{"title":"MCP registry report","url":"https://lazaretto.dev/mcp-registry-report","as_of":"2026-10-21T21:31:48.766Z","coverage":0.054,"complete":false,"servers":{"listed":25330,"read_attempted":1360,"tools_listed_to_anyone":799,"wanted_credentials":442,"unreachable_or_unread":119,"set_instructions":522,"flagged":1},"tools":{"total":9141,"median_per_server":6},"flagged_by_rule":{"pi.instruction_override":1},"weekly":[{"date":"2026-10-21","listed":25330,"checked":1360,"read":799,"needsCredentials":442,"unreachable":117,"unread":2,"flagged":1,"tools":9141,"withInstructions":522,"medianTools":6}],"method":"Each remote server the official MCP registry lists with a public endpoint is sent initialize and tools/list, the way an MCP client connects; no tool is ever called. Every tool name, description, schema and server instruction is checked by deterministic tool-poisoning rules. Re-read weekly.","caveats":["A server that wants credentials cannot be read; it is counted, not checked.","Local stdio servers are not in the registry remote list and are not covered.","A server can change its tools at any time; each figure is as of its read.","A clean read means these rules found nothing, not that a server is harmless."]}