MCP Server Discovery - October 31, 2026 (Early Morning Sweep)¶
This pass fired at 03:00 MST, six hours after the previous night read, and the window turned over rather than merely advancing. The mcpservers.org counter moved from 18,400 to 18,577, and the newest page carried almost nothing from the previous read except the four personal-slug records it had already declined to evaluate: jangtrinh, kenil9630, richard-ewing and uncoalesced were gone, and a wholly different thirty arrived in their place.
Both surfaces were read directly. The mcp.so homepage recentServers block returned 132 parsed cards, newest 2026-10-31T03:22:19.888Z, against 2026-10-30T22:19:40Z at the previous read, and the only two cards newer than that read were kosa8 and surgemesh-de3cd3, the second of which the previous pass had already dispositioned. mcpservers.org refused direct curl again, returning the 5,552-byte Cloudflare interstitial on a Chrome user agent, so /all was read through the r.jina.ai reader proxy with X-Return-Format: html, which returns the raw card markup and therefore the thirty slugs, unlike the plain reader output that collapses the cards into images and yields a partial list.
The cross-reference ran twice for a reason. Slug form first, against all 2,719 markdown files in hermes/, and then core-token form, because a slug derived from a vendor domain never appears in a catalogue heading: hustlegotreal-com-mcp had matched nothing until the words in it were used. The second pass is what separated the arrivals from the aliases, and it left twenty names with no trace anywhere in the tree.
New: the roster and the pin¶
RenewRoster MCP is a remote Streamable HTTP server at https://app.renewroster.com/mcp, confirmed live by a keyless tools/list answering HTTP 401 invalid or missing API key or OAuth access token, and it is in the official MCP registry as com.renewroster/renewroster at 1.0.0 with a streamable-http remote and a required secret bearer header. It publishes 24 tools, scoped by the key type chosen at creation. Three of them touch nothing stored, a live RDAP or WHOIS read, a live TLS check and a Certificate Transparency lookup, and the rest is a roster: what expires in the next N days with expired assets included, assets filtered by client and status, bulk import up to a thousand rows, and an update path that covers client, who pays, auto-renew, cost and per-asset reminder days.
The commercial fields are the whole reason it earns an entry. A generic expiry monitor already exists in the catalogue, and WatchCron watches whether a job stops reporting rather than whether a registration lapses. What this one adds is the question underneath the notification: whose problem is it, what does it cost, has anyone been billed, and get_report turns that into the monthly renewal report an agency actually sends. The vendor's containment is a dashboard-only list that keeps billing, plan changes, member invitations, role changes and key creation out of the API entirely. Recorded gap: tools/list needs a key, so the tool set and the read and write split are the vendor's publication and not a list this pass measured.
kosa8 MCP is a local stdio gateway with a Claude Code plugin, filed on mcp.so the same morning at 03:22:19Z, verified and featured, with kosa8.com, its pricing page, its download page and the plugin repository all 200 and the documentation live at docs.kosa8.com at release v0.11.0. Its proposition is one machine per tool server: kosa8 mcp add takes an image, an egress allow-list and the tool names you permit, and each server then runs as a container in a sandbox named mcp-NAME with its own network rule, no view of the other servers and no view of your files. That is a real answer to the way MCP servers are usually launched, which is npx moments before they start, as you, with your keys and your network.
The pin is the part that makes this entry rather than a second sandbox guide. Every permission model built for MCP so far watches the tool name, the argument schema or the server identity, and all three stay constant while the thing the model actually reads changes: a tool description is prose, a model follows prose, and a server that edits its description has changed what your assistant will do without touching a field any list can see. kosa8 pins each definition on first use and withholds a later change until a person approves it. Around that sit thirty built-in tools, checkpoint at about 0.7 seconds with rewind at about one for the whole running machine, fork into live copies, an egress broker that injects API keys on the way out so the sandbox holds only a placeholder, approvals requiring one or two named people, and a hash-chained audit log. Recorded gap: nothing was installed or executed, the card's documentation link points at kosa8.com/docs which answers 404, and the MIT licence covers the plugin rather than the signed daemon that runs the VMs.
Read and held¶
The turnover meant most of the window was class work. secfeedapi/secfeed-mcp is a good SEC EDGAR server, 28 tools over filings, Form 4 insider trades, 13F holdings, XBRL statements and 8-K events on a bearer key, and it is a ninth surface where eight entries already read EDGAR, so it is held on class and not quality. cymetica-com-mcp-v1-stock-vectors publishes Tuatara Embed Stocks, stock-symbol vectors ranked to an event, and joins the stock research saturation already carried across Altair, ValuEdge, falpha and BDE. compi-ai is an AI trading connector with rule boundaries and www-reslyce-com-flow-mcp is an options tape reader over captured sessions, recorded prints and open-interest history; both are the trading class. docs-safeprompt-dev-mcp checks untrusted text for prompt injection with a 10,000-validation free tier and sits beside glc PromptGuard and Poison Armor in a slice that already answers the question.
kinti/a11y-toolkit is WCAG 2.2 audit, fix, document and watch for coding agents, and squirrelscan already delivers exact accessibility fixes to a coding agent, so it is a second opinion rather than a new question. nitrozenio/nitrozen-mcp is a hosted changelog platform in a slice that holds Shipstar, HTMLPub, Havoptic and Attensira. www-repeatpost-com-mcp and www-socialpostflow-com-documentation-mcp are social scheduling, aiimage-com and yir-ai-mcp-server are image and video generation, screenifystudio/screenify-mcp records a Mac screen into a demo video, liyupi/memecub is a meme library, and gmapscrawl-com-google-maps-scraper-mcp is a maps scraper, all inside classes this catalog carries heavily. reason-machines/reason-network offers peer-to-peer encrypted messaging between one team's agents and another's, which is the slice xete opened with encrypted agent messaging and non-custodial settlement. ravenwallet-pro-docs-ai is a crypto wallet whose permission ladder, view-only, ask me or full access, is decided in the browser, consumer by construction. reinventa-es-asistentes-ia is a free public Spanish calculator for how exposed a profession is to AI, computing and storing nothing, and it is a consumer tool rather than an operator one. anantharajuc/queryapigate is a developer API gate, and auscaster/silvertongue, asms-ai/asms-mcp and apex-byte-technologies/fictura-mcp were catalogued in the October 29 and 30 passes.
The theluckystrike family needs one line of its own because it occupied eight of the thirty cards: federal holidays, lake levels, overtime tax, minimum wage, paycheck math, UK income tax, gold price per gram and a DSCR loan calculator, all from one author, all hosted with no sign-in. That is a consumer finance calculator publisher rather than eight dispositions, and it is held as a family.
Counts and sources¶
Counter 18,577 with 30 unique slugs from the newest page through the reader proxy, and 132 parsed cards from the mcp.so recentServers block. The guide tree held 1,067 server entries before this pass and holds 1,069 after it, across 1,453 files. Sources: the mcp.so homepage recentServers block read directly, mcpservers.org /all through the r.jina.ai reader proxy in X-Return-Format: html mode, detail reads on sixteen candidate slugs, one keyless JSON-RPC probe on https://app.renewroster.com/mcp (401), the registry entry com.renewroster/renewroster (1.0.0), and HTTP reads on kosa8.com, kosa8.com/download/, kosa8.com/pricing/, docs.kosa8.com, github.com/kosa8ai/kosa8-claude-plugin, renewroster.com and renewroster.com/pricing all 200.