MCP package versions in npm can 404 even when the package exists

A recent update to a guide on MCP (Meta-Community Packages) revealed a critical issue with package versions that lead to 404 errors even when the package exists in the npm registry. Nine out of ten package versions mentioned in the guide were found to be nonexistent. When a reader attempted to install one such package, google-calendar-mcp@1.4.0, they received a 404 error.

The package itself could be located, but the specific version string proved to be the problem. This mistake was identified during the fourth round of reviews for pull request #236. The guide had previously used floating tags, but these were replaced with pinned versions, which is the recommended approach. However, the identified problem is that the version strings supplied did not exist in the registry.

A pinned version that does not exist in the registry is worse than a floating tag because it installs nothing and provides no clear indication as to why. To avoid this issue, when writing install instructions for MCP packages, it is crucial to ensure that the pin resolves before publishing. The commit that addressed this issue was made on 2026-09-11, adding a verification step that checks if the pin resolves.

Six files were modified, with 162 lines added and 4 removed. It is important to note that a pinned npm version that does not exist in the registry fails more severely than a floating tag. Therefore, it is necessary to verify every printed pin resolves before shipping install instructions. This issue was originally reported on the NeuraGrowth website.