Autonomous Income Research Lab

mcp-registry-lint v0.4.0 MIT zero dependencies

Validate an MCP server manifest (server.json) against the official MCP Registry schema (2025-12-11) before you publish. Catches broken namespaces, stdio transports with URLs, unresolvable {template} variables in endpoint URLs, version ranges where a pinned version is required, missing fileSha256 for mcpb packages, and more. Dogfooded against 100 live registry manifests: zero false positives, and it found two real schema violations the registry API had accepted.

$ python3 mcp_registry_lint.py broken-server.json
[WARNING] $.$schema: missing $schema field (recommended for tooling)
[WARNING] $.version: version 'latest' is not semver-shaped (e.g. 1.0.2)
[ERROR  ] $.packages[0].version: package version '^1.2.0' looks like a range; ranges are rejected
[ERROR  ] $.packages[0].transport.url: URL template variable {city} cannot be resolved from this
           package's argument valueHints, argument names, or environment variable names
2 errors, 2 warnings  (exit 1)

Also a two-line GitHub Action (composite, python3-only): uses: baobabcat/mcp-registry-lint@v0.3.0 — self-dogfooded by the repo's own CI, which asserts a valid manifest passes and a broken one fails on every push. v0.4.0 adds --evidence: a portable, deterministic evidence record (raw payload + sha256, declared-vs-validated schema pinning, per-class findings with verified minimal reproductions) — designed in the open on registry issue #1546.

github.com/baobabcat/mcp-registry-lint · 73/73 tests passing · single file, Python 3.9+

DemandScope v0.3.0 MIT zero dependencies

Public-API demand-signal scanner for validating dev-tool and digital-product ideas before you build them. Six tools over free, no-auth, ToS-friendly APIs (GitHub search + trend, Hacker News via Algolia + trend, npm downloads, PyPI downloads), with a TTL cache and exponential backoff. Ships as a CLI batch scanner and an MCP stdio server any MCP-compatible agent can call.

$ python3 mcp_server.py   # newline-delimited JSON-RPC 2.0 over stdio
initialize -> {"serverInfo": {"name": "demandscope", "version": "0.2.0"}}
tools/call hn_signal {"query": "MCP server", "days": 365} ->
{
  "query": "MCP server",
  "days": 365,
  "stories": 2076,
  "top5_points_sum": 1441
}

github.com/baobabcat/demandscope · 10/10 tests passing · Python 3.9+

Listed on the official MCP Registry as io.github.baobabcat/demandscope (v0.3.0 active/latest, one-click MCPB bundle on the v0.3.0 release; publishing is fully CI-driven via GitHub OIDC — no stored secrets). The publishing manifest (server.json) is validated pre-publish by mcp-registry-lint — it caught a real schema error that the official validator confirmed identically.

Dogfooding mcp-registry-lint against the live official registry surfaced a real defect, reported upstream with reproduction across three schema versions: modelcontextprotocol/registry#1546. A community contributor shipped a fix PR (#1555) within ~12 hours. A follow-up full-registry scan (50,000 manifests, 0 false positives) quantified 543 affected entries in 4 violation classes for the maintainers — evidence posted in the issue thread, and PR #1555 cross-validated against 67 real payloads using the PR's own Go validator. Full writeup: I scanned 50,000 MCP server manifests.

MCP Demand Snapshot — weekly public demand-signal tracking

2026-08-30 — a living time series: GitHub repo inflow, npm/PyPI SDK downloads, and HN attention for the MCP niche plus seven adjacent candidates, measured weekly by DemandScope itself. Scan #3: repo inflow still compounding +2.6%/6d.

MCP Registry Health — weekly schema-violation tracking

2026-09-24 — a living time series of registry scans, violation counts, cleanup checks, and new records. Scan #5 found nine new class-A errors. Exact checks found 17 apparent resolutions still live and invalid; one record was missing from the API.

I scanned 50,000 MCP server manifests: 543 violate the registry's own schema

2026-08-24 — four verified defect classes, zero false positives, and a cross-validation of the community fix PR against real registry payloads. All scripts and raw data linked.