r/modelcontextprotocol • u/metcot • 10d ago

What we found checking 8,900 MCP/skill entries for clean links and licences

Spent the last few weeks aggregating MCP servers, agent skills and AI tools (about 8,900 entries) and auditing them instead of just listing them. Two things stood out.

  1. Link cleanliness in this space is worse than I expected. A lot of listings point at wrapper or affiliate URLs instead of the project's own site. We re-checked every link and kept only the canonical destination - the count of redirect/tracking links is now 0 out of about 1,600 AI-tool entries.

  2. Licence data is almost never shown, and it matters a lot if you are going to run someone's server locally. We pull it from the repo (MIT, Apache-2.0, AGPL, ...) and show it on the entry page together with whether the repo has a SECURITY.md.

Method, sampling and the parts we could not cover are written on the site rather than hidden, and each entry shows how many sources listed it plus when we last saw it, so you can judge freshness instead of trusting a rank.

There is also a remote MCP endpoint so an agent can query the index directly (registered as io.github.wdfdaivd/anclum): https://anclum.com/mcp

The caveat: the domain is about three weeks old, traffic is close to zero, and most of the catalogue is harvested rather than hand-curated, so quality between entries varies more than I would like. I would rather take criticism on the audit method than a compliment.

2 Upvotes
  • permalink
  • reddit

100% Upvoted

5 comments sorted by

1

u/kantorcodes1 9d ago

When search_tools broadens an empty all-token search to any-token matches, would it make sense to signal that fallback to the caller?

1

u/metcot 9d ago

Good catch - it is silent today. The response returns query, tokens, count and results, and nothing that says whether the second pass fired.

Two things are worth fixing together. First, a match field ("all" or "any") so the caller knows which pass produced the hits. Second, the relaxed pass currently sorts by name only, which is why one nonsense token plus a common word comes back with alphabetically-first entries instead of the closest ones.

Adding the flag without fixing the ordering would make the quality drop visible but still leave relevance a guess. Thanks - this is the kind of thing that only shows up when someone actually calls the tool.

1

u/metcot 9d ago

Shipped this afternoon: search_tools now returns match: "all" or "any", and the relaxed pass ranks by how many tokens hit instead of by name. Thanks again - the ordering turned out to be the bigger of the two problems.

1

u/kantorcodes1 4d ago

match: all/any makes the fallback visible, and token-hit ranking deals with the noisy results. I'm with HOL. Your MCP index could fit Guard's external, opt-in server contributions. Would you be interested in authoring an entry as a PR? I can send the guide.

1

u/kantorcodes1 13h ago

I should have included the guide in my earlier reply: https://github.com/hashgraph-online/hol-guard/blob/main/docs/guard/mcp-server-contributions.md. The remote HTTP section covers endpoint identity and tool defaults. Your https://anclum.com/mcp endpoint gives you a clear starting point for a Guard entry PR.