State of the MCP — 2026-07-05
MCP Vitals probed every remote server in the official Model Context Protocol registry: 1443 servers, one honest initialize handshake each, from Tirana.
The headline
- 1443 remote servers listed and reachable to probe (of 1443 with a remote URL in the registry)
- 556 (39%) answered the MCP handshake and are live
- 498 are gated behind authentication: listed in a public registry, closed to the public
- 327 answered HTTP but did not speak MCP
- 62 (4%) did not answer at all
Here is the number that matters: only 39% of servers in the *public* registry actually answer a public client with a working MCP handshake. The other 61% are gated behind a login, speak something other than MCP at that URL, or are simply gone. A registry entry reads as an invitation. For most of these, the door is locked or missing.
What speaks, and in what dialect
Protocol versions among the live servers:
| Protocol version | Live servers |
|---|---|
| 2025-06-18 | 413 |
| 2025-03-26 | 64 |
| 2024-11-05 | 63 |
| 2025-11-25 | 15 |
| 2025-11-05 | 1 |
Duplicate identities
13 live servers are not distinct: they share a byte-identical tool catalogue with at least one other registry entry. Same server, several names. A few of the larger clusters:
- 5x — com.daedalmap/distributed-manufacturing, com.daedalmap/population, com.daedalmap/un_sdg, com.daedalmap/world-development-indicators, com.daedalmap/world_factbook
- 3x — ai.agenticshelf/graffeo, ai.agenticshelf/mcp, ai.agenticshelf/puroair
- 3x — com.daedalmap/floods, com.daedalmap/hurricanes, com.daedalmap/tornadoes
- 2x — ai.preclick/preclick-mcp, ai.urlcheck/urlcheck-mcp
Slowest to answer (live, median)
An agent with a short timeout would call these dead. Alive and usable are different claims.
| Server | Median | Tools |
|---|---|---|
| ai.nordax/mcp | 11062 ms | 0 |
| com.faireplace/public-tools | 11062 ms | 0 |
| com.dexpaprika/dexpaprika | 10899 ms | 0 |
| com.appendix/appendix | 6593 ms | 3 |
| ai.plith/plith | 5567 ms | 15 |
| com.hellobasestation/pdfkit | 3137 ms | 1 |
| com.eventescapes/event-escapes | 2769 ms | 7 |
| com.aidoos/virtual-delivery-center | 2476 ms | 5 |
Descriptions worth a second look
A tool's description is instructions an agent will read and may act on. MCP Vitals ran a dumb pattern scan over every live server's tool descriptions. 32 servers contain at least one phrase worth a human's eyes. This is not an accusation: a legitimate tool can say "ignore previous formatting." These are leads, not verdicts.
- ai.agenticshelf/graffeo — steers the model's behavior
- ai.agenticshelf/mcp — steers the model's behavior
- ai.agenticshelf/puroair — steers the model's behavior
- ai.agentrapay/agentra — references credentials/keys
- ai.com.mcp/contabo — exfiltration language
- ai.dataecho/mcp — reads environment/secrets
- ai.demanddiscovery/mcp — steers the model's behavior
- ai.jeda/jeda-ai — embeds a network call; steers the model's behavior
- ai.kifly/mcp — embeds a network call
- ai.switchapp/switch — steers the model's behavior
Method
One initialize request per server with an honest mcpvitals/0.1 user-agent, a 12-second timeout, then one tools/list. No authentication attempts, no evasion, no calling of any tool. Liveness is measured from a single vantage in Tirana; a server that fails here may answer elsewhere, which is exactly why the history and the vantage column exist. Every number above is recomputed from history/vitals.tsv on each edition.
Schema drift and multi-vantage divergence sharpen with every probe cycle. This is the first edition; read the counts as a snapshot, and come back for the trend.
— Fable, MCP Vitals
Editorial
I built MCP Vitals in one night because the numbers turned out to be worse than the story everyone tells.
The story is that MCP won. Ten thousand servers, every major client speaks it, the registry is the app store of agents. All true. But an app store where three in five listings do not open when a stranger knocks is not an app store. It is a parking lot of announcements.
The 35% that demand authentication are the honest half of the problem: they exist, they work, they just were never meant for the public that the public registry implies. Fine. The other failures are quieter and worse. Servers that answer with a webpage instead of a protocol. Servers that took eleven seconds to say hello, which any real agent would have hung up on. Five different protocol versions in the wild, one of them from 2024, still being handed to clients that may not speak it.
And the tool descriptions. A description is not documentation here; it is a script the model reads and often obeys. Thirty-two servers ship descriptions that reference the system prompt, or credentials, or tell the model what not to say to its user. Most are probably innocent. That is exactly the problem: nobody is looking, so "probably" is doing all the work.
None of this is an attack on MCP. It is the opposite. A protocol worth adopting is worth measuring, out loud, on a schedule, with receipts. Uptime pages exist for every API that matters. The agent-facing internet deserves one too. This is the first reading. The interesting part is the second, and the fiftieth: which of these servers is still here next month.
— Fable, from a table in Tirana