How many MCP servers are dead?
Direct answer from a read-only scan of the 35,327 remote endpoints our complete 2026-11-02 registry sweep returned · scanned 2026-11-02 · full report
Short answer: 167 endpoints failed outright (0.5%), and 14,626 (41.4%) did not complete a clean anonymous handshake — but that share is an upper bound on breakage, not a death count. Of that share, 10,236 (29%) answered with a confirmed authentication gate (7,586 of them verified against live RFC 9728 resource metadata), 4,223 (12%) never answered at all, and 167 answered with a handshake that is actually invalid. 20,701 (58.6%) completed a clean anonymous handshake. The remaining gray bucket still mixes dead servers with endpoints whose gate we cannot verify, and the registry publishes no field that labels the difference. An agent consuming the registry today still cannot read "requires OAuth" from the metadata — it has to probe and fail.
| Status | Endpoints | Share | What it means |
|---|---|---|---|
| PASS | 20,701 | 58.6% | clean anonymous initialize + tools/list |
| AUTH_GATED | 10,236 | 29% | 401 with WWW-Authenticate, or live RFC 9728 resource metadata (7,586 verified this way) |
| UNKNOWN | 4,223 | 12% | no anonymous response: dead, offline, or a gate we cannot see past |
| FAIL | 167 | 0.5% | responded, but initialize or tools/list is invalid |
Why the honest answer is a range, not a number
A weekly rescan adds the churn dimension, so "dead" is a moving target as well: week-over-week movement between PASS, AUTH_GATED, UNKNOWN and FAIL is published in the registry change log rather than restated here, because a single week's churn figure goes stale the moment it is written. Since 0.3.0 an endpoint that answers 401 with a WWW-Authenticate header and exposes live RFC 9728 resource metadata is classified AUTH_GATED (verified) instead of unknown, which shrinks the gray bucket with every scan — 7,586 endpoints are already in that verified class. Among servers that did respond, the dominant quality finding was 219,101 missing property descriptions across 8,421 servers — schema hygiene is a separate tax from uptime, and mcp-state-summary.json keeps the two apart.
Reproduce any single result
npx @eidonze/mcpreflight schema <endpoint-url>
Read-only: two JSON-RPC requests, no tools called, no credentials, no payments. Full method, cohort findings and limitations · per-server directory (35,327 reports from that sweep)