Daily MCP Registry Digest (2026-03-22)

by

Daily MCP Registry Digest (2026-03-22)

Overview

  • Total updated servers (new “latest” version present in this snapshot): 14
  • Deprecated servers: 0
  • Deleted servers: 0

Note: This digest is derived from the provided registry snapshot (which includes multiple historical versions per server). “Updated” here means a server has an identifiable latest entry and at least one prior non-latest entry also present in the snapshot.

Notable changes

  • ai.adramp/google-ads → 1.0.3: transport moved from sse (1.0.0) to streamable-http (>=1.0.1) and the endpoint normalized to https://mcp.adramp.ai. Website URL added in 1.0.3.
  • ai.adadvisor/mcp-server → 1.0.1: documentation/website URL updated and authorization header guidance refreshed (still bearer-token based).
  • ai.cookiy/cookiy → 1.7.9: rapid patch progression (1.7.5 → 1.7.6 → 1.7.7 → 1.7.9) with repository reference shifting from cookiy-code to cookiy-skill and a stable remote endpoint (https://s-api.cookiy.ai/mcp).
  • ai.kawacode/mcp → 5.0.4: patch train (5.0.2 → 5.0.3 → 5.0.4). Also note a packaging inconsistency in 5.0.3 where the package version remained 5.0.2 while the server version is 5.0.3; 5.0.4 aligns again.
  • ai.marketcore/mcp → 1.0.2: branding/title cleanup (“MarketCore”), website URL added, icon added, remotes continue to offer both streamable-http and sse.
  • ai.mcpcap/mcpcap → 0.9.6: multiple releases in short succession (0.6.4 → 0.7.0 → 0.8.0 → 0.9.0 → 0.9.1 → 0.9.2 → 0.9.6), indicating a fast-moving package line for operators pinning PyPI versions.
  • ai.obris/mcp → 0.4.0: stepped releases (0.2.5 → 0.2.6 → 0.3.0 → 0.4.0) with stable remote base (https://mcp.obris.ai/) and consistent API-key env var requirements.
  • ai.openmandate/mcp → 0.5.1: endpoint migrated from https://api.openmandate.ai/mcp (0.3.1) to https://mcp.openmandate.ai/mcp (>=0.3.2), with continued bearer auth requirement.
  • ai.perplexity/mcp-server → 0.8.4: npm package updated from 0.8.3 to 0.8.4 (stdio transport).
  • ai.rolli/mcp → 1.1.7: patch train (1.1.4 → 1.1.5 → 1.1.6 → 1.1.7) plus environment variable semantics changed (ROLLI_USER_ID became optional with a default).
  • ai.social-api/socialapi → 1.0.1: versioning/packaging alignment is unusual: earlier entries show server version 0.1.0 / 1.0.0 while the npm identifier version is 1.0.1; latest is server 1.0.1 with package 1.0.1.
  • app.cardog/mcp → 1.0.1: patch update from 1.0.0 to 1.0.1; both streamable-http and SSE endpoints preserved, using an api_key URL variable pattern.
  • app.himalayas/mcp → 1.0.2: iterated releases (1.0.0 → 1.0.1 → 1.0.2) adding title, icons, website URL, and an additional SSE remote alongside streamable HTTP.
  • app.marketgenius/mcp → 2026-03-19: date-stamped release cadence (2026-03-15 → 2026-03-18 → 2026-03-19) on a stable remote (https://marketgenius.app/mcp).

Why it matters for operators

  • Transport changes impact clients and networking: the Google Ads server’s shift from SSE to streamable HTTP may require client configuration updates (proxy behavior, timeout semantics, and connection management differ).
  • Endpoint migrations can break integrations if pinned: OpenMandate’s move to mcp.openmandate.ai and similar hostname/URL adjustments require updating allowlists, DNS policies, and service discovery configs.
  • Rapid patch trains increase pinning risk: projects like mcpcap, Cookiy, Rolli, and Marketgenius show frequent releases; operators should pin versions deliberately and schedule upgrade windows rather than auto-tracking “latest” in production.
  • Metadata/packaging mismatches are operational footguns: Kawa Code (5.0.3) and SocialAPI entries demonstrate that server version and package version can temporarily diverge; CI installs and SBOM/asset inventories should validate actual installed artifact versions, not just registry title/version fields.
  • Auth and secret handling remains consistent but must be enforced: several servers require bearer tokens or API keys via headers/environment variables; ensure secrets are injected via approved secret stores and avoid logging request headers.

Leave a Comment