When you install an MCP server from the official registry, you get exactly the package version the entry lists. The registry checks that version when the entry is published: it fetches it from npm or PyPI and confirms the package names the server.

I read the registry's source to see what happens after that. The package check runs again only when the publisher edits the entry . Nothing re-checks entries on a schedule. Repository links are checked against a URL pattern and never fetched.

That's a reasonable design for a young registry, and it isn't anyone's mistake. But it means entries can drift. So I checked the whole registry against npm, PyPI and GitHub and counted what no longer matches.

What I counted

Registry snapshot 2026-10-04: 38,977 servers (the latest version of each name).…