MCPSearch

The record29 September 20264 min read

The record: week ending 28 September

What the daily observations show for the seven days to 28 September 2026. Every figure here is a count of things observed, drawn from the published daily snapshots.

Registry observations, 22 to 28 September 2026

Servers
34,820 → 37,023  (+2,203, +6.3%)
Versions
112,404 → 123,880  (+11,476)
Version entries added
13,420
Status changes
487
No longer listed
123 versions

The headline is growth, and it is fast. The registry gained servers at a little over 6% in seven days. Sustained, that is a doubling roughly every eleven weeks. We would not bet on it being sustained, but it is what this week did.

The version count grew faster than the server count, which is the normal shape: most of any week's additions are new releases of things already present rather than genuinely new projects.

The one anomaly worth pointing at

Status changes ran between 19 and 52 a day for six days, and then 299 on 28 September. That is roughly six times the highest other day of the week, and about eleven times the median.

DayAddedStatus changesNo longer listed
22 Sep1,830275
23 Sep1,1335259
24 Sep1,5721918
25 Sep2,918437
26 Sep1,922278
27 Sep2,2982013
28 Sep1,74729913

We do not know why. A status change means the registry reported a different status for a server-version than it did the day before. A spike like this is consistent with a bulk administrative action, a change in how the registry classifies something, or a batch of publishers acting at once. We observed it; we have not established the cause, and we are not going to imply one.

It is on the record with a date, which means that when an explanation does surface, there is something to check it against. That is the whole use of writing things down before you understand them.

Things that stopped being listed

123 server-versions were listed at the start of the week and not at the end. The heaviest single day was 23 September with 59.

Worth repeating, because it is the most misread field on the site: "no longer listed" is not "deleted" and it is not "abandoned". We observed that a listing stopped containing an entry. A maintainer tidying up old versions and a registry removing something look identical from here. The record says what it saw.

What it does mean is that those versions are now harder to inspect anywhere else, and the ones we retrieved an artifact for are still here, addressed by the hash of their bytes.

What is not in this week's numbers

You will notice there is no figure for artifacts that changed under a fixed version: the tampering signal, and the number a supply-chain report would most want to lead with.

That is deliberate. Our change feed currently counts repository references moving and package artifacts changing as the same kind of event, and they are not remotely the same thing: a branch head advancing is ordinary development and happens constantly, while a published version's bytes changing is rare and significant. Publishing the combined number would produce an alarming figure that is mostly people committing code.

Separating them is engineering work in progress. Until it lands, that number does not appear here. A number you cannot trust is worse than no number, particularly this one.

Where these figures come from. The daily snapshots produced by the metadata crawl, one per day, published back to 8 August 2026. "Servers" and "versions" here are the official MCP Registry view; the site-wide totals on the home page are larger because they include repositories and catalogue listings observed outside the registry. Dates are observation dates, not publication dates.

Previously: MCP supply chain security: what registries forget · Check any of this in the portal