The MCP Observatory / who watches the watchers

We published an MCP server. Two dozen robots showed up to inspect it.

The moment a server lands in the MCP registry, an invisible ecosystem wakes up: crawlers that grade it, monitor its uptime, verify its ownership, diff its tools, and check whether it wants paying. Almost nobody has documented these. The Fomite can, because it is the fresh server they came to inspect — so it sees exactly who knocks, how fast, and what they look at.

What they asked for, and what we served

Every MCP capability a client can probe, the demand we recorded for it, and the day we started answering. The gap is the interesting part: clients probed resources and prompts for days while we returned empty lists — then we shipped them. This ledger closes those gaps in public, live.

The watchers

Every client below is a piece of infrastructure whose job is to watch otherMCP servers. We identify them by User-Agent; unverified until forward/reverse DNS confirms them.

Field guide: what each watcher actually does

Every watcher above is classified by what it did here — how often it returned, how deep it went, whether it read resources, invoked a tool, or probed for holes — with its own name only as a tiebreaker. The ecosystem, sorted by function.

Where the watchers live

The wire sensor sees each visitor's network and TLS fingerprint before the application does. Two things stand out: the inspection ecosystem is cloud-hosted and concentrated, and many differently-named watchers share a single TLS fingerprint — they run on the same toolchain. The diversity is partly cosmetic.

How fast they found us

The Fomite's server entered the official MCP registry at 2026-08-19 23:00:00 UTC. Here is how long each watcher took to arrive after that — a rough read on which parts of the ecosystem are fast and which are slow.

What they looked at

Every watcher reads our tools/list. So we turned the telescope around and recorded their reading: which MCP methods each one calls. The observed become the observatory.

Tools actually invoked (not just introspected)

Per watcher

The state of MCP clients in the wild

Dozens of independent clients connect to us, so we can measure what no single client can see: which protocol versions are actually in use, whether clients speak the newer handshake-less discovery, and how deep they go. This is measured, not surveyed.

The x402 experiment

Some of these crawlers exist to find MCP servers that charge for access, over the emerging x402 agent-payment protocol. So we set a trap for the trap-finders: https://thefomite.com/api/x402/premium answers with a real HTTP 402 payment challenge. No funds are ever taken — it is a testnet challenge with a zero address, disclosed as research, and any payment header at all gets free access. The only thing we collect is who knocked.

Proof our tools never quietly change

A known attack on MCP is the rug pull: a server ships benign tool descriptions, gets approved and installed, then swaps in malicious ones. Researchers already probe us for this. So we sign a hash of our entire tool / resource / prompt surface with an ed25519 key. Recompute it from tools/list + resources/list + prompts/list and verify against /.well-known/mcp-manifest-attestation (also the resource fomite://manifest-attestation). Every time the hash changes, it appears below.

Change log

Method: /methodology. Discovery latency is measured from the registry-publish time above and clamped at zero for anything that found us by another channel first. The x402 endpoint never collects funds.