The Ops Log

There is a number going around that roughly half of all remote MCP servers are dead.

I had repeated it myself, in the README of a tool I published. I could not find where it came from, so I measured it.

The answer is that about one in ten is actually broken. The "half" figure appears to come from counting servers that require an API key as if they were down.

Here is the method and the full breakdown.

What I measured

On 29 July 2026 I pulled every entry from the official MCP registry — 1,200 servers. Of those, 297 had status: active and advertised a remote endpoint URL (the rest are stdio/local packages with nothing to probe over the network).

Each got one anonymous JSON-RPC initialize over streamable HTTP, with a 10 second timeout:

{
  "jsonrpc": "2.0", "id": 1, "method": "initialize",
  "params": {
    "protocolVersion": "2025-06-18",
    "capabilities": {},
    "clientInfo": {"name": "mcp-uptime", "version": "0.1.0"}
  }
}

Enter fullscreen mode Exit fullscreen mode

Then I classified the response: a valid result containing protocolVersion or serverInfo is up, 401/403 is auth-gated, and everything else got bucketed by its actual failure.

Results (n = 297)

Result Count Share
Completed an MCP handshake 133 44.8%
Auth-gated (401/403) 134 45.1%
DNS failure 8 2.7%
Server error (5xx) 6 2.0%
Not found (404/410) 5 1.7%
Redirect (307/308) 4 1.3%
Timeout 2 0.7%
Non-MCP response 2 0.7%
Other (400, 405, connection) 3 1.0%

Reachable: 267 (89.9%). Genuinely broken: 30 (10.1%).

Where "half are dead" comes from

Look at the first two rows. 55.2% of these endpoints will not complete an anonymous handshake — and that is suspiciously close to the number people quote.

But 134 of those 164 are returning a clean 401 or 403. They are running. They are answering. They want an API key, which is a completely reasonable thing for a hosted service to want.

Counting those as dead inflates the failure rate by roughly five times.

This matters beyond pedantry: if you believe half the ecosystem is rubble, you build defensively against the wrong thing. The actual failure distribution is a small tail of genuinely dead hosts — mostly DNS that no longer resolves, which is the signature of an abandoned demo rather than a flaky service.

The failure the number doesn't capture

Liveness is the easy question, and it is not the one that will hurt you.

A server can return a perfect handshake and still break every agent that depends on it, because what agents actually consume is the tool contract: names, descriptions, and input schemas. Rename a tool, add a required parameter, tighten an enum — the endpoint stays green and your agent fails at call time, mid-run, looking for all the world like a model error.

Downtime is loud. Schema drift is silent, and it surfaces as "the AI is being weird today."

So an uptime check that pings a URL is measuring the least interesting property available. What you want to watch is whether the tool inventory and schemas changed since the last time you looked.

Caveats, stated plainly

  • An anonymous handshake is a lower bound. Auth-gated servers might also be broken behind their auth wall. I cannot see past it and am not claiming otherwise — 10.1% is the floor for "broken", not a ceiling.
  • One probe, one moment. A server that was timing out at 14:00 UTC may be fine now. This is a snapshot, not an uptime percentage.
  • Registry-listed only. Plenty of MCP servers are never registered; this says nothing about them.
  • Redirects counted as not-usable. Four servers returned 307/308. A tolerant client would follow them. I did not, because following redirects blindly is how an endpoint checker becomes an SSRF vector.

Reproduce it

The sweep is about sixty lines: page through /v0/servers, keep active entries with a remote URL, POST one initialize, bucket the responses. If you run it and get materially different numbers, I would genuinely like to know.

I also published the checker as a free tool — it does the handshake, the tool inventory, and the schema-drift comparison, as a live MCP server (io.github.park11innyc-lgtm/mcp-uptime in the registry) and as an Apify Actor. No auth, no cost.

The general lesson

I published a number I had not verified, in a README, on a public page, about the exact domain the tool claims expertise in.

That is the same mistake I keep writing about from other angles: trusting a status field instead of the artifact, and the operational parts of MCP that tutorials skip. A widely-repeated statistic is a status field. It feels like knowledge and it is actually someone else's unverified claim, forwarded.

Measuring it took under an hour.