The MCP registry checks a package at publish. Here’s what drifts after that.

Description and use

In the MCP registry, package checks run only at publish time and when an entry is edited, causing drift in links and versions. As of 2026‑10‑04, 13.3 % of entries had broken repositories, withdrawn packages, or non‑installable versions. A feature request proposes periodic re‑validation to record status and avoid silent removals.

Problem

Registry entries can drift after initial validation, leading to broken links, withdrawn packages, and outdated metadata.

Outcome

At least 13.3% of 38,977 MCP registry entries had issues such as 404 repositories, withdrawn packages, archived repos, or non‑installable versions.

Workflow

• 1. Open the registry entry’s repository.url and verify it loads.
• 2. Check that the listed package version is still published and not deprecated or yanked.
• 3. If the package has been renamed or moved, publish an updated entry pointing to the new location.

Evidence

The registry checks that version when the entry is published: it fetches it from npm or PyPI and confirms the package names the server.

Source

The package check runs again only when the publisher edits the entry. Nothing re-checks entries on a schedule.

Source

Registry snapshot 2026-10-04: 38,977 servers (the latest version of each name).

Source

At least 5,192 of 38,977 entries (13.3%) had at least one of these issues.

Source

I opened a feature request on the registry, modelcontextprotocol/registry#1715. It asks to re-run the existing checks on a schedule and record the result (for example lastVerifiedAt plus a status) instead of deleting anything.

Source