Measurement, never certification

The MCP Trust Board

One question per round: how many publicly enumerable MCP servers answer a correct protocol handshake, and under what authentication posture? Nothing more. Never server quality, never safety, never a trust score. Host names are withheld by design — naming is not the product.

Latest round · 2026-09-11T05:31:47Z

259 of 500 enumerated hosts answered a correct MCP initialize; 207 answered with an auth challenge (a term sheet, not delivery); 20 were unreachable or gone (never FAIL). Counts only by doctrine.

Enumeration: 500 unique hosts from 2188 registry rows (https://registry.modelcontextprotocol.io/v0/servers). Enumeration incomplete — recorded, never passed off as complete (cap reached).

Answered handshake · tools counted239
Answered handshake · open20
Auth challenge (401/403 — a term sheet, not delivery)207
Payment challenge (402 — an invoice, not delivery)0
Alive, but no protocol-valid MCP reply5
Listed, no usable reply0
Unreachable or gone (never FAIL)20
Other error9

Auth posture observed

188

challenges indicating bearer/OAuth-family schemes

Tools listed (aggregate)

1643

across 239 answering servers · median 3 each — counted, never called, never named

Rate-limited probes

0

the board backs off; it never retries into a rate limit

What this does not measure

This snapshot does not measure server quality, the safety of any tool, whether a listed tool does what its name claims, compliance with the MCP authorization specification, or any property of servers not listed in the enumeration source. The true internet-facing population is larger than the enumerable one and stays an open, unmeasured cell.

Third-party context

A third-party study ('Exposed by Design') reportedly found ~21,000 internet-facing MCP servers, 91.8% without OAuth. That figure is cited as context only — it is NOT a CSOAI measurement and is not reproduced here.

Method

One POST initialize (protocol 2025-06-18) per host, identifiable UA 'csoai-mcp-trust/0.1 (+https://councilof.ai/trust)', 14s timeout, 12 workers; exactly one tools/list if and only if initialize answered — tools counted, never called, never named. Zero authentication attempted, zero payment, zero signing, zero side effect.

The rules of this board

  • Read-only by construction: one initialize per host per week; one tools/list only if the handshake answers. Tools are counted, never called.
  • No authentication is ever attempted — the board holds no credentials and never will.
  • A 401/402 challenge is recorded as a term sheet. It is never a verdict.
  • UNREACHABLE is never FAIL. A timeout says where we stood, not what they are.
  • Counts, snapshots and diffs are free, public, forever. A named party may commission a signed card for their own server via the existing metered door; host-level data about other parties' servers is not for sale at any price.
Machine artefact (JSON)Methodology specHow signing worksDoctrine