DEV Community

md sultan mahamud
md sultan mahamud

Posted on AI-assisted

Narrow 54,988 MCP registry entries to a shortlist with URL filters

#ai #mcp #opensource #devtool

You need an MCP server for one job, and the official registry lists 54,988 of them (counted 2026-11-02). Scrolling won't work. A name search only helps if you already know the name.

Here is how I narrow the list using plain URLs. It needs no account and no key, and nothing runs on your machine until you decide to install something.

Step 1: Start from the directory in the order you care about

The browse page takes a sort parameter. These are the orders it supports:

  • sort=downloads: monthly downloads from npm or PyPI
  • sort=stars: GitHub stars of the linked repository
  • sort=released: the registry date of the latest release
  • sort=listed: when the earliest listed version entered the registry, newest first 
https://protocolprobe.com/mcp/servers/browse?sort=downloads
Enter fullscreen mode Exit fullscreen mode

Servers without the figure, such as remote servers that publish no download count, follow in name order. A missing download figure means there is no figure to count. It says nothing about the server.

Step 2: Add filters until the list is small

Filters stack in the query string. These are the ones the browse page accepts:

filter values
runs remote, local, both
pkg npm, pypi, mcpb, oci, nuget, cargo
license permissive, copyleft, other
maint active, slowing, stale, archived
prov attested, repo, norepo
read yes

prov=attested means an npm build-provenance attestation exists. prov=repo means the source repository opens publicly, and norepo means the repository link does not open. read=yes keeps only servers whose tool list was read.

A shortlist for "local, npm, permissive licence, recently pushed to, tool list available" looks like this:

https://protocolprobe.com/mcp/servers/browse?sort=downloads&runs=local&pkg=npm&license=permissive&maint=active&read=yes
Enter fullscreen mode Exit fullscreen mode

Add lang=<language> or topic=<topic> to cut further. The topic is an AI reading of the publisher's description. Two differently worded runs had to agree, and nobody checked it by hand.

Step 3: Open a candidate and read the record

Every entry has a page at /mcp/servers/<namespace>/<name>. Three anchors do most of the work:

  • #record-checks shows how many of nine record checks are met. The nine are facts from public records: entry active and runnable, repository opens, not archived, pushed in the last 90 days, SECURITY.md, SPDX licence, listed version installs, npm build attestation, and no known critical or high advisory. A check that does not apply or could not run is listed but never counted.
  • #setup gives the client configuration from the registry entry, and names the inputs it needs.
  • #offers lists the tools as the server itself listed them. The list was read without calling any tool.

The count rates nothing. Two servers with the same count can differ in ways the nine facts do not cover, and a server that meets fewer of them can still fit your job.

Step 4: Compare two finalists side by side

When two candidates remain, put them next to each other:

https://protocolprobe.com/mcp/compare?a=<namespace/name>&b=<namespace/name>
Enter fullscreen mode Exit fullscreen mode

The page shows the same values as the two server pages and marks the rows that differ. There is no winner row.

Step 5: Script it if you need an allowlist

If your team keeps a list of permitted servers, the allowlist export returns every entry, 500 per page, in the official registry's server shape plus dated facts. It comes as JSON or NDJSON:

https://protocolprobe.com/api/v1/export/allowlist
Enter fullscreen mode Exit fullscreen mode

These are facts, and nothing in the export approves a server. You apply your own rules on top.

How the figures were counted

The 54,988 is the size of the registry list on 2026-11-02. The registry changes every day: the pull of 2026-11-02 shows 588 servers listed for the first time, compared with the pull of 2026-11-01. A shortlist you build today will differ next week, so keep the URL, not the names.

Of those 54,988, 25,993 had a tool list read (also as of 2026-11-02). read=yes therefore drops a large part of the list. That is a coverage limit of the reading, and tells you nothing about the servers it drops.

Limits of these filters

  • Filters read public records: the registry entry, npm or PyPI, and the linked GitHub repository. They say nothing about how a server behaves when it runs.
  • A "no known advisory" fact covers what the advisory databases held on the day it was read.
  • Downloads and stars count popularity. They can't tell you whether a server suits your job.

Where to look

Top comments (0)