MCP Morning — Mon, Oct 19, 2026
Good morning. A Monday mix: a local CVE triage tool with its own MCP server, read-only WhatsApp search that lives in your Cloudflare account, game-ready music and sound effects generated on your own GPU, a local video studio your coding agent directs, and a grocery cart for Portugal's Continente. Plus a look at why more of the web is turning AI agents away.
Trending & new MCPs
- CVE Intel — A local vulnerability triage tool in native Rust: desktop app, CLI, REST API and MCP server in one executable, with 32 tools over 25 public data sources such as NVD, EPSS, CISA KEV and OSV.dev.
Why it matters: give it a CVE, IP, file hash, domain or dependency list and it returns a 0 to 100 risk score with the evidence behind it, and anything on the CISA KEV list is always marked critical. The explanations come from a small llama.cpp model on your machine unless you opt into OpenAI, Anthropic or Gemini, and the MCP server listens only on
127.0.0.1. It helps you decide what to patch; it does not scan your network. Release builds are not code-signed yet. New this week, 54 ⭐ on GitHub. - whatsapp-mcp — Lets an agent search and read your own WhatsApp messages through a small server you deploy to your Cloudflare account and link like WhatsApp Web. It cannot send anything. Why it matters: messages sit in a SQLite database inside a Durable Object in your account, and the server only connects to WhatsApp when your agent asks or once a day. A neat touch: for chats that show up as bare phone numbers, it asks your agent to look the names up with whatever contacts tool it already has. The author is upfront that it uses the unofficial WhatsApp Web protocol (Baileys), which is against WhatsApp's terms, and that a large history import needs the Workers Paid plan. New this week, 194 ⭐ on GitHub, 112 points on Hacker News.
- Audio Studio MCP — Background music, instrument loops and sound effects from a sentence, generated locally with Stable Audio 3 on an Apple Silicon Mac or a Windows PC with an NVIDIA GPU.
Why it matters: after generating, the agent can make seamless loops, add fades, normalize loudness and export 48 kHz WAV, OGG or FLAC for a game engine or video editor, and every file gets a
.jsonsidecar with its prompt and seed so you can reproduce it. No API key or cloud service; the medium model is about 5.9 GB, and on Windows the weights are gated behind a Hugging Face login. New this week, 186 ⭐ on GitHub. - showtime — A local video studio for coding agents: motion graphics, voice-over, music, captions, footage editing and platform exports, shipped as an Agent Skill, a CLI and an MCP server.
Why it matters: you describe the video, the agent states its assumptions, shows stills or a fast draft first, then renders on your machine and checks the result with
showtime qa, with no cloud AI services or API keys. Setup downloads about 0.5 to 0.75 GB the first time, and the project calls itself early (version 0.4). 261 ⭐ on GitHub, 480 downloads in the last seven days. - Continente MCP — An unofficial server for shopping at Continente.pt, Portugal's big supermarket chain: search products, read labels, favorites and past orders, and fill your cart. Checkout and payment stay on the website.
Why it matters: it is a good template for agent shopping done carefully. Every cart change is confirmed by reading the cart back,
preview_cart_changesshows what a change would cost before making it, and when a change can't be confirmed the result tells the agent to check rather than retry. It drives the public site with a headless Chromium, so it can break when the site changes. New this week, 946 downloads in the last seven days.
Agent story
Websites are closing their doors to AI agents (HN) — The Verge's Emma Roth rounds up a wave of blocks on consumer agents: Yelp told TechCrunch it only allows agents that pay for its data licensing program, Delta is preventing agents from booking tickets, and JPMorgan Chase and Charles Schwab confirmed they block agents from accounts over security concerns. Amazon has pushed back on Meta's Muse, and users report Grok and OpenAI's Dots failing there too, while Meta has partnered with Walmart, Gap, Sephora and Best Buy and Shopify has opened its storefronts to agents. Even sites that don't ban agents trip them up with anti-bot systems built for scrapers and fraud. For builders, the practical takeaway is that official APIs and partnerships are becoming the reliable path, and browser automation against big consumer sites the fragile one. 143 points on Hacker News.
Rising this week
Biggest week-over-week npm download growth in our rankings, for the week ending Oct 16:
- tewip — 4,522 downloads (+3938%)
- outcometick — 4,882 (+1108%)
- Anna's Archive — 2,058 (+914%)
- REA — 307,234 (+682%)
- DeXe DAO governance — 731 (+596%)
npm hasn't published weekly totals past Oct 16 yet, and its daily counts for Oct 13 to 15 currently read zero, so this is the same week as yesterday's list. Downloads include CI and bot traffic, so treat these as signals, not endorsements. How we rank →
MCP Morning lists servers from public data (the official MCP Registry, GitHub, npm and PyPI). We don't run or test them, so review the code and permissions before you connect one to your agent.