Trusted MCP sources: registries, directories and documentation
The official MCP Registry (registry.modelcontextprotocol.io) is the central metadata database for public MCP servers, maintained by the MCP project and backed by Anthropic, GitHub, PulseMCP and Microsoft. Alongside it, dozens of commercial and community directories exist. The crucial distinction: a listing proves at most the identity of the publisher — never that the code is safe.
Anyone looking to deploy MCP in a business context quickly runs into a fragmented landscape: one official registry, a handful of large directories with tens of thousands of listings, vendor catalogues and curated lists. This page lays out the sources, assesses them honestly on strengths and weaknesses, and gives you a concrete checklist to evaluate the trustworthiness of an MCP server yourself before connecting it to your business data.
What is the official MCP Registry and how does it work?
The official MCP Registry launched in preview on 8 September 2025 and still holds that status as of mid-2026 — the documentation explicitly warns that breaking changes or data resets are possible before general availability. The registry contains only metadata in a standardised server.json format: name, package location (npm, PyPI, Docker Hub or a remote URL), installation instructions and capabilities. The code itself lives elsewhere. According to NimbleBrain's State of MCP Security report, the registry counts roughly 3,000 unique servers (March 2026) — deliberately much smaller than scraped directories, because publishing requires namespace verification. The registry is primarily intended as a source for downstream aggregators such as the GitHub MCP Registry, PulseMCP and Glama, which layer their own curation and ratings on top.
The core trust mechanism is reverse-DNS namespacing. Server names follow the format io.github.username/server-name or com.company/server-name, and publishers must prove ownership of that namespace: via GitHub authentication for io.github.*, or via a DNS or HTTP challenge for their own domains. In practice this means com.stripe/… demonstrably belongs to Stripe, while io.github.random-user/stripe-mcp does not. This is the strongest identity signal in the entire ecosystem. The old community server list in the GitHub repo modelcontextprotocol/servers has been phased out in favour of the registry; older reference servers (GitHub, Slack, PostgreSQL, Puppeteer) live in servers-archived and are no longer maintained — although they still circulate in outdated tutorials.
Identity ≠ security
The official registry's moderation policy describes itself as "quite permissive": only illegal content, malware, spam and completely broken servers are removed. Servers with known security vulnerabilities explicitly remain listed. The registry itself advises consumers to assume "minimal-to-no moderation". A registry listing therefore proves who the publisher is — not that the code is sound. Also read our page on MCP security.
Official documentation and GitHub organisation
For everything concerning the protocol itself, modelcontextprotocol.io is the canonical source: specification, guides and registry documentation. The official blog publishes announcements such as the registry preview and the 2026 roadmap. The GitHub organisation hosts the spec, SDKs (TypeScript, Python, C#, Java, Go and more), the registry and the Inspector. Relevant if you are getting started now: spec version 2026-07-28 arrives in late July 2026, featuring among other things a stateless protocol core, a formal extension framework, OAuth 2.0/OIDC hardening and a governance policy with a minimum of twelve months per deprecation phase — see the release candidate announcement. Read more about the technology at how MCP works.
Which directories exist, and how trustworthy are they?
Beyond the official registry there is a range of directories and marketplaces, each striking its own balance between scale and curation. The largest, mcp.so, claims over 23,000 servers (July 2026); PulseMCP counts 20,000+, updated daily. For comparison: the official registry holds roughly 3,000 verified listings and the Anthropic Connectors Directory around 340 reviewed integrations. That ratio tells the whole story — the bigger the list, the less each server has been checked. Use broad directories to discover whether something exists, and curated catalogues to decide whether you should run it.
| Source | Size (±, 2026) | Strength | Weakness | Trust |
|---|---|---|---|---|
| Official Registry | ~3,000 | namespace verification as proof of identity | minimal moderation, no code check | Identity high, code none |
| GitHub MCP Registry | hundreds | GitHub curation, VS Code integration, enterprise allowlists | focused on dev tooling | High |
| PulseMCP | 20,000+ | breadth, refreshed daily, client directory, newsletter | listing ≠ vetting, many abandoned servers | Medium-high |
| Glama | thousands | automated scans, quality score, Inspector sandbox | proprietary methodology, no human audit | Medium-high |
| Smithery | 6–7,000 | easiest route to remote hosting, good CLI/API | credentials pass through their infra; leak incident (~3,000 credential sets) | Medium |
| mcp.so | 23,000+ | broadest coverage, quick check whether something exists | virtually no curation, many dead/duplicate entries | Low-medium |
| mcpservers.org (awesome-mcp-servers) | thousands of links | human-curated, ~90k GitHub stars, PR review | a PR merge is not a security audit, link rot | Medium-high |
| Docker MCP Catalog | 200+ | container isolation, signed "Docker-built" builds pinned to a git commit | requires Docker Desktop, smaller selection | High (Docker-built) |
| AWS / Azure / Cloudflare | 50+ per vendor | first-party, actively maintained | own ecosystem only | High |
Two sources deserve separate mention. The Anthropic Connectors Directory contains connectors and desktop extensions (.mcpb bundles) for Claude that have been reviewed by Anthropic — high trust, but limited to the Claude ecosystem. The Cline MCP Marketplace is one of the few directories with a documented human review process: the team tests whether installation from the README actually works and applies extra scrutiny to financial and crypto tools. The Smithery incident is the lesson to remember: a platform bug leaked roughly 3,000 sets of credentials according to Pipelab's State of MCP Security report — "verified marketplace" status did not prevent it. Platform trust is never absolute.
How do you assess the trustworthiness of an MCP server yourself?
Because no list guarantees code safety, every server choice deserves your own assessment. The signals below are ordered by strength. Pay particular attention to the weakest signal on the list: popularity. The postmark-mcp backdoor had, according to Pipelab, around 1,500 weekly downloads when it was discovered to be adding a hidden BCC to every outgoing email (September 2025, roughly 300 organisations affected). Downloads and GitHub stars are triage tools, not a seal of approval. For the legal side of this trade-off — who is responsible when things go wrong — see MCP and EU regulation.
Checklist: signals from strong to weak
✔ Official namespace — a reverse-DNS name matching the company domain (com.stripe/…) or the verified GitHub org in the official registry.
✔ First-party vendor — published by the service itself; verify that the repo sits under the verified vendor org.
✔ Signed builds — "Docker-built" entries in the Docker MCP Catalog are built from a pinned git commit with build signing.
✔ Human-reviewed catalogue — Anthropic Directory, Cline Marketplace, GitHub MCP Registry.
✔ Maintenance signals — recent commits and releases, answered issues, matching versions across registry, npm and GitHub. A server dormant since 2025 is probably targeting outdated spec revisions.
✔ Source code available and readable — including the tool descriptions themselves (Glama indexes them); hidden instructions in those descriptions are known as tool poisoning.
✔ Least privilege — does the server request a token scope that matches its function? Full account tokens for a read-only task are a red flag.
⚠ Popularity — stars and downloads: useful for triage only, never as proof of safety.
Additional advice from the security research: pin versions and hash tool definitions, because auto-update is the classic rug-pull vector. Tools such as mcp-scan (Invariant Labs, now part of Snyk) handle tool pinning, scan tool descriptions for prompt injection and monitor runtime traffic through a proxy; Cisco provides an open-source YARA-based mcp-scanner. And preferably run local servers isolated in a container (Docker MCP Toolkit) rather than raw via npx from an unknown package. For a deeper dive, see our security page and the glossary.
In what order should you pick a source? The trust ladder
- First-party first: the official vendor server from AWS, GitHub, Cloudflare, Stripe, or the Anthropic Connectors Directory.
- Then curated and signed: a Docker-built catalogue entry, or a listing in the GitHub MCP Registry or Cline Marketplace.
- Then the official registry: a verified namespace plus visibly active maintenance.
- Only then community directories: PulseMCP and Glama for research, mcp.so for discovery only — always with the checklist above, preferably scanned with mcp-scan and run in a container.
How do you stay up to date?
The official MCP blog is the primary source for spec releases, registry news and the roadmap. The PulseMCP newsletter is the de facto weekly digest of new servers, clients and protocol changes. For discussion there are the official contributor channels (Discord, GitHub Discussions, working groups) and a broader community Discord with 13,000+ members. If you follow the security side, read Invariant Labs and the annual State of MCP Security reports from Pipelab and NimbleBrain; the changelogs from GitHub and the Docker blog announce new governance and trust features. We collect practical recommendations on tips & tricks.
Where does mcpstore.nl fit in this landscape?
mcpstore.nl is not a registry and not a replacement for the sources above — we curate on top of them, specifically for a business context. Concretely: we select servers per sector that are relevant to businesses, weigh the trust signals from this article in that selection, and highlight considerations around GDPR, compliance and EU regulation that international directories do not cover. For the source data we always refer back to the official registry and the original publisher. Browse the sector overview or go straight to a sector:
Banking & fintech
MCP servers for payments, banking APIs and fintech integrations.
Insurance
Servers and considerations for insurers and underwriting agencies.
Software development
GitHub, CI/CD and developer tooling — the most mature MCP segment.
Legal & compliance
Servers for legal workflows, with extra emphasis on confidentiality.
The key message, in closing: a listing is a place to find something, not a seal of approval. Even the official registry literally tells you to assume minimal moderation. Verification shrinks the attack surface but does not eliminate it — the postmark backdoor travelled through a regular channel and the Smithery leak happened despite verified status. More questions? Check the FAQ or get in touch.
Frequently asked questions
What is the official MCP Registry?
The official MCP Registry (registry.modelcontextprotocol.io) is the central metadata database for publicly available MCP servers, maintained by the MCP open-source project and backed by Anthropic, GitHub, PulseMCP and Microsoft. It has been running in preview since September 2025.
Does a listing in the official MCP Registry mean a server is safe?
No. The registry only verifies the publisher's identity through namespace verification. Its moderation policy explicitly states that servers with security vulnerabilities are not removed — you should assume "minimal-to-no moderation".
What is the largest MCP directory?
mcp.so is the largest with over 23,000 servers (July 2026), followed by PulseMCP with 20,000+. Large does not mean trustworthy here: both lists contain many abandoned and uncurated servers.
How do I verify that an MCP server really belongs to a company?
Look at the reverse-DNS namespace in the official registry: com.stripe/… demonstrably belongs to Stripe, because publishers must prove domain ownership via a DNS or HTTP challenge. io.github.random-user/stripe-mcp does not.
Which MCP directory is best for technical due diligence?
Glama (glama.ai) automatically scans every server for tools, schemas and licence, assigns a quality score, and offers a browser-based Inspector sandbox to test tools before installation. Its scoring methodology is proprietary, however.
Are popular MCP servers automatically safe?
No. The postmark-mcp backdoor had roughly 1,500 weekly downloads when it was discovered to be adding a hidden BCC to every outgoing email (September 2025, ~300 organisations affected). Popularity is a triage signal, not a safety guarantee.
How do I stay up to date on MCP developments?
Follow the official MCP blog (blog.modelcontextprotocol.io) for spec releases and registry news, and the weekly PulseMCP newsletter for new servers and clients. For security research: Invariant Labs and the annual State of MCP Security reports.
Can I run a private MCP registry for my organisation?
Yes. The official registry publishes an OpenAPI specification that private and enterprise registries can implement as well. In addition, since November 2025 GitHub offers an internal MCP registry with allowlist policies for VS Code/Copilot, blocking any servers outside the internal list.
Last updated: