Methodology

What we collect, how, and what we deliberately do not claim. Version 1, 2026-10-19.

What we do

Once a day we read the public APIs of five registries: the official MCP Registry, ClawHub, Smithery and the npm registry (both search and per-package documents). We record a normalized copy of each extension’s published record. We compute a SHA-256 hash over that normalized record. When the hash differs from the previous observation, we store a new observation. Identical re-reads are not stored.

What we record

• Identifier, published version, description and declared source repository.
• For npm packages: the upstream content integrity hash, lifecycle scripts that run at install time, declared dependencies, accounts holding publish rights, and declared license.
• The UTC timestamp of every observation.

What we exclude, and why

Counters that move constantly (download totals, install counts, usage figures) are recorded but deliberately excluded from the hash. Including them would make every daily read look like a change and render the entire record meaningless. Verified: an immediate second collection run across all sources produced zero changes.

What we do not claim

We do not label extensions as abandoned, dead, malicious, safe or verified, and we publish no composite score. Those are conclusions; we publish the timestamped observation that a reader can use to reach their own. “No issues detected” would mean nothing here, so we never say it: absence of a recorded change is not evidence of safety. We do not execute, sandbox or behaviourally analyse any extension.

Known limitations

• We observe what registries publish. If a registry’s record is wrong or stale, ours inherits that.
• Registry search payloads carry descriptions but not permissions. Changes visible only inside package contents are captured for npm packages and not yet for other sources.
• A repository URL returning 404 may mean deleted, renamed or made private. We report the observation, not the cause. When we sampled 120 MCP Registry listings, all 36 non-resolving repositories were re-checked authenticated and following redirects; 36 of 36 still did not resolve.
• Coverage is a subset of each registry, bounded by page limits, and grows over time.
• The archive begins on the date shown on the overview page. We cannot report on anything before it.