194 MCP server listings are republished copies

Findings

• Two publishers account for most copies. @iflow-mcp has 113 copies of servers by 88 authors; @mseep has 35 copies of servers by 35 authors. Each package lists the original author's repository as its own.
• Almost nobody installs them. The 181 copies on npm had 1,178 downloads between them in the week to 2026-10-22; the median copy had 0. Where we could compare a copy with its original, the copies took 241 weekly downloads against 24,593 for the originals.
• They are snapshots, not forks. 136 of the 181 copies were published once and never updated, and 48 of 97 copies with a comparable original ship a different version from it. Fixes made upstream don't reach them.
• The harm is to rankings, not (mostly) to users. A directory that takes stars from the repository field gives each copy the original's count. Across the 123 copies whose original we list, that is 21,119 borrowed stars, and one server can appear two or three times in a “most popular” list. It did on ours until this week.

What we changed

MCPSkillHub now marks these listings as republished copies. They show no stars, are left out of lists, rankings, search and our sitemap, and their pages link to the original where we have it. Pages stay up, so a link to a copy still resolves. If you maintain one of these packages and it is your own work, tell us and we'll correct it.

What to do as a user

Install from the original author. Check that the npm package name matches the repository owner, or that the repository lists the package, before you connect a server. A copy runs whatever code its publisher uploaded, which may not be what the linked repository contains.

Method

Our analyzer groups listings by the GitHub repository they claim. A listing is a copy when it does not belong to the repository owner (not a monorepo subfolder, not published under the owner's npm scope or name, not the owner's registry namespace, not claimed) and either another listing for the same repository does, or all its packages come from a scope that publishes packages for ten or more other owners' repositories. Download and version figures come from the public npm registry and downloads APIs. Republishing open-source code is usually allowed by its licence; this study is about how directories count it.