👑

MCP QUEEN

Ecosystem Reports / August 4, 2026

Repository URLs are not MCP identities

MCP servers move faster than many directories can revalidate their metadata. A repository can be renamed, transferred, archived, made private, or deleted while the server name and remote endpoint continue to exist.

Twenty-one percent of this dated sample was not stable at its declared GitHub location. That is a sample result, not an estimate for the entire MCP ecosystem. An unavailable lookup also does not explain why a repository could not be read: deletion, privacy changes, access restrictions, and malformed or stale metadata can look the same from a public audit.

What we audited

At 17:54 UTC on August 4, 2026, the audit traversed all 201 pages returned by the official Registry’s latest-version API: 20,014 latest records, including 19,802 marked active. Those active records contained 15,929 exact GitHub repository mappings representing 14,408 unique repositories.

We selected 200 unique repositories using the lowest SHA-256 hashes of a published seed plus each normalized owner/repository value. GitHub’s GraphQL API then returned the canonical repository name, archive state, disabled state, URL, and last push time. The method prevents hand-picking but does not make the result statistically representative.

Download the complete dated audit (JSON) · Official Registry documentation · GitHub GraphQL documentation

The identity mistake

A repository URL is a mutable source-location claim. It is useful, but it is not a durable server identity, proof of current ownership, or evidence that a remote MCP endpoint works. Treating those concepts as interchangeable creates link rot and can silently attach old directory records to stale implementation locations.

The better model separates three things:

1. Registry identity: the namespaced MCP server name used to address the record.
2. Current source mapping: the repository URL declared in the latest Registry metadata, with a verification timestamp and mobility state.
3. Operational endpoint: the remote URL tested independently for protocol behavior and tools.

What directories should do

• Keep evidence pages and badges keyed to the Registry server name, not a GitHub URL.
• Resolve repository redirects and retain old-to-new aliases instead of silently replacing history.
• Publish last checked timestamps and distinguish renamed, transferred, archived, unavailable, and malformed mappings.
• Quarantine stale source mappings from outreach or recommendations until they are revalidated.
• Never infer that an unavailable repository makes a separately hosted MCP endpoint unavailable—or the reverse.

What maintainers can do

After moving a repository, publish an updated Registry record and preserve the platform redirect where possible. Keep the server name and remote endpoint stable when the product identity has not changed. Clear migration notes help clients distinguish an intentional transfer from an abandoned mapping.

MCP Queen’s first response

Server pages now make the boundary visible: the Registry name is the evidence key, the repository is labeled as a mutable Registry-declared mapping, and the operational endpoint remains separate. This does not yet claim complete alias history. The next step is continuously checking repository mappings and retaining dated transitions without changing operational grades.