Data exports

capability-observations-2026-09-02.jsonl.gz — 1.0 MB gzipped, 29,584 rows, JSONL

One row per MCP capability observation, for the 6,033 endpoints (4,027 hostnames) observed two or more times. Every row carries registry_name, so it joins against registry-derived datasets.

registry_name, host, service_slug, endpoint_url,
observed_at, tools_hash, tool_count, digest_version

sha256 (after gunzip) 7d9a8efe2f2eb1f71a09e4ba302827f8ab021ddcfea1add982687b6f25a8fc83
sha256 (.gz as served) 661c13873a53534e3479a833e006fa1a41a5760ec9c0b4477ab6ff8b52b6436f

Read this before comparing hashes

The capability digest changed definition at2026-08-26T11:14:37Z. Before that it covered tool name and input schema. From that point it covers name, description, input schema and annotation values — widened after a reader pointed out that tool poisoning lives in the description, so hashing names and schemas alone meant a poisoned description produced no drift at all.

A hash comparison spanning that timestamp therefore reports a change that did not happen. Every row carries digest_version; compare only within a version. 6,028 of 6,033 endpoints have two or more observations inside a single version, so almost nothing is lost — but only because it is declared.

Limits

• Coverage starts 2026-08-12. Earlier change is invisible and is not absence.
• Rescan interval is 2 days, so "within one window" means up to ~48h of resolution, not same-day.
• 17% of hostnames opt out via robots.txt and are excluded entirely, so this is not all reachable MCP servers.
• Descriptions are truncated at 500 characters before hashing. A change past that point is invisible, so drift counts are lower bounds.
• tools_hash is comparable only within oneendpoint_url. It is not a cross-server fingerprint.
• No tool is ever invoked, so every figure describes what is listable, not callable.