About our probing

Either your endpoint is on our public tracking list — built from public MCP registries and a short hand-picked set of well-known servers — or someone asked us for a one-off check of it. Every request identifies itself with the User-Agent below.

Scheduled checks, on servers without an active operator claim: one round every 12 hours, at most 8 requests per round, per endpoint. If the server returns its tool list in pages, we send up to 9 more requests to read the rest of it, so at most 17.

Scheduled checks, on servers with an active operator claim: one round every 8 hours on the Free plan and every 15 minutes on Indie, at most 8 requests per round, per endpoint. If the server returns its tool list in pages, we send up to 9 more requests to read the rest of it, so at most 17.

When the Registry lists a different address for a server we track, we may send one extra test round to that address, without credentials and within the request limits above, to see whether it answers.

One-off checks started by a visitor or by an agent through our MCP endpoint: at most 8 requests per check (at most 17 if the server returns its tool list in pages), and never more than one check per host every 10 minutes. These run only when someone explicitly asks for a check of that endpoint.

When we discover a server on our own, we read its robots.txt first and skip servers that disallow automated clients. Checks that a maintainer or a visitor asks for are not subject to robots.txt.

We never send authentication credentials of our own — if your server requires auth, we only observe how it challenges for it, not attempt to bypass it.

We time the requests we already send; timing adds none.

Every 6 hours we compare the endpoint we probe for each server we added from the Registry with the addresses the Registry lists for it; a full pass over them can take several rounds. An endpoint the owner gave when adding the server through a claim, or one we set by hand, is never changed by this comparison.

Email us and we will stop every check of that endpoint. The server is removed from the directory, and its report and attestation pages return 404 from then on. Signed records already issued are kept with their content and signatures unchanged: in our database for at least 30 days, then in cold storage. We no longer publish them.