How this was measured.

Every server was taken from the official Model Context Protocol registry at registry.modelcontextprotocol.io. We harvested every entry carrying a remote endpoint and discarded anything that was not a reachable public HTTPS URL: templated addresses such as https://{HOST}:{PORT}/mcp, localhost, and private addresses. A complete enumeration on 28 October 2026 found 51,705 named servers, of which 37,093 publish a remote endpoint, across 26,650 distinct hosts.

We then took one endpoint per host, so that a single large platform could not flood the sample, and ranked hosts by how established they look in the registry: how many servers they publish and how long they have been listed. The top 200 were scanned.

The first selection rule was wrong and we changed it. Ranking by most-recently-updated returned 200 servers published in the previous thirteen hours, which measures what was uploaded that day rather than what the ecosystem runs on.

It connects as an ordinary unauthenticated MCP client and asks the server what it publishes: its tools, its resources and its prompts. It reads the text of up to 25 resources. Then it disconnects.

It never invokes a tool. Not a read-only one, not a harmless-looking one. Nothing on any server in this index was called, nothing was written, and no credential was supplied or guessed. Everything the index reports is something the server volunteers to any stranger who connects, which is the same thing an attacker would see before doing anything at all.

This is the same free Snapshot that anyone can run from this site against their own server, running the same checks in the same order.

Findings are produced by checks mapped to the OWASP Top 10 for Agentic Applications and NIST IR 8596, and carry a severity. The grade is a function of the findings: critical findings dominate it, highs move it, and a clean surface scores well.

No server in this index scored an A, and that is structural rather than damning. An A needs an authenticated surface. A server that answers a stranger has already ruled it out, and the servers that did demand authentication were never graded at all, because there was nothing public to grade. They are counted, at 72 of 200, as the largest single group in the survey.

Equally, every graded server carries a high-severity finding reading “reachable without authentication”. That is definitional: the graded set is the set that answered. We say so on the report rather than presenting it as a discovery.

The scan found credential-shaped strings on the public surface of 2 servers. Those findings are not published, their pages are held back entirely, and only the count appears. Publishing them would hand a working secret to every reader of this page.

Those operators are being contacted privately. Their servers stay inside the aggregate counts, so the statistics on the report describe the whole sample even while two pages are missing from the table.

Every stored error message is also scrubbed of long opaque strings before it reaches this site, because provider error bodies routinely carry request identifiers and occasionally fragments of a token.

It is a point in time. Every grade carries the date it was taken. A server that was open on that date may be locked down today, and the reverse is just as true.

It reads the registry, not the internet. A server that is not listed in the official registry is not here, however widely it is used.

Non-answers are classified from error text. Servers refuse in at least eleven different wordings, most carrying no status code, so the difference between “demanded authentication” and “was simply broken” is read from the message. We tuned those rules against the real responses until nothing was left unclassified, and the classification is still a judgement about someone else's error message.

One endpoint per host. A platform hosting two hundred servers is represented by one of them, so this describes hosts rather than every individual server.

The pool this sample was drawn from was incomplete. The harvest that fed the 13 October scan stopped after 10,152 hosts, because the registry's pagination returned an end-of-list marker early. A complete enumeration on 28 October found 26,650. The 200 servers scanned are therefore the most established hosts within roughly the first 38 percent of the registry as it paginates, not within all of it. We found this by re-running the harvest rather than by trusting the first result, and the next scan will be drawn from the full pool.

Ask for a re-scan and we will take a fresh reading and update the page. It is free, there is no condition attached, and you do not have to buy anything. If you think a finding is wrong, tell us what we got wrong and we will correct or remove it.

If you would rather not appear at all, say so and we will remove the page. We would rather have an accurate index than a complete one.