Every MCP catalogue shows you a list. mcpbeat shows you what happens to a server over time. I ping 12,000+ live servers every 15 minutes and keep the history. 2,320 of them are dead while the official registry still lists them as active. I pull real install counts from npm and PyPI instead of GitHub stars. And I read the source: file access, shell calls, install hooks. Every finding comes with the file, the line, and a link to the exact commit I read, so you can check it in a minute.
I kept plugging MCP servers into my agents and kept getting burned by the same thing. The directory said the server existed, and that was all it said. Not whether it answers. Not whether anyone actually uses it. Not what it does with my filesystem once it's running.
So I started measuring instead of listing.
mcpbeat pings every reachable MCP server every 15 minutes and keeps the history. That history is the part you can't fake retroactively, and it produced the number that still surprises me: 2,320 servers are dead while the official registry still lists them as active. Roughly one in six.
Two other things I wanted and couldn't find anywhere.
Real usage. GitHub stars are a vanity metric. A server with 4k stars can have 30 installs. I pull weekly download counts from npm and PyPI instead. Playwright MCP: 5.8M a week. Context7: 867k.
What the code actually does. I read the source and report file access, shell calls, network calls, install hooks. Every finding comes with the file, the line, and a link to the exact commit I read. If you can't verify a claim in a minute, I shouldn't be making it.
On that last point, one thing I'd rather say myself than have someone find. Automated rules are wrong in both directions. Last week I went through my own findings by hand, opening each one on GitHub. Fifteen defects in my own rules. I was flagging Japanese prose as "encrypted code", a developer's own deny-list of dangerous paths as "requests docker socket access", and a commented-out line in a Dockerfile as a high-severity finding. All fixed, all covered by tests, and there's now a daily check that runs my rules against known-malicious packages and against the ten most-installed servers in the ecosystem.
Find a wrong finding on your server and tell me. I'll fix the rule, not just the finding. Claiming your server is free and always will be. It exists so there's someone to answer when I get it wrong.
Built solo, bootstrapped. Happy to answer anything here today.