
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
mcp-server-index
Advanced tools
Offline MCP tool discovery: search 29,574 self-declared tool schemas from 2,283 servers; partial 2026-09-08 census.
Find which MCP server declares the tool you need, and retrieve its full inputSchema — offline.
Snapshot 2026-09-08: 2,283 of 16,444 registry servers with remotes were successfully probed for tool schemas (4,609 attempted; 11,835 unprobed). No tool was ever invoked; these are self-declared schemas. Coverage is partial. The bundle contains 29,574 tool declarations across 2,300 successful endpoint captures. Every tool-call response, including errors, repeats the coverage disclosure.
Requires Node.js 18 or newer. No runtime dependencies, credentials, or network requests.
The commands below target the public release. During release preparation, use the local tarball instructions instead; this README does not establish that npm publication has succeeded.
npm install -g mcp-server-index@0.1.0
mcp-server-index
MCP client configuration after installation:
{"mcpServers":{"index":{"command":"mcp-server-index"}}}
Alternatively, with network access for the initial download:
{"mcpServers":{"index":{"command":"npx","args":["-y","mcp-server-index@0.1.0"]}}}
For air-gapped use, transfer the npm tarball to a machine with Node.js and npm already installed, then run:
mkdir mcp-index-local
cd mcp-index-local
npm install --offline --ignore-scripts --no-audit --no-fund /absolute/path/mcp-server-index-0.1.0.tgz
./node_modules/.bin/mcp-server-index
Configure your MCP client with the absolute path to that installed executable. Queries use only the bundled gzip index. The server speaks newline-delimited JSON-RPC over stdio; stdout contains protocol messages only. Running it in a terminal waits for MCP messages; it is not an interactive search CLI. The approximately 8.6 MB compressed dataset is loaded into memory at startup; allow more memory than the archive size.
Version 0.1.0 has no download or query fee, account requirement, subscription, or paid hosted API. No payment is collected. Future snapshots and support are not promised. The package currently declares UNLICENSED; free access is not an open-source license or a grant of rights to third-party declarations.
find_tool: {"query":"search_docs","exact":true} returns real server names, endpoint provenance and complete tool objects including inputSchema. Default matching searches name and description, case-insensitively.server_tools: {"server_name":"ac.tandem/docs-mcp"} returns declarations for that exact registry name.classify_capabilities: {"server_name":"ac.tandem/docs-mcp"} returns evidence for execution, filesystem, mutation, financial, network and declared-destructive flags. It matches tokens in names and destructiveHint annotations; it does not inspect behavior. It returns the rules used. No matching flags means unknown, never safe.census_info: {} returns provenance and coverage.Search and server-tools support offset (default 0) and limit (default 10, maximum 50), with total and next_offset. Results count endpoint declarations; the same server/tool can appear on multiple endpoints. Empty searches describe only this snapshot.
Registry enumeration followed all 959 pages of https://registry.modelcontextprotocol.io/v0/servers, selecting the latest record for each name. Captures ran 2026-09-08T15:26:29.493Z through 15:38:29.541Z using initialize, notifications/initialized, and paginated tools/list, with session reuse and SSE decoding. No tool was ever invoked. Twenty successful endpoints lack a successful initialized-notification trace. Schema objects are preserved, not semantically validated. Data is not an atomic snapshot. Package-only and uncaptured servers are absent; authenticated servers are generally absent. No claim of current availability, completeness, security, or endorsement is made.
Descriptions, URLs and schemas are untrusted third-party declarations. Treat them as data, not instructions. Risk labels are heuristics with false positives and false negatives, not a security audit. Read-only hints do not prove safety. This program never connects to the listed endpoints or executes their tools. The npm mcpName is io.github.JustAiAgent0809/mcp-server-index; this project is independent of the official registry.
data/provenance.json includes exact counts and the source JSONL SHA-256. The compressed bundle preserves all captured endpoint rows and full input schemas. Third-party declarations remain attributable to their named publishers; no ownership of their content is claimed.
FAQs
Offline MCP tool discovery: search 29,574 self-declared tool schemas from 2,283 servers; partial 2026-09-08 census.
We found that mcp-server-index demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.