# ProtocolProbe

> Dated facts about MCP servers from the official registry and public records. Every figure names its source and the date it was checked. ProtocolProbe calls no server's tools for anything it publishes (one dated exception, a check of its self-test command, is described at /security) and publishes no security-check outcome for a named server. Aggregate reports, plus one page per registry entry with its checked facts.

Key facts (registry snapshot 2026-10-04, upstream checks 2026-10-06):
- 13.9% of all 38,977 entries in the official MCP registry (5,435) have at least one problem the registry doesn't catch. Full count, not a sample.
  - Repository link can’t be opened publicly: 11.0% of all entries (4,298); registry check: never checked; cite: https://protocolprobe.com/mcp/reports/registry-vs-reality#repoUnreachable
  - Listed version is withdrawn upstream: 1.7% of all entries (663); registry check: never checked; cite: https://protocolprobe.com/mcp/reports/registry-vs-reality#withdrawn
  - Active, but declares no way to run it: 1.2% of all entries (459); registry check: allowed by schema; cite: https://protocolprobe.com/mcp/reports/registry-vs-reality#noWayToRun
  - Linked repository is archived: 0.8% of all entries (309); registry check: never checked; cite: https://protocolprobe.com/mcp/reports/registry-vs-reality#archived
  - Listed version can’t be installed: 0.4% of all entries (157); registry check: verified once; cite: https://protocolprobe.com/mcp/reports/registry-vs-reality#cannotInstall
- The registry checks a package's exact listed version at publish (by default) and never re-checks it. It checks repository links for format only.
- These are not security findings and not judgements of publishers.
- Of all 38,977 entries, 19,568 were opened in a live read-only session and 19,409 have no exercised security checks; every untested entry states why, split by whose limit it is — the server's own choice (10,520), a package defect (1,848), our limit (356) or an undetermined cause (6,685). A check we did not run is never counted as passed.

## Reports

- [The MCP registry vs. reality](https://protocolprobe.com/mcp/reports/registry-vs-reality): the full report, definitions and caveats. Every figure has a permanent anchor (#headline, and #<finding id> as listed above) and a ready "Cite this figure" line with the number, its base, the registry snapshot and check dates
- [Report data (JSON)](https://protocolprobe.com/mcp/reports/registry-vs-reality/data.json): the aggregate figures the report shows
- [What's in the MCP registry](https://protocolprobe.com/mcp/reports/catalogue): all entries by language, MCP features, dependency advisories, license, maintenance and where they run, each with its coverage
- [Catalogue data (JSON)](https://protocolprobe.com/mcp/reports/catalogue/data.json)
- [Why some MCP servers have no security result](https://protocolprobe.com/mcp/reports/not-tested): the 19,409 untested entries by reason and owner (our limit, the server's own choice, a package defect, or undetermined)

## Servers

- [MCP server directory](https://protocolprobe.com/mcp/servers): every registry entry (38,977) has its own page; 19,568 were opened in a live, read-only session (data as of 2026-10-14). Each page (/mcp/servers/<namespace>/<name>): what we tested and what we left out, whether the listing matches reality, install and repository facts, each with source and date; where the registry entry allows it, ready-to-paste client config (Claude Desktop, Cursor, VS Code, Claude Code) and a one-click Cursor install link when nothing needs filling in. We do not publish security-check outcomes for named servers.
- "Is <server> safe to install?": each server page answers this at /mcp/servers/<namespace>/<name>#safe with the facts we hold (build-provenance attestation, whether the repository opens, maintenance, deprecated, whether the listed version is current or installable, known vulnerabilities in the package, dependency-tree advisories with counts, tools described as changing data). It is never a rating or a verdict ("we do not rate servers as safe or unsafe"). The page's common questions are also published as schema.org FAQPage data.
- Version history: each server page (in "How fresh this is") gives the number of versions still listed in the registry, the first and latest dates, how many were published in the 90 days before the registry snapshot, how many are marked deprecated, and the most recent 12. Removed versions are not in the registry, so it is "versions listed", not every release.
- [Publishers](https://protocolprobe.com/mcp/publishers): every registry namespace with two or more servers, most servers first; each publisher page (/mcp/publishers/<namespace>) counts facts over all its servers (where they run, repositories that open or not, deprecated, npm build provenance, servers we opened, same-tools groups) and lists them. A namespace is tied by the registry to a verified GitHub account or domain. Facts, not a rating.
- [Leaderboards](https://protocolprobe.com/mcp/servers/top): top 100 MCP servers by monthly downloads (/mcp/servers/top/downloads), by GitHub stars of the linked repository (/mcp/servers/top/stars), and the servers that meet all 9 record checks (/mcp/servers/top/all-checks). A package or repository listed under several entries is ranked once; each list says what its number does and does not mean.
- Ranks on every server page: its downloads rank among all npm/PyPI packages ("#N of M packages by monthly downloads", ties stated, entries sharing a package share its rank) and, from 10 GitHub stars, its stars rank; otherwise the plain reason (for example a remote server publishes no download figure). Deprecated entries are not ranked. Method: https://protocolprobe.com/methodology#rankings.
- Record checks: every server page shows "N of M record checks met" at #record-checks: nine facts from public records (registry entry active and runnable, repository opens, not archived, pushed in the last 90 days, SECURITY.md, SPDX licence, listed version installs, npm build attestation, no known critical/high advisory). Checks that do not apply or could not run are listed, never counted. Not a safety rating; method at https://protocolprobe.com/docs/record-checks. The API carries it as `recordChecks`, and the README badge shows the count.
- [Servers that share an identical tool list](https://protocolprobe.com/mcp/servers/same-tools): every group of registry entries whose read tool lists have exactly the same tool names, largest first.
- "Same tools as other registry entries": a server page shows, at #same-tools, the other registry entries whose read tool lists have exactly the same tool names (3 or more), how many publishers they span, and whether the descriptions are also identical. It can be one publisher's family of servers or one template reused under many names; it is a fact about published tool lists, not a judgement of the publisher or a safety finding.
- [Live-tested servers](https://protocolprobe.com/mcp/servers/tested/1): only the servers we opened a live session with (read-only: no tool was called)
- [Servers by what their tools do](https://protocolprobe.com/mcp/servers/tool-type/changes-data/1): lists of servers that have a tool of one kind (reads or searches, creates or changes data, deletes, sends messages, runs code, moves money, ...) or a tool whose description says it changes something (8,501 servers). We read the tool list of 17,549 servers (296,503 tools) without calling any tool; the kind and the change mark are an AI model's reading of the publisher's description, two differently worded runs had to agree, and nobody has checked them by hand. Each server page also shows the publisher's first description sentence per tool, how clearly the descriptions are written (counted facts and AI yes/no readings, no grade) and how consistent the tool list is.
- Security policies: for 24,256 servers with a readable GitHub repository we looked for a public SECURITY.md; 7,304 publish one and 273 contain a statement about security research, quoted on the server page in the publisher's own words (not permission for us to test anything).
- [All servers in another order](https://protocolprobe.com/mcp/servers/browse?sort=downloads): the whole directory by downloads last month (npm or PyPI), GitHub stars (sort=stars), the registry date of the latest release (sort=released) or of the earliest version still listed (sort=listed, newest in the registry); servers without the figure follow in name order; filters runs=remote|local|both, pkg=npm|pypi|mcpb|oci|nuget|cargo, lang=<language>, license=permissive|copyleft|other, maint=active|slowing|stale|archived, status=active|deprecated, prov=attested|repo|norepo (npm build-provenance attestation; source repository opens publicly; repository link does not open), topic=<topic>, read=yes
- [Compare two servers](https://protocolprobe.com/mcp/compare): any two registry servers side by side (/mcp/compare?a=<namespace/name>&b=<namespace/name>), the same values as their pages, no score and no security check result
- [API](https://protocolprobe.com/docs/api): the same per-server facts as JSON, read-only, no key, CC BY 4.0 ([OpenAPI](https://protocolprobe.com/api/v1/openapi.json))
- [Discover command](https://protocolprobe.com/docs/discover): a free local command (npx protocolprobe-discover) that lists the MCP servers configured on your own machine and which are in the official registry; reads config files only, sends nothing, never prints secrets


## Citing

- [How to cite ProtocolProbe](https://protocolprobe.com/docs/cite): per-figure citation lines on the reports, the credit line every API record carries, and the dataset DOI. Licence CC BY 4.0.
- [Full dataset on Zenodo](https://doi.org/10.5281/zenodo.23386799): every server's facts (DOI 10.5281/zenodo.23386799, all versions; this version 10.5281/zenodo.23386800, registry snapshot 2026-10-04), CC BY 4.0, no security check outcome.

## Tools

- [Test your own MCP server](https://protocolprobe.com/docs/selftest): a free command (npx protocolprobe-selftest) that runs these checks against a server you run yourself: started on your machine (stdio), or your own Streamable HTTP server at a URL after a one-time proof in its MCP instructions. It runs on your machine; results stay there; nothing is sent to us; the only score is "N of M checks passed" over the checks that ran, never a grade. From 0.4.0 it can fail a CI job (--fail-on-finding, exit 5) and write SARIF for GitHub code scanning (--sarif).

## About the data

- [Methodology](https://protocolprobe.com/methodology): sources, bases, definitions
- [Corrections log](https://protocolprobe.com/corrections): every mistake we found, including before publishing
- [Updates](https://protocolprobe.com/updates): what changed on the site, newest first, each with its date (also in the Atom feed at https://protocolprobe.com/feed.xml)

## Optional

- [Security & disclosure](https://protocolprobe.com/security)
- [Terms](https://protocolprobe.com/terms): per-server data (pages and API) under CC BY 4.0; quote reports with a link and the check date