MCP servers, observed

The official MCP Registry says which servers exist. CrawlCheck records what each listed endpoint actually answered: whether it completed the MCP handshake, asked for credentials, or did not answer, and whether its tool list changed.

Coverage

Imported from the registry: 40,688 servers (latest versions, 407 pages of 100), 25,686 with a remote endpoint, pass 1 finished 2026-10-08. Re-imported every 7 days.

Observed this cycle: 11,529 endpoints. initialized 49.1% · initialized no tools 1% · auth required 32.4% · sse reachable 0.2% · not mcp 0.3% · http error 14.3% · redirected 0.8% · unreachable 1% · templated url 1% · invalid url 0% · tool list changed on 1

Login scope audit

Servers that ask for a login, read without signing in: 1751 of 3687 audited carry at least one finding (scope privileged 225, scope excess default 648, audience path mismatch 18, refresh by default 246, audience broad 328, audience other host 29, no protected resource metadata 466, authorization server metadata missing 20, pkce s256 not advertised 6). Audit any server: /api/v1/mcp/auth.

Tool shadowing

Servers from another publisher, on another domain, exposing the distinctive tool names of a server whose registry namespace is its own domain: 10 of 5623 servers with a tool list, compared with 4800 publisher-verified servers (copies 9, collides 1). Check the servers your client connects to: /api/v1/mcp/shadow.

Tool poisoning

Tool lists read for hidden characters, instructions aimed at the model, requests for secrets or the conversation, and instructions about other tools: 4 of 5418 servers carry at least one such text (this observation cycle so far). injected instructions 3 · exfiltration 2 · encoded blob 1. A finding is a quoted text to review, not a judgement of intent. Check any server before connecting: /api/v1/mcp/scan · rule MCP_TOOL_POISONING

Method: initialize, notifications/initialized, tools/list, DELETE session - no tools/call. Up to 100 endpoints an hour; a cycle is one pass over every listed endpoint, so each is contacted about once a cycle. JSON: /api/mcp/index · /api/mcp/servers?host= · reliability over time: /registry/mcp/reliability