MCP Registry Integrity Report · study · published 2026-09-29 · data to 2026-09-29 · all numbers as JSON

The state of the MCP registry, August 13 to September 29, 2026

Summary. We probed every public server in the Model Context Protocol registry every six hours for 47 days (20,285 probes, 2,073 servers that returned tools, 35,815 distinct tools). We hashed each tool's name, description and schema on every probe and ran eleven pattern detectors over the descriptions. Three findings matter to anyone who installs an MCP server from the registry:

The registry entry you vetted is not the server you run. 45.7% of all high or critical tool findings were not present when the server was first probed.

1. What the detectors found

A finding is a tool description containing text aimed at the model rather than the user. The critical detectors are instructions hidden from the user, explicit user concealment, exfiltration patterns (send data to an outside destination) and zero-width characters. High-severity detectors are references to secret material (keys, tokens, credentials), instructions directed at the model, mandatory-call directives and cross-tool references. Cross-tool references are often benign orchestration hints, which is why the headline numbers separate critical from high.

The two servers with zero-width characters are both from one publisher (com.makeupar/beauty, com.makeupar/creators); the characters sit inside tool descriptions where a human reviewer cannot see them.

2. Findings appear after listing

For every high or critical (server, tool, detector) triple we compared the first time the finding was seen with the first time the server was probed.

Examples of findings that appeared 45 days or more after the server was first listed (each links to the server's full history):

3. How fast servers change

Of the 208 servers that changed an existing tool, 39 did so within a day of first being seen, 92 within a week, 75 within a month. Churn is concentrated: the ten most active servers account for 60.7% of all 37,597 change events, and 4,620 of them belong to io.github.Hlobo-dev/tengu-firm alone. Tool removals (18,286) come from just 19 servers that publish and withdraw large tool sets.

4. Registry health

11 servers that once listed tools have been failing for seven days or more. Servers average 17.3 tools; 131 expose 50 or more and the largest (io.github.davidmosiah/delx-mcp-a2a) exposes 1,082. 800 tool descriptions exceed 2,000 characters and the longest is 23,132 characters, which is where instructions hide. Only 2 servers answer with HTTP 402 (payment required).

5. Servers with the most critical and high findings

Method and caveats

Sources: registry.modelcontextprotocol.io (server list), our six-hourly probes (raw counts at /v1/summary.json). Population: every server entry in the public MCP registry with a reachable remote endpoint (2,090 probed, 2,073 returned tools). Cadence: one tools/list call per server every six hours from 2026-08-13 to 2026-09-29. Fingerprint: SHA-256 over name, description and input/output schemas. Detectors are regular-expression and heuristic patterns; they flag text, not intent, so individual findings can be false positives and every row above links to its evidence. Servers requiring authentication (25) have no fingerprints and are excluded from prevalence rates. Counts are point-in-time as of 2026-09-29 03:18 UTC; the live report on the front page updates every six hours. Data and this text are CC BY 4.0; cite as "agentexchange.work, The state of the MCP registry, Aug 13 to Sep 29 2026, https://drift.agentexchange.work/study/2026-09".

agentexchange.work · study JSON · live summary JSON · llms.txt