Repository navigation
Measurement: 8.6% of listed entries with a remote endpoint answer HTTP but not MCP #1626
Description
Hello — this is a measurement report, not a bug report or a feature request.
I have been probing the registry nightly and thought the numbers might be
useful. No action requested.
Method
Every night at 03:00 UTC I fetch the full registry, then send a plain
JSON-RPC initialize to every entry that declares a remotes[] endpoint,
followed by tools/list. Failures are recorded with a reason, so "refused
us" is never conflated with "is not there". Both streamable-http and legacy
SSE are attempted, and three protocol versions are tried before an entry is
written off.
Results, 2026-09-07
28,139 registry entries, of which 16,305 declare a network endpoint. Every
one of those 16,305 was probed:
| outcome | count | share |
|---|---|---|
answered tools/list unauthenticated |
9,532 | 58.5% |
| required authentication | 4,135 | 25.4% |
| answered HTTP but not MCP | 1,401 | 8.6% |
| unreachable | 1,043 | 6.4% |
| timed out | 103 | 0.6% |
| returned a JSON-RPC error | 91 | 0.6% |
149,725 tools were recorded across the servers that answered.
The row worth your attention is the third. Those 1,401 entries respond over
HTTP but do not speak MCP at all: they return HTML, unrelated API errors, or
nothing parseable. They are not auth failures and not outages — both are
counted separately above.
Four of them are expired domains now serving for-sale parking pages, all
through the same ad network, while still listed as active:
backlog-forge.arcanum-plus.comtoolpipe.devmcp.TEST-blockscholes.commcp.tradallo.com
An agent configured from the registry connects to infrastructure the
original publisher no longer controls.
Two smaller observations
- Declared endpoints grew from 14,426 to 16,305 over the eight days measured
— roughly 235 per day — so any absolute figure here ages quickly. - 24.8% of servers that do speak MCP have no
mcpsubstring anywhere in
their URL path, across 3,026 distinct paths. Discovery heuristics keyed on
the path will miss a quarter of working servers.
Reproducing this
Crawler, raw archived responses and analysis:
https://github.com/yassinht/mcp-observatory
Observations go into a signed RFC 6962 Merkle log, so these figures can be
recomputed rather than taken on trust. Corrections welcome — I have had to
correct my own numbers several times and the README records those.
Happy to share the full per-entry breakdown in whatever format is useful, or
to run a specific query against the archive.
Activity
yassinht commentedon Oct 9, 2026
Follow-up, 41 days in. The crawl has not missed a night since 30 August, so here is the same measurement again rather than a one-off.
2026-10-09, 26,130 declared endpoints:
tools/listunauthenticatedThree things that changed since September, in case any of them are useful:
rpc_errorwent from 0.6% to 5.6% — a tenfold jump in absolute terms, first appearing around 10 September. These are entries that speak MCP correctly and then return a JSON-RPC error totools/list. I have not investigated what causes it and it may well be benign, but it is the sharpest discontinuity in six weeks of data.Reachability itself has been remarkably stable: 50.5–58.5% across all 41 days, within eight points.
Still no action requested. The four expired domains from the original report are still listed. Raw data, method and a signed log are at https://github.com/yassinht/mcp-transparency-log — and as of this week the leaf hashes are published too, so the figures can be recomputed without downloading the archive.