Methodology and probe policy

What we measure

Public remote MCP servers listed in the official MCP Registry (latest version, status active, an https remote without URL variables). Servers under domain-verified namespaces are added first; servers that someone looks up through check_tool are added on request (bounded). We don't rank our own server.

Probe policy

• At most one handshake per server per hour, from Cloudflare's network.
• Only the MCP lifecycle and discovery calls: initialize, the required notifications/initialized, and tools/list (first page). No tool calls.
• No authentication. We never send credentials, tokens or API keys. A server that answers 401 is recorded as "up · auth required".
• No bot-check bypass. If a server or its CDN refuses the probe (403, 429, a challenge page), we record "blocked", never "down", and exclude it from uptime.
• User-Agent: AgentStandingsProbe/0.1 (+https://agentstandings.com/probe)
• For servers that answer 401, we read the OAuth protected-resource metadata the 401 points to (or /.well-known/oauth-protected-resource) at most once a day.
• Once a day we read the TLS certificate's expiry date with a TLS 1.2 hello and hang up before any data is exchanged. Servers that only offer TLS 1.3, or sit on Cloudflare's network, show "unknown".
• Responses are capped at 256 KB and 10 seconds per request.
• Opt-outs are honored within 24 hours, usually immediately.

The request we send

POST <endpoint>
User-Agent: AgentStandingsProbe/0.1 (+https://agentstandings.com/probe)
Content-Type: application/json
Accept: application/json, text/event-stream

{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"AgentStandingsProbe","version":"0.1.0"}}}

Status definitions

• up: initialize and tools/list both returned valid JSON-RPC results.
• up · auth required: the endpoint answered 401. "OAuth (metadata OK)" means the protected-resource metadata lists an authorization server.
• degraded: initialize worked but tools/list failed.
• down: no connection, timeout, TLS failure, or HTTP 5xx.
• error: the endpoint answered, but not with MCP (e.g. 404, an HTML page, a JSON-RPC error to initialize).
• blocked: the server or its CDN refused our probe. Excluded from uptime.

Uptime = up / (up + down), where up = up + auth required + degraded and down = down + error. An incident opens at the first down or error check and closes at the next up check. Latency is the initialize round trip; p50 and p95 are per UTC day. Drift: we hash each tool's name, title, description, input and output schema and annotations (key order and list order don't count), and log a drift event whenever the set changes between checks.

Neutrality

• No paid placement. Paying for alerts never changes a server's status, rank or listing.
• Methodology public (this page); data published weekly under CC BY 4.0 (data).
• Right of reply: maintainers can send corrections or a reply to probe@agentstandings.com.
• Sponsors: none.

Corrections log

No corrections yet.

Opt out

Stop all probes to a host. We stop within 24 hours (normally at once) and show the server as "not measured (opt-out)".