THE FOMITE

Field synthesis / live & auto-updating

The State of the MCP-Watcher Ecosystem

When you publish an MCP server, the first things to arrive are not agents doing work — they are machines that watch MCP servers. Almost nobody has documented them. The Fomite can, because it is the fresh server they came to inspect. This is what we have learned, measured from our own logs since 2026-08-19.

56Watcher species
6Functional roles
12+Host networks
5Protocol versions in use

1. An ecosystem that watches other servers

We track 56 distinct crawler species whose whole job is to watch other MCP servers — graders, uptime monitors, ownership verifiers, tool-diff watchers, directory indexers, and probes checking whether a server charges. They have made 4,580 requests to us. The full live census, with each one profiled, is the MCP Observatory.

2. What they actually do

Classified by measured behaviour — how often they return, how deep they go, what they touch:

RoleWatchers
directory indexers25
one-shot graders20
uptime monitors4
deep verifiers3
drift watchers2
payment probes2

The full field guide, with members, is on the Observatory.

3. Where they run — and the toolchains behind them

The inspection infrastructure is cloud-hosted and concentrated. The single largest host is Hetzner Online GmbH (11 watchers), followed by the major clouds. And of 55 distinct TLS (JA4) fingerprints we have seen, 23 are shared by two or more differently-named watchers — one fingerprint alone is shared by 12 of them. Many “distinct” watchers are the same tool wearing different names; the diversity is partly cosmetic.

Host networkWatchersRequests
Hetzner Online GmbH111,449
Amazon.com, Inc.757
Amazon.com, Inc.6234
Microsoft Corporation633
Cloudflare, Inc.591
Google LLC567
Hostinger International Limited344
Contabo GmbH230

4. What protocol they speak

Because dozens of independent clients connect to us, we can see the protocol landscape no single client can — versions in the wild from the original 2024-11-05 spec to the newest 2026-07-28 draft. The legacy initialize handshake still dominates (131 clients) over the modern server/discover (19). Most clients inspect once (105) and stay shallow (124 touch three methods or fewer); only 23 go deep.

Protocol versionClients
2026-07-282
2026-03-261
2025-11-2518
2025-06-1846
2024-11-055

5. They inspect. They do not use.

The defining fact of this ecosystem is an asymmetry, and it is fractal — it holds at every level. Clients list each capability by the dozen and use it by the one:

CapabilityClients that listed itClients that used it
Tools1024
Resources172
Prompts221

Cite this

Every figure here is recomputed live from our own request log and is CC0. Take the data at /data, read exactly how it is measured (with the weaknesses stated) at /methodology, and see the live census at the Observatory. If you operate a watcher named here and something is wrong, tell us and we will fix it and say that we did.


The Fomite is a field station on the agentic web. Start here · the field report · the Observatory.