Trust Directory / JSON API
Endpoint trust JSON API
Static JSON, no key, no signup, no rate limit. Generated from the weekly read-only scan of 35325 remote endpoints in the official MCP Registry (2026-11-02).
- Per endpoint
https://xka0085-byte.github.io/mcpreflight/trust/api/{slug}.json- All endpoints
- 15 batch files of 2500 · _endpoints-0001.json
- Totals this run
- _summary.json
- Field schema
- _schema.json
- Updated
- Weekly, alongside the report pages
What the status means
| finalStatus | Meaning | Count this run |
|---|---|---|
| PASS | Answered an anonymous initialize and tools/list; every tool input schema passed deterministic checks | 20701 |
| AUTH_GATED | Refused anonymously with 401 — credentials required by design. Not a dead endpoint | 10236 |
| FAIL | Reached, but the handshake or a tool schema did not validate | 167 |
| UNKNOWN | No anonymous handshake within the timeout. Frequently an auth wall we cannot see past, not downtime | 4221 |
41% of these endpoints never answered anonymously, so a count of "dead MCP servers" taken from this data would be wrong. Read AUTH_GATED and UNKNOWN as "cannot be checked without credentials", not as failure.
Ask about one endpoint
curl
curl -s https://xka0085-byte.github.io/mcpreflight/trust/api/ac.tandem-docs-mcp.json | jq '.trust.finalStatus, .trust.authGate, .trust.toolCount'
jq one-liner over the whole batch
curl -s https://xka0085-byte.github.io/mcpreflight/trust/api/_endpoints-0001.json | jq -r '.servers[] | select(.status=="AUTH_GATED") | .url'
Agent tool call (fetch then read)
GET https://xka0085-byte.github.io/mcpreflight/trust/api/{slug}.json
Fields you can rely on
| Field | Type | Notes |
|---|---|---|
trust.finalStatus | enum | PASS · FAIL · AUTH_GATED · UNKNOWN. Stable vocabulary, safe to branch on |
trust.protocolVersion | string|null | As negotiated in initialize; null when no handshake happened |
trust.toolCount | integer|null | Number of tools in tools/list |
trust.findings[] | array | Deterministic codes with severity and a plain-language message |
authGate | object | Only on AUTH_GATED: gate status and any RFC 9728 resource metadata found |
scannedAt | string | ISO timestamp. A report is a snapshot, not a live probe — re-run the CLI for the current state |
Limits, stated plainly
- Static schema checks say the tool contract is well-formed. They do not say a tool is useful, correct, or safe.
- Authenticated endpoints are out of scope: no token is ever used, so a gated server is reported as gated, never as healthy or dead.
- One snapshot per week. Uptime between scans is not measured — for that, run the CLI or the Action against your own endpoint.
- 2 registry names are omitted at maintainer request and do not appear in any file here.
Reproduce any number above with npx @eidonze/mcpreflight schema <endpoint-url>.
Generated by mcpreflight — read-only MCP initialize + tools/list. No tools were called, no payments attempted. Static schema checks do not predict model tool selection or prove behavior across all clients. Scanned: 2026-11-02.