Two days ago we ended a writeup with: "the 367 we're missing — plus 27 official npm packages — are queued for the next ingestion run. Publishing the gap is the point."
This is that run. The queue is closed: +1,097 servers indexed, 66,496 → 67,593.
- Directory: marketnow.site/mcps
- All 67,593 pages declared in the sitemap index
- Live API: api/skills?sort=recent — the batch entries carry
indexed_at: 2026-09-12
What went in
230 from GitHub topic search — topic:mcp-server, topic:model-context-protocol, plus language slices (Go, Rust, C#, Java, TypeScript) and repos pushed since July. Every entry keeps its real star count and language in the source record.
165 from the npm registry — the 27 vendor packages we named publicly (@heroku/mcp-server, @storybook/mcp, @mapbox/mcp-server, @doist/todoist-mcp, argocd-mcp, @drawio/mcp...) plus 138 more surfaced by registry search, each with its real weekly-download count from the npm downloads API.
702 from the awesome-mcp-servers reconciliation — we re-ran the diff against the curated list with exact repo-URL matching instead of name matching. The stricter matching surfaced 769 repos we genuinely didn't have; 67 turned out to already live under a different identity, the rest went in.
The check that matters more than the count
Here's the part I want you to steal for your own directory.
Of those 769 awesome-list repos, 347 have an npm package with the same name as the repo. Naive ingestion would stamp npx -y <that-name> on all 347. We checked where each package's repository field actually points: only 159 point back to the same GitHub repo. The other 188 same-name packages belong to someone else's project.
Recommend npx on one of those and you've done the typosquat's job for it — installed look-alike code with a legitimate name on top. So the rule in this batch: an awesome-list entry only gets an npx install line if the package's own metadata points home. The rest get git clone and a yellow install-risk, which is honest: no registry code execution, but no verified publisher either.
Same-name ≠ same-project. 188 out of 347 is not an edge case.
What we're still not claiming
Everything in this batch is review_status: auto-scanned, tier core, index heuristics only — trust scores start at 40 and rise with real signals (log-scaled stars/downloads, capped at 88). No L2 deep-scan certificates were issued, because no deep scans ran. A page still says indexed and classified, never verified. If your directory conflates those two words, it's selling certainty it doesn't have.
And the new gap, published like the last one: GitHub reports ~28,000 repos tagged mcp-server. We index the ones where the name, description or topics say MCP server and the repo isn't a fork or a shell — the difference between that and 28k is mostly platforms that merely support MCP. We choose precision; the diff stays observable.
Indexing notes
The sitemap grew to 67,593 URLs across the same three files, and the registry now tracks 131,942 servers across GitHub, npm, PyPI, Smithery, the official registry, crates.io and Docker Hub. If you run an MCP directory yourself, the full breakdown is in catalog-meta.json — comparing coverage against a competitor's claims is the fastest way to find out who's counting ghosts.
(MarketNow is our project — free registry, free search API. The previous writeup, with the honest 50,632-red distribution and why "red" is a definition rather than an accusation: 66,496 pages, all crawlable.)
Top comments (0)