An observation record, not an assessment. Every row below is a change we recorded directly, with the content hash before and after. https://app.hermoso.ai/mcp?src=registry
6 of these transitions happened while the reported version string stayed the same. A consumer pinning that version would have received a different tool surface with nothing in the version to indicate it. That is a compatibility and review fact, not a security finding and not an allegation of wrongdoing — unversioned iteration is normal practice and is frequently deliberate.
| observed at (UTC) | change | version signal | reported version | tools | surface hash |
|---|---|---|---|---|---|
| 2026-10-07 19:40:03Z | DESCRIPTION_CHANGED | version-signalled | 0.1.403 → 0.1.405 | no tool-name change recorded | d77ebf5dac35 → 3a8f9a358deb |
| 2026-10-07 19:40:03Z | PARAMS_CHANGED | version-signalled | 0.1.403 → 0.1.405 | no tool-name change recorded | 7d9205afa590 → 990abb79c5c3 |
| 2026-10-07 07:40:03Z | DESCRIPTION_CHANGED | version-signalled | 0.1.401 → 0.1.403 | no tool-name change recorded | 71a04af5db89 → d77ebf5dac35 |
| 2026-10-07 07:40:03Z | PARAMS_CHANGED | version-signalled | 0.1.401 → 0.1.403 | no tool-name change recorded | ecc15ec17b01 → 7d9205afa590 |
| 2026-10-07 01:40:03Z | DESCRIPTION_CHANGED | version-signalled | 0.1.395 → 0.1.401 | no tool-name change recorded | ed069de650bf → 71a04af5db89 |
| 2026-10-07 01:40:03Z | PARAMS_CHANGED | version-signalled | 0.1.395 → 0.1.401 | no tool-name change recorded | 3b6201d5abce → ecc15ec17b01 |
| 2026-10-06 19:40:03Z | DESCRIPTION_CHANGED | version-signalled | 0.1.381 → 0.1.395 | no tool-name change recorded | c19fa25e4e3e → ed069de650bf |
| 2026-10-06 19:40:03Z | PARAMS_CHANGED | version-signalled | 0.1.381 → 0.1.395 | no tool-name change recorded | 505369a91423 → 3b6201d5abce |
| 2026-10-06 01:40:03Z | DESCRIPTION_CHANGED | version-signalled | 0.1.375 → 0.1.381 | no tool-name change recorded | 8bab4919e7ad → c19fa25e4e3e |
| 2026-10-06 01:40:03Z | PARAMS_CHANGED | version-signalled | 0.1.375 → 0.1.381 | no tool-name change recorded | 8f825d6fa137 → 505369a91423 |
| 2026-10-05 19:40:04Z | DESCRIPTION_CHANGED | version-signalled | 0.1.373 → 0.1.375 | no tool-name change recorded | 8ec60108c9c2 → 8bab4919e7ad |
| 2026-10-05 19:40:04Z | PARAMS_CHANGED | version-signalled | 0.1.373 → 0.1.375 | no tool-name change recorded | 1faea76075e2 → 8f825d6fa137 |
| 2026-10-05 07:40:03Z | DESCRIPTION_CHANGED | version-signalled | 0.1.372 → 0.1.373 | no tool-name change recorded | d6b3502bfced → 8ec60108c9c2 |
| 2026-10-05 01:40:03Z | DESCRIPTION_CHANGED | SILENT — version string did not move | 0.1.372 (unchanged) | no tool-name change recorded | 62a69312b632 → d6b3502bfced |
| 2026-10-04 19:40:04Z | DESCRIPTION_CHANGED | SILENT — version string did not move | 0.1.372 (unchanged) | no tool-name change recorded | 8e5c21d9e392 → 62a69312b632 |
| 2026-10-04 07:40:03Z | DESCRIPTION_CHANGED | SILENT — version string did not move | 0.1.372 (unchanged) | no tool-name change recorded | 3564a06444b3 → 8e5c21d9e392 |
| 2026-10-04 01:12:58Z | DESCRIPTION_CHANGED | SILENT — version string did not move | 0.1.372 (unchanged) | no tool-name change recorded | 3043e793e1bb → 3564a06444b3 |
| 2026-10-03 01:40:03Z | SURFACE_CHANGED | version-signalled | 0.1.371 → 0.1.372 | +restyle_video | 6180819382d6 → ff27ce4c45f3 |
| 2026-10-02 19:40:04Z | PARAMS_CHANGED | SILENT — version string did not move | 0.1.371 (unchanged) | no tool-name change recorded | — |
| 2026-10-01 19:40:04Z | SURFACE_CHANGED | version-signalled | 0.1.370 → 0.1.371 | +tiktok_post_status | 056070bd219c → 6180819382d6 |
| 2026-10-01 01:40:03Z | PARAMS_CHANGED | version-signalled | 0.1.366 → 0.1.370 | no tool-name change recorded | — |
| 2026-09-30 13:40:03Z | PARAMS_CHANGED | version-signalled | 0.1.359 → 0.1.362 | no tool-name change recorded | — |
| 2026-09-30 01:40:03Z | PARAMS_CHANGED | version-signalled | 0.1.347 → 0.1.358 | no tool-name change recorded | — |
| 2026-09-29 01:40:03Z | PARAMS_CHANGED | version-signalled | 0.1.336 → 0.1.345 | no tool-name change recorded | — |
| 2026-09-28 13:40:03Z | PARAMS_CHANGED | version-signalled | 0.1.335 → 0.1.336 | no tool-name change recorded | — |
| 2026-09-28 07:40:03Z | PARAMS_CHANGED | version-signalled | 0.1.322 → 0.1.335 | no tool-name change recorded | — |
| 2026-09-26 01:40:03Z | PARAMS_CHANGED | version-signalled | 0.1.316 → 0.1.322 | no tool-name change recorded | — |
| 2026-09-25 19:40:04Z | PARAMS_CHANGED | version-signalled | 1.0.0 → 0.1.316 | no tool-name change recorded | — |
| 2026-09-25 07:40:03Z | PARAMS_CHANGED | SILENT — version string did not move | 1.0.0 (unchanged) | no tool-name change recorded | — |
This section is identical for ~92% of publishers and is published as
shared context, not as a finding about app.hermoso.ai. 90 dependency
packages sit beneath the measured MCP population; 41 have a
single maintainer and 31 have not published in over two years.
The widest is zod at
80.46% of npm-backed servers (8529 servers,
1 maintainer, last publish 2026-09-13).
These are properties of the shared SDK dependency closure. Any page claiming this set as
one operator's personal exposure is misreading a universal fact as a private one.
Source: state/mcp-census/chokepoint-maintainers.json, as_of 2026-10-07.
Observation window 2026-09-21 → 2026-10-10.
22,294 servers were observed; 2,214
were seen to change and 20,080 were observed and
recorded no change — that negative control is why a non-zero count here means something.
Across the corpus, 4,781 of
6,334 changes carried no version signal, and
1,690 of those added or removed tools.
What this does NOT cover: servers outside the observed set; changes that
occurred before 2026-09-21; changes that began and reverted between two observations;
and any server reachable only with credentials we do not hold. A server's absence from this
record is not evidence it did not change — only that we did not observe it.
Universe captured 2026-10-10T19:40:03.823Z. Produced by core/surface_history_page.cjs (reads core/surface_clock producers).
Hashes are of the served tool surface and are recomputable from the server's own response.