The MCP census — October 2026

This report covers a full census run on 19 October 2026, published 20 October. Each census report is named for the month it is published and is a dated snapshot. The registry keeps changing, and so do these numbers.

The probing rules are on the probing standard. How the behaviour scores themselves are produced is on the methodology page. This report asks the same question as the September 2026 census, how many MCP tools can actually be probed?, seven weeks later.

Basis for this report: a full census of every distinct server in the MCP registry as of 19 October 2026. That's 41,501 servers after deduplication, with every remote-transport server checked, no sampling. The identity key is unchanged since the September census, so unlike September's comparison with the August sample, the counts below compare directly. The reproducible artefact is the method plus the live corpus, queryable at vouch.tools and vouch.tools/api/stats.

What changed since September

Three findings worth stating plainly:

1. The registry grew by two-thirds in seven weeks. 16,688 more distinct servers than on 30 August, under the same identity key. Remote servers grew faster than stdio ones: remote-reachable servers went from 55.5% of the corpus to 62.6%.

2. The unreachable rate fell, but the registry isn't getting healthier. The fall is entirely a mix effect. Remote servers already listed in late September are 33.1% unreachable, about where the whole corpus stood in September. Servers listed since then are 7.8% unreachable. Of the servers that were unreachable on 23 September, 96.7% still are. Dead listings are not being removed from the registry; they are being outnumbered by new ones that answer. A single corpus-wide unreachable rate hides this, and on its own would read as an improving ecosystem.

3. Output schemas are spreading. Tools declaring an outputSchema rose from 20.1% to 29.9%. The share of servers declaring at least one barely moved (31.8% to 32.5%), so the rise comes from tool-heavy servers that use them rather than from wider adoption.

1. The corpus

41,501 distinct servers, deduplicated by a version-independent identity key. The registry's listing still returns one row per published version, not per server. This run fetched 46,300 rows, and every figure below is against the deduplicated count.

The live corpus on vouch.tools carries 41,501 servers and 223,827 tools as of 20 October 2026, with 1,792 servers marked delisted. A delisted server's identity key has fallen out of the registry since it was last seen; it is retained and flagged, never deleted. The tool count is higher than this census's 161,125 because tool records are kept when a server stops listing a tool between sweeps. Reconciling that is a known, tracked gap.

2. Transport split: exact, full corpus

Transport is a pure function of the registry record, with no network call, so this split is exact. 62.6% of the corpus is remote-reachable, up from 55.5% in September. stdio-only servers remain out of scope until sandboxed local probing exists.

3. Credential class: full, not sampled

Every one of the 25,976 remote-transport servers was checked for an opt-out first.

• 720 had opted out (via robots.txt, /.well-known/mcp-probing.json or the manual deny-list). They were not contacted, and are recorded as opted out.
• 461 had an opt-out file we could not read: a timeout, TLS error or 5xx on robots.txt or mcp-probing.json. An unreadable opt-out is not permission, so these were skipped for this run rather than probed. This rule is new since September; see §6.

The remaining 24,795 were probed with initialize then tools/list, unauthenticated, with no credentials of any kind sent:

Probeable (A+B): 10,734 servers, 139,314 tools, measured directly with no extrapolation.

Class A grew fastest of any class (+125%), and its share of probed servers rose from 14.0% to 17.1%. Most of that is the new-server effect from finding 2: servers listed since late September are 20.9% Class A, against 15.1% for those already listed.

The declared-vs-enforced gap, unchanged. 693 Class C servers returned a full tools/list with no authentication and then gated the sample call. That's 21,811 tools listed by servers that will not let you call them anonymously, almost exactly September's 691 servers. The absolute number is stable while the corpus grew by two-thirds, so this inconsistency is not spreading with the registry.

4. Schema quality: full corpus

Across the 161,125 tools returned by the 11,418 servers that listed at least one:

• 100% declared well-formed input schemas, unchanged since the August sample.
• 29.9% of tools declare an outputSchema (32.5% of servers declare at least one), up from 20.1% of tools in September. See finding 3.
• 56.8% of tools declare themselves read-only (readOnlyHint: true), against 59.4% in September. A further 15.7% declare readOnlyHint: false, and 27.5% don't set it. Vouch records this annotation and does not trust it. A self-reported "I have no side effects" flag is precisely the signal this project was built to distrust, and side-effect classification for behavioural probing is done by hand.

5. Unreachable

6,067 of 24,795 probed remote servers (24.5%) were unreachable: connection failures, timeouts, or 5xx after a single-attempt probe. There are no retries against third-party servers, by design. A server whose origin answered neither opt-out file at all (no DNS, no connection) is recorded as unreachable without an MCP request being sent.

Of the 5,178 servers that were unreachable on 23 September and probed again, 5,007 (96.7%) still were. Of the servers that answered on 23 September, 3.6% have since stopped answering. Broken listings accumulate; they are rarely fixed or withdrawn.

Two caveats on comparing 24.5% with September's 31.1%:

• The 461 servers skipped for an unreadable opt-out are excluded from the denominator. Their opt-out files were failing, so many of their MCP endpoints would probably fail too. Counting every one of them as unreachable would give 25.8%, still a clear fall.
• The fall is compositional. See the table above. The registry is not repairing itself.

6. Method: what is the same, what changed

Same as September: registry sync via full cursor pagination with every raw page archived; transport classification as a pure function; the same version-independent identity key; credential classification by unauthenticated initialize then tools/list, with a conservative read-only heuristic that does not trust readOnlyHint; a global concurrency ceiling of 4 with never more than one request in flight per host; 429 retried with Retry-After backoff, first-attempt-only for third-party timeouts and 5xx.

Changed since September:

• Opt-outs now fail closed. Following RFC 9309, a 4xx on robots.txt or /.well-known/mcp-probing.json means nothing is published. A 5xx, 429, network error or timeout means the opt-out is unknown, and the server is skipped for that run instead of probed. Each server's opt-out check is archived with the run.
• Dead origins are recorded without an MCP request. If neither opt-out file gets any response, the server is recorded as unreachable and not contacted further.
• Our own connectivity is checked before blaming a server. Every no-response failure is checked against independent reference hosts before it is recorded. If those are down too, probing pauses and the server is retried, so a local network fault cannot be recorded as servers being unreachable. It did not trigger during this run.
• Contact address. Every request carries Vouch-Census/0.1 (+mailto:probing@vouch.tools; read-only census probe; see https://vouch.tools/probing-standard).

7. What this method still could not determine

• Credential class for stdio-only servers. 37.4% of the corpus cannot be handshaken without executing third-party code, which is the job of sandboxed local probing.
• Class B resolution. 6,493 candidates is a count of servers that need a human to look at the evidence, not a final classification into A or C.
• Deep behaviour for most of the probeable universe. 139,314 tools are reachable for probing. The published deep-behaviour corpus is far smaller. The census says what can be measured, not what has been.
• The 461 servers with an unreadable opt-out. Their class is whatever an earlier census found, if any, until a run can read their opt-out.
• No published, stable IP range. The probing standard calls for probing from a published range, and this run did not.
• The read-only heuristic is still a deliberate lower bound. Genuinely read-only tools whose names do not lead with a safe verb fall into Class B, not A. Class A is a measured floor, not a precise count.

8. Reproducibility

The census method is described above, and its decision functions are individually unit-tested. That covers the identity key, transport classification, the read-only heuristic, credential classification, the opt-out rule and the rate-limiter policy. Re-running against the live registry will not reproduce byte-identical output, because the registry changes continuously, but it reproduces the method, which is the thing that has to hold up. The raw per-server output of this run is not published as a file. The reproducible artefact is the method plus the live corpus, which is the census result and is queryable at vouch.tools.