I probed every remote server in the official MCP Registry. 30,557 URLs, one evening.

October 19, 2026

I build Preflight, a scanner that checks an MCP server before an agent connects to it. On October 19, 2026 I pulled every entry from the official MCP Registry, kept the ones that list a remote URL, and sent each one the two requests any client sends first: initialize and tools/list, with no credentials. No tool was ever called. Then I ran Preflight's rule functions on the manifests that came back. The rules match on names, descriptions and schemas, so treat every "flagged" number below as an upper bound and the reachability and manifest numbers as the hard part.

What is in the registry

The registry held 161,061 version entries for 45,899 distinct server names. Keeping the latest active version of each name and only the ones with a streamable-http or sse remote left 30,557 unique URLs. Each got one initialize, one initialized notification, one tools/list, a twenty-second timeout, and a User-Agent that links to Preflight.

So roughly a quarter of the registry is gated, a little over half is open to anyone who asks, and about a tenth is broken in some ordinary way: dead DNS, a 404, an expired certificate. 1,834 of the open servers declare an Authorization or API-key header in their registry entry and then answered without one.

Protocol versions

Of the 16,575 servers that answered, 9,036 returned 2025-11-25, 3,192 returned 2025-03-26, 2,736 returned 2025-06-18 and 649 returned 2024-11-05. 777 returned 2026-03-26, which is not a published revision; it is the version an earlier build of our own probe sent, and those servers echo whatever a client offers. Four of our own servers had the same bug until this afternoon, which is how I knew to look.

Manifests

The median server exposes 8 tools. The five largest expose 1,711, 1,423, 1,068, 1,000 and 791. Estimating tokens as characters divided by 3.8, 2,084 manifests (13%) cost more than 10,000 tokens on every session start, 174 cost more than 50,000, and the largest is about 878,000, which is bigger than most context windows. One tool description alone runs to 26,514 characters. 1,075 servers carry at least one description over 2,000 characters.

Across 270,968 tools, 148,597 (55%) carry any annotation at all. 6,560 open servers annotate none of their tools, which means a client has no readOnlyHint or destructiveHint to go on and has to guess from the name.

The 16,575 open servers collapse to 15,567 distinct manifests on 11,680 hosts. One host serves 2,365 listings with near-identical manifests, and 155 servers share one four-tool dataset schema. The registry counts names; the ecosystem is smaller than the count.

What the rules flagged

Counting a server once per category: blind writes (a tool that writes or deletes with no tool that reads the same thing back) on 1,621 servers; unbounded destructive arguments (a delete or overwrite whose path, pattern or query argument has no enum, pattern or length limit) on 322; capability overreach by keyword on 1,865; a known-bad signature on 10. Preflight's verdicts over the open set came out 10,769 clear, 2,886 caution and 2,920 high-risk, and the high-risk count leans on the keyword rules, so a human review would clear a good share of it. Two concrete shapes that would not be cleared: an open 35-tool server with an account deletion tool and no tool that lists accounts, and a trading product that lets anyone create strategies through a free-text selector with no bound at all.

Caveats

One snapshot over about ninety minutes. Unauthenticated probes only, so a gated server says nothing about what sits behind its login. Token counts are estimates, not tokenizer output. The obfuscation rule fired on blockchain tools that carry hashes, and the "package or code installation" keyword matched 2,702 tools that a person would mostly wave through. The 1,491 servers that rate-limited tools/list are not in the scanned set.

Raw data

Per-server results (name, URL, outcome, protocol version, tool count, estimated tokens, verdict, finding categories) are at /data/mcp-registry-scan-2026-10-19.json, about 9 MB. Tool manifests are not included; fetch them yourself from the URLs if you want them. To scan one server the way this did, paste its URL into Preflight; ten scans a day are free and need no signup.