Facts re-checked
free facts of the 33,102 servers unchanged since 2026-10-23, re-read 2026-10-24; all npm/PyPI dependency audits re-run 2026-10-24.
Compared with the facts published after the 2026-10-23 refresh (read 2026-10-06 to 2026-10-23); the facts compared now were read 2026-10-22 to 2026-10-24. Read again in this run: package, GitHub and OSV facts of 33,102 servers, version pins of 11,830 servers, npm dependency audits of 11,756 servers, PyPI dependency audits of 4,535 servers, repository languages of 33,102 servers. 48,551 servers had the same listed version in both and were compared (a fact that was not read again is the same reading on both sides). 410 readings where our own lookup failed are left out of every count.
- Package downloads (last month) changed8,279
905 of them moved to another band; the bands are 0–9, 10–99, 100–999, 1,000–9,999, 10,000–99,999 and 100,000 or more
For example: agency.kesey/pretrip, ai.adeu/adeu, ai.adtest/adtest-mcp, ai.aetherwealth/mcp, ai.agent-bev/bev-door
- GitHub stars changed2,564
For example: ac.tandem/docs-mcp, agency.ottobot/business-contact-finder, agency.ottobot/contractor-license-changes, agency.ottobot/licensed-house-painters, ai.adeu/adeu
- Version-pin status changed425
current → behind: 354 (16 of them also deprecated or yanked, 15 newly); current → package missing: 35; behind → package missing: 21; current → listed version missing: 7; behind → listed version missing: 4; behind → unknown: 2; ahead of the latest release → behind: 1; unknown → behind: 1 (1 of them also deprecated or yanked)
For example: ai.autonomad/travel, ai.chronary/mcp, ai.decimal/registry, ai.intodns/scanner, ai.llmintel/model-lifecycle
- Listed version newly withdrawn (deprecated or yanked)29
For example: ai.telbase/deploy, co.truncus/mcp-server, com.brick-byte/footnote, io.github.Braynexservices/nigeria-admin-divisions, io.github.Braynexservices/nigeria-bank-resolve
- Listed package or version newly missing (install fails)67
For example: com.star-meet/mcp-starmeet, com.unifiedoffer/mcp-server, eu.ansvar/argentine-law-mcp, eu.ansvar/australian-law-mcp, eu.ansvar/botswana-law-mcp
- Repository link now gives 404 (gone or private)127 entries
114 repositories
For example: ai.smithery/jirispilka-actors-mcp-server, app.countlink/countdown, app.vercel.flightsweeper-webmcp/public, com.ai2fin/ai2fin-tax-mcp, com.aikstockdata/mcp
- Repository link works again205 entries
17 repositories; 186 of the entries link one repository, mrfentmen/awesome-mcps
For example: app.vercel.groundtruth-ruby/groundtruth, com.productclank/productclank, info.storiesig/instagram-mcp, io.github.171county/modwrench, io.github.DIALLOUBE-RESEARCH/hypernatt-terminal
- Repository newly archived32 entries
30 repositories; 6 entries (5 repositories) no longer archived
For example: ai.arpi/arpi-mcp, ai.memcell/memcell, ai.smithery/keithah-tessie-mcp, cc.servelink/serve, com.gfbytes/mcp-oauth-connect
- npm dependency audit: servers with a high or critical vulnerable package1,112 → 5,583
of 11,441 audited in both runs; 4,512 newly, 41 no longer. Same listed versions on both sides: such a change comes from the advisory database or the dependency versions resolved on the day, not from a new release of the server
For example: agency.kesey/pretrip, ai.achromat/mcp-server, ai.aetherya/mcp, ai.agenticaffiliate/affiliate-networks-mcp, ai.agentutility/mcp-agentops
- PyPI dependency audit: servers with a high or critical advisory173 → 217
of 4,226 audited in both runs; 54 newly, 10 no longer
For example: com.knitli/codeweaver, com.travelanimator/mcp, io.github.AIYantra/extra, io.github.ArkNill/embgrep, io.github.Artexis10/exomem
- Package itself has a known vulnerability (OSV)5 → 5
of 16,291 looked up in both runs
For example: io.github.MervinPraison/praisonai
- Package licence changed0
- Main repository language changed66
For example: ai.hyreflow/hyreflow, ai.objekts.mcp/production-desk, ai.spelunking/hub, app.traderspy/traderspy, app.vercel.ora-x402-gateway/sensations-mergulho
- Facts of the same server and the same listed version, read in two runs. A change is a difference between two readings of public records, not a judgement of the server or its publisher; no reason is given or guessed.
- Our own failures (rate limits, network errors, a tool that could not run) are never counted as changes: 410 field readings were left out for that reason (ourLimit).
- 0 servers listed a different version in the two runs and are not compared here (new version: see the registry changes).
- Dependency audits: npm audit counts vulnerable packages in the resolved tree; the PyPI audit counts OSV advisories in the resolved tree. A count can move because the advisory database changed, without any change to the server.
- Same listed versions on both sides: the rise in npm servers with a high or critical vulnerable dependency comes from the advisory database, which changed between the two reads (GitHub reviewed GHSA-mrhx-c7xc-m3w5, zod below 4.6.6, severity high, on 2026-10-23 18:26 UTC; read from api.github.com 2026-10-24), and from dependency versions resolved on the day of each audit. It is not a new release of these servers. The audit rows keep counts only, not advisory ids, so the share due to that one advisory is not measured.