Project
Glama is a directory and catalog of Model Context Protocol (MCP) servers, indexing tens of thousands of entries for discovery and comparison.
QRFLOW.codes' developer refused both fixes a security report proposed for open OAuth client registration, saying either would lock Claude and ChatGPT out. The exposure turned out to be a consent screen showing attacker-chosen app names, now handled by trusting redirect hosts.
Reality
One team's two MCP servers, in Hiberden and Easy2257, share a protocol but take their auth, distribution and update rules from where each one runs. Settle that choice before designing tools, because it decides whether a shipped tool signature can ever change.
Reality
Korea's business registry sits behind a Korean-language portal and SMS verification, so an agent cannot reach it. One developer put it behind an HTTP 402 and $0.02 in USDC, then found his free tier had disqualified him from the marketplace.
Reality
SlowMist's August 28 report describes a GitHub page promising offline Qwen 3.8 27B weights and handing over a 487KB stealer instead. The byte count on a download is the cheapest integrity control a team still owns.
Reality
A developer's four-tool server read as empty on glama, Smithery and mcp.directory, because tools/list arrives without a token. The fix is a four-method allowlist.
Reality
A new meta-server proposes replacing N configured MCP servers with five search-and-connect tools. The saving is real, but the cost moves to round trips, and to whoever ranks in the top five.
Reality