Methodology

What is listed

Active latest registry entries with a GitHub repository, an npm or PyPI package, and a description of at least 20 characters. One listing per repository, keeping the longest description. The 30 most recently updated repositories are always kept. Up to 290 more are an even spread across the rest; after metadata is fetched, the spread is cut to the most-starred repositories until the catalog reaches 160. A missing star count sorts last and can drop a spread row.

The catalog covers 49058 latest registry rows across 491 pages, metadata for 320 repositories, and 160 listings chosen from 13368 candidates. The catalog holds up to 160 listings.

Listings come from the official MCP registry, plus package and repository metadata for those entries. Cursor rules, skills, and client-only plugins are not separate catalogs, because there is no structured public feed for them. An MCP server can still be filtered by inferred client fit.

Sources

If a source does not return a value, the field is null. Listings do not estimate or fill missing numbers.

Field	Source
Name, description, version, transport, package id, remote URL	Official MCP registry
License for npm packages	npm registry, one published version
License for PyPI packages	PyPI JSON API
Stars, last push, archived flag	ecosyste.ms public repository metadata
Last commit date	The repository's public GitHub commit feed. Author fields in that feed are discarded.

AddonAudit links to the repository, the package page, and the registry record. It does not copy source code into this site.

Some lookups failed and those fields stayed blank: 2 PyPI license lookups did not return a license, so those fields were left blank., 53 repository lookups did not return stars or a push date, so those fields were left blank., 38 commit feeds did not return a date, so those fields were left blank..

Install commands

npm packages become npx -y name@version. PyPI packages become uvx name==version. Flag arguments published in the registry are included. Positional arguments are left off, so a transport name is not pasted into the command. Docker is shown only when the registry already published the arguments. Commands that would need a guessed runtime, or that contain characters that do not belong in a package name, are omitted.

Client fit

• stdio — cursor, claude, codex. A stdio package is treated as a fit for Cursor, Claude, and Codex because those clients can launch local MCP servers. This is not a certification.
• streamable-http — cursor, claude. A streamable HTTP remote is treated as a fit for Cursor and Claude. Codex is not marked for remote transports.
• sse — cursor, claude. An SSE remote is treated as a fit for Cursor and Claude. Codex is not marked for remote transports.

Categories

Categories come from the title and description only. The registry namespace is not used, so a name that merely contains a forge host does not pick the category.

Category	Rule
Browser	\b(browser|playwright|puppeteer|selenium|chromium|firefox|chrome)\b
Database	\b(database|postgres|postgresql|mysql|sqlite|mongodb|mongo|redis|bigquery)\b
DevOps	\b(docker|kubernetes|\bk8s\b|terraform|cloudflare|helm|ansible|aws|gcp|azure)\b
Search	\b(search|tavily|algolia|elasticsearch|serp)\b
Files	\b(filesystem|file system|object storage|s3\b|google drive|dropbox)\b
Source control	\b(pull request|gitlab|git\b|github|commit)\b
Memory	\b(memory|knowledge base|vector store|embeddings|\brag\b)\b
Communication	\b(slack|discord|email|notion|calendar|telegram|sms)\b
Observability	\b(sentry|grafana|opentelemetry|\botel\b|logging|metrics|tracing|datadog)\b
Design	\b(figma|screenshot|diagram|wireframe)\b
Media	\b(video|audio|podcast|transcribe|transcription|image generation)\b
Data	\b(spreadsheet|\bcsv\b|excel|airtable|dataframe|pandas|analytics)\b
Security	\b(security|vulnerability|\bcve\b|oauth|pentest|secrets)\b
Docs	\b(documentation|markdown|wiki|confluence|readme)\b
Other	Used when no category rule matches the title or description.

Metadata score

The weights below are the ones stored with this catalog. They are the whole formula.

Signal	Points
Recognized SPDX license	30
Activity within 90 days	30
Activity within 365 days, if the row above did not apply	15
Description of at least 40 characters	15
Install command or public remote URL	15
Repository URL	10
Payment	0
Maximum	100

• Recognized SPDX license: 30 points. A missing license or the value UNLICENSED scores 0.
• Activity within 90 days: 30 points. Activity within 365 days: 15 points. Activity is the last commit date, otherwise the last push, otherwise the registry update time.
• Description of at least 40 characters: 15 points.
• Install command or a public remote URL: 15 points.
• Repository URL: 10 points.
• Maximum score: 100.
• Payment has weight 0. A listing has no payment field. Payment never changes a score.
• Metadata quality is high at 70 or above, medium from 40 to 69, and low below 40.
• The repository activity check is true when the repository is not archived and activity is within 180 days. It is false when the repository is archived or the activity is older than 180 days. It is null when no activity date is known.

Checks

• Repository activity uses the 180-day window described above.
• License is a recognized SPDX id from the package registry, or from repository metadata when the package record has none.
• Metadata quality follows the score bands in the notes.
• Tool count is filled only when the registry publisher metadata includes a tool list or an explicit count. Descriptions that mention a number are not parsed into a tool count.

Sandbox tests are not run. Payment never changes a score.

Refresh

The catalog is updated weekly from the public sources above.