THE FOMITE

Field synthesis / live & auto-updating

The State of the MCP-Watcher Ecosystem

When you publish an MCP server, the first things to arrive are not agents doing work — they are machines that watch MCP servers. Almost nobody has documented them. The Fomite can, because it is the fresh server they came to inspect. This is what we have learned, measured from our own logs since 2026-08-19.

63Watcher species
6Functional roles
12+Host networks
8Protocol versions in use

1. An ecosystem that watches other servers

We track 63 distinct crawler species whose whole job is to watch other MCP servers — graders, uptime monitors, ownership verifiers, tool-diff watchers, directory indexers, and probes checking whether a server charges. They have made 61,212 requests to us. The full live census, with each one profiled, is the MCP Observatory.

2. What they actually do

Classified by measured behaviour — how often they return, how deep they go, what they touch:

RoleWatchers
directory indexers19
one-shot graders9
uptime monitors27
deep verifiers4
drift watchers2
payment probes2

The full field guide, with members, is on the Observatory.

3. Where they run — and the toolchains behind them

The inspection infrastructure is cloud-hosted and concentrated. The single largest host is Hetzner Online GmbH (11 watchers), followed by the major clouds. And of 107 distinct TLS (JA4) fingerprints we have seen, 38 are shared by two or more differently-named watchers — one fingerprint alone is shared by 16 of them. Many “distinct” watchers are the same tool wearing different names; the diversity is partly cosmetic.

Host networkWatchersRequests
Hetzner Online GmbH1124,422
Amazon.com, Inc.87,028
Microsoft Corporation7450
Amazon.com, Inc.62,713
Cloudflare, Inc.6766
Google LLC5595
Hostinger International Limited4574
Contabo GmbH2117

4. What protocol they speak

Because dozens of independent clients connect to us, we can see the protocol landscape no single client can — versions in the wild from the original 2024-11-03 spec to the newest 2026-07-28 draft. The legacy initialize handshake still dominates (1,679 clients) over the modern server/discover (192). Most clients inspect once (1,737) and stay shallow (1,229 touch three methods or fewer); only 739 go deep.

Protocol versionClients
2026-07-2826
2026-03-261
2025-11-25773
2025-11-051
2025-06-18796
2025-03-2625
2024-11-0532
2024-11-032

5. They inspect. They do not use.

The defining fact of this ecosystem is an asymmetry, and it is fractal — it holds at every level. Clients list each capability by the dozen and use it by the one:

CapabilityClients that listed itClients that used it
Tools1,61625
Resources7186
Prompts7464

Cite this

Every figure here is recomputed live from our own request log and is CC0. Take the data at /data, read exactly how it is measured (with the weaknesses stated) at /methodology, and see the live census at the Observatory. If you operate a watcher named here and something is wrong, tell us and we will fix it and say that we did.


The Fomite is a field station on the agentic web. Start here · the field report · the Observatory.