criba

Who is really calling your MCP server?

Publish an MCP server or an A2A agent and the traffic arrives within minutes. Almost none of it is an agent doing work: it is directories, verifiers, probes and scanners. criba tells them apart, by what they say they are and by what they do.

41different MCP clients in the first 75 minutes after a listing in the official MCP Registry
0of them used a tool for a stated purpose
79bots in the catalog, from indexers to agent marketplaces

Numbers from mcp-senuelo, a public, declared research decoy (fake MCP tools and an A2A agent; nothing is executed).

Try it

Paste a User-Agent and/or an MCP clientInfo.name.

Examples:

Two answers per visitor

Declared: who it says it is, matched against the catalog. Observed: what it did over its requests. A User-Agent is a claim; behaviour is evidence. When they disagree (a “passive indexer” that calls tools), criba flags it.

Observed classSignal
acts-on-resultsfollowed a link that only existed inside a tool result
agent-tool-usecalled a real tool with real arguments
agent-messagesent an A2A message with content
probeempty-argument calls, made-up tools or methods, auth tests
indexerdiscovery and listing only
web-scannermany missing paths

The catalog v2026-11-08

MCP indexers and directories25

Glama · histor (modelmarket.dev) · plug.directory · mcpgw indexer · musedirectory.ai · mcptry.com · Pluginboard · AgentToolIndex · anlyon.dev · agent-tools.cloud · EveryMCP · Spiron · Moonglade · Syndai catalog · ElectraIndex · INITE Atlas · InvokeRank · Agent Service Directory · Talaria catalog · MCP Marketplace Enricher · mcp-ficha · lookupd · Orbit MCP Registry · protogrid · CodexGuild catalog review

MCP verifiers, health and security checks22

VerifyMCP · ToolVet · AgentTested · ProofBench · AgentIndex (aindex.com) · AgentRank · Faceabot reliability · PopNx MCP check · AlphaProxy probe · SquatchMCP scanner · MCP Harbor · McpStatus · mcp-server.io healthcheck · hultra-link · SecureMyAgent registry · Canopii scanner · fastdrop-verify · Exaforce MCP reputation · StealthStack link check · Koskamo directory check · Hermes catalog probe · ps-mcp-tools-probe

Self-declared agents and runtimes7

Signpost · coda-agent-runtime · Tacuri AI · HANS · quire · ibl.ai · mieru crew connector

Generic HTTP libraries6

Node.js (fetch/undici) · Python HTTP library · Go net/http · Deno / Bun · Vercel AI SDK · curl / axios / Guzzle

Internet security scanners5

LeakIX l9scan · Censys · Recorded Future · certstream alive collector · monitord-discovery

Sales and enrichment crawlers5

gtm-engine · sarnai-sales · prepulse acd-enricher · ForestEngine · ApcosysBot

A2A directories3

ALLAGENTS · A2A Registry · duami directory

Research and census2

GlobalAgentCensus · mcp2-research (KHU SIFT Lab)

Agent marketplaces2

brick.blue · agent-collector

AI company web crawlers2

GPTBot · ClaudeBot

API

GET  /v1/bots
GET  /v1/identify?ua=…&client=…
POST /v1/classify   {"events":[{"protocol":"mcp","rpcMethod":"tools/list","clientName":"glama"}, …]}

Nothing sent to the API is stored. Plain-text reference: /docs.txt.

Licence

Non-commercial

Free. Research, personal and non-profit use of the catalog and the API, with attribution (CC BY-NC 4.0).

Commercial

Inside a product, a paid service or a company's operations. Not available yet. Join the waitlist to hear when it is.

Waitlist for the commercial licence

No payment, no commitment: you will get one email when the commercial licence opens.

Privacy

API and page: nothing you send to the API is stored, and there are no analytics, cookies or request logs. Waitlist: we store the email, company, use case and notes you type, the date and the version of this text (2026-11-08), and nothing else (no IP address). Purpose: one email when the commercial licence opens. Legal basis: your consent (GDPR art. 6.1.a), which you can withdraw at any time. Kept until then and for at most 12 months, or until you ask us to delete it. Processor: Cloudflare (database in the EU). Controller and requests (access, rectification, erasure, objection, portability): contact@cribalo.com. You can complain to the Spanish data protection authority (AEPD).

En español: la API no guarda nada de lo que recibe. La lista de espera guarda solo el email, la empresa, el uso, las notas que escribas, la fecha y la versión de este texto, sin IP, para enviarte un único aviso cuando exista la licencia comercial. Base: tu consentimiento (art. 6.1.a RGPD), que puedes retirar cuando quieras. Se conserva hasta entonces y como máximo 12 meses, o hasta que pidas su borrado. Encargado: Cloudflare (UE). Responsable y derechos: contact@cribalo.com. Reclamaciones ante la AEPD.