387 active servers declare neither remotes nor packages and cannot be reached

Describe the bug

387 servers with status: active declare neither remotes nor packages. They are published and discoverable, but their record contains no way for any client to reach or install them.

I found this while taking a census of the registry, not while trying to publish, so this is a data-quality observation rather than a publish-flow bug.

Numbers

Retrieved every record from GET /v0/servers by cursor pagination (August 2026): 82,994 version records, resolving to 25,125 distinct servers after filtering on _meta[...].isLatest.

Examples (all status: active, no transport declared)

• ai.complyme.mcp/mcp v1.0.0
• ai.megastructure/arc v1.9.1
• app.qwady.thorns/thornguard v0.1.0
• bid.scope/healthcare v0.0.0
• capital.hove/read-only-mysql-mcp-server v0.1.0

The 8 servers whose description is still the template string [describe what your server does]:

co.contraption/mcp, io.github.TranThienTrong/asset-auto-picker, io.github.arun250492/Personal-MCP, io.github.atarkowska/fastmcp-pdftools, io.github.augee99/mcp-weather, io.github.manoharanRajesh/python-version, io.github.preedew17/mcp-bookmark, io.github.shafarenkacfi/mcp-server-registration

Expected behavior

Publication could reject a server that declares neither remotes nor packages, since such a record cannot be acted on by any client. The template-description case is a one-line string check.

This is adjacent to #1193 and #1004 but distinct: #1193 concerns skipping deprecated servers during remote-URL validation at publish time, and this is about records that declare no transport to validate in the first place.

To Reproduce

python fetch_mcp_registry.py --out mcp-registry.jsonl
python -c "
import json
rows=[json.loads(l) for l in open('mcp-latest.jsonl',encoding='utf-8')]
none=[r for r in rows if not r.get('remotes') and not r.get('packages')]
print(len(none), 'of', len(rows), 'have no transport')
print(sum(1 for r in none if r.get('_status')=='active'), 'of those are active')
"

Retrieval script: https://github.com/ashishsinha1602/dataset-integrity-audit/blob/main/fetch_mcp_registry.py

Additional context

Counts are a snapshot from August 2026 and will drift. One caveat on methodology, in case it is useful to anyone repeating this: the endpoint returns one record per version, so measuring without filtering to isLatest inflates duplicate-description rates roughly 20x (74.5% vs 3.6%). The mean is 3.30 versions per server, with a maximum of 1,175.

Happy to open a PR adding the transport check if that would be welcome.

Filed from an organisation account. Author: Ashish Sinha (@ashishsinha1602), who is replying on this thread under that handle. Data and code: https://github.com/ashishsinha1602/dataset-integrity-audit

Start with the publication-validation path; the issue does not name a registry implementation file or test. Read fetch_mcp_registry.py to understand the observed records and reproduce the no-transport count. Done means publication rejects records with neither remotes nor packages, with coverage for the template-description check if that remains in scope.