Your agent will confidently give you an MCP install command that doesn't exist

THE SIGNAL / 01

Ask your agent to set up an MCP server and it will hand you npx -y @modelcontextprotocol/server-<name>. That package usually does not exist.

The pattern is everywhere in training data, because in MCP's first months it was mostly true — the protocol shipped with a set of reference servers, all published under that scope, and every tutorial copied the shape.

We ran it against the npm registry for every stdio server in our directory. It resolves for 4 of 182. Six more exist but are deprecated. For 172 the package was never published at all.

What actually happened is that the reference servers were the starting pistol, not the finish line. The steering group now keeps seven of them — everything, fetch, filesystem, git, memory, sequentialthinking, time — and has archived the rest, in most cases because the vendor shipped a better one. server-github is archived; GitHub maintains its own in Go, and it doesn't install with npx at all. server-brave-search is archived; Brave publishes @brave/brave-search-mcp-server. The pattern didn't break. It graduated.

So when an agent hands you one of these, three checks take ten seconds:

1. Is it one of the seven? If not, the @modelcontextprotocol/server- package is almost certainly archived or imaginary. 2. Does the vendor publish one? Most now do, and it is usually better maintained. GitHub, Brave, Stripe, Notion, Sentry and Linear all ship their own. 3. Is it even npm? Plenty of the good ones are Docker images or hosted endpoints you point a URL at. Assuming npx is how you end up with a command that looks right and installs nothing.

The official registry at registry.modelcontextprotocol.io is the canonical index. Our MCP pages now carry configuration copied verbatim from each server's own README — 77 of them so far — and say "documented upstream" with a link rather than showing you a block we haven't checked.

• Browse MCP servers →

NEW & VETTED / 02

A new directory, and seven skills that moved house.

• Tools55 developer tools in 11 categories: coding agents, agent frameworks, sandboxes, vector stores, hosting, orchestration, observability, auth. Products, not adapters — the MCP directory lists the thing your agent talks to, this lists the thing itself, with licence and deployment model. Selected by us, not ranked by anyone's budget. Every skill and MCP page now points at the tools category its readers are most likely to need next.
• Disclosureshow the site makes money, and what it doesn't. The affiliate list is currently empty; it's published now so that when the first one exists, the page was there first.

And if any of these are in your setup, the install id changed: Expo renamed three skills (building-native-ui → expo-native-ui, expo-deployment → eas-app-stores, upgrading-expo → expo-upgrade), HashiCorp split its single Terraform skill into sixteen, Remotion and Firecrawl moved folders, and Kreuzberg is now xberg and installs as a plugin. Old commands will fail quietly. The current one is on each skill's page.

THE PICK / 03

Static Analysis — Trail of Bits

S-RANK · 7,074 STARS · 41 CONTRIBUTORS · UPDATED SEPTEMBER 14, 2026 BY TRAIL OF BITS

Three skills in one plugin — CodeQL, Semgrep, and SARIF parsing — from a firm whose day job is finding what other people's tooling missed.

We picked it for one line in the CodeQL skill's principles:

"Zero findings needs investigation, not celebration. It can mean poor extraction, missing models, the wrong packs, or suite filtering."

A clean scan is a success signal that may mean nothing. So the skill makes the agent run a database-quality check after every build and state in the report that it passed — because, in their words, "a database that builds is not automatically good."

The part that earns the rank is how much of it is about not trusting the tool. Never pass a pack name to codeql database analyze, because hidden suite filters can silently produce zero results — generate an explicit suite file instead. Write data-extension models for your own wrappers, because the shipped ones don't know your db.query(). Exit code 137 on Apple Silicon is an architecture mismatch, not a failed build — try the arm64 toolchain before falling back to a mode that analyses less. Each of those is a place where the default path reports success and finds nothing.

The caveat, and the reason the install command looks unfamiliar: this is a plugin, not a SKILL.md. Plugins are the packaging standard that landed this year — a marketplace you add once, then install from by name — and they can carry scripts, hooks, agents and reference files that a single file can't. This one ships all of that, assumes CodeQL or Semgrep are installed, and expects you to let the agent run them. It's one of 43 plugins in that marketplace. And it will cost tokens — a CodeQL database build on a real codebase is not a quick pass. That's the trade: it does the expensive thing properly rather than the cheap thing convincingly.

$ /plugin marketplace add trailofbits/skills
$ /plugin install static-analysis@trailofbits

• What are agent plugins? →
• View skill & platform support →

DIDN'T PASS / 04

Six things worth removing from your setup this week.

They still work, mostly. Nobody will tell you they stopped being maintained.

• @modelcontextprotocol/server-sqlite, -postgres, -puppeteer, -gdriveall four moved to servers-archived. No fixes, no security patches. For Postgres and SQLite, your database vendor or the official registry has a maintained alternative; for browser control, Playwright's official server is actively developed.
• mcp-run-pythonretired by Pydantic, who were blunt about why: there is "no safe way to run Python within pyodide safely with reasonable latency." They point to Monty instead. If you're executing model-written Python, that sentence is worth reading twice.
• next-best-practicesretired by Vercel, and this one is good news. Their README: "no longer a skill. This knowledge is now delivered through the bundled docs and the auto-generated AGENTS.md / CLAUDE.md written by next dev (Next.js 16.3+)." You get version-matched guidance from the framework instead of a snapshot that drifts. On 16.1 or earlier, npx @next/codemod@canary agents-md pulls the same docs in.

All six are out of the directory — we're at 189 skills and 193 MCP servers, down from 192 and 200.

And one thing to watch for anywhere, not just here: 79 of the servers we list publish no repository and no website at all. Nothing to read, nothing to audit, no way to check what a config block claims. They now carry a "no source" mark on their card and page so you can see it at a glance before installing. It's a useful question to ask of any directory: what is actually behind this entry?

• The MCP directory →

WORKFLOW / 05

Security Code Review — an agent that audits a pull request the way a reviewer would, with the tools a reviewer would use. Intermediate.

It belongs next to 03 for the obvious reason, and next to 01 for a less obvious one. The failure mode both describe — a process that reports success without doing the work — is the default failure mode of AI code review. Ask a model "is this safe?" and it will answer confidently from the diff alone. This workflow makes it run the analyzers first and reason from their output, which is the same discipline the Trail of Bits skill enforces on itself.

• Security Code Review →

WHAT CHANGED / 06

53 skills you may have installed were updated this week.

New section, and it runs every week from here — because a skill you installed in July is not the skill that's there now, and nothing tells you when it moves. "Updated" means the skill's own directory got a commit since September 5. Top of the list by stars:

• Claude APISeptember 10
• UI/UX Pro MaxSeptember 6
• ImpeccableSeptember 10
• Scientific SkillsSeptember 14
• Claude SEOSeptember 11
• GEO SEO SkillsSeptember 14
• UI SkillsSeptember 13
• .NET TestSeptember 9

…and 45 more. The date is on every skill's page, under Last commit.