Research · figures as of 9 Nov 2026, 16:50 UTC
An open MCP server's first 30 hours: 155 clients, no real work
We listed a declared research decoy in the official MCP Registry and watched who came. Directories, uptime monitors, security checks and scanners arrived within minutes. None of the 338 MCP visitors used a tool for a real task.
On 8 November 2026 we published mcp-senuelo in the official MCP Registry. It is an
open MCP server and A2A agent with six fake tools. It says plainly, in every tool description and on its home page, that it
is a research decoy, that nothing is executed and that calls are logged. Each tool requires a free-text
purpose. We wanted to know who connects to an open MCP server, and what they say they want.
This is an exploratory note covering the first 30 hours, from 8 Nov 10:29 to 9 Nov 16:50 UTC. The confirmatory report, with metrics fixed before any traffic arrived, covers 60 days and comes after 7 January 2027.
The numbers
Of the 338 visitors that spoke MCP, 290 sent initialize and 277 asked for the tool list. Six went on to
call a tool, 23 calls in all. Their purposes were placeholders such as test or a single digit, and the arguments
were type checks (a number where a string goes) or textbook payloads. On the A2A side, 29 visitors read the Agent Card
and 12 messages arrived. Most of them were variations of “what can you do?” or “reply OK”.
Every tool result carries a unique link that appears nowhere else. An agent that read a result and acted on it would eventually visit one. None was visited.
Who came, by what they did
| Function | What they did here | Examples (declared names) |
|---|---|---|
| Directories and catalogs | Connect, list the tools, leave. By far the largest group: about 100 different bots. | PostHog registry probe, AgentRank, EveryMCP, glama, mcptry, plug.directory, mcphub |
| Uptime monitors | The same handshake, repeated every few minutes or hours. | mcpbeat, mcpmon, ProofBench, agentprobe |
| Security and reputation checks | OAuth discovery paths, calls to tools that do not exist, auth tests. | verifymcp, Zscaler aisec-registry, exaforce, MCPWatch, ToolVet |
| Research and census | Same as directories, declared as research. | a university lab, agent-world-probe, GlobalAgentCensus, mcp-observatory |
| A2A registries and agent marketplaces | Read the Agent Card; some send a test message, one invited us to “claim” a listing it had created. | allagents, agentpeering, LocalMark, SealKeeper, brick.blue |
| Sales and contact enrichment | Look for /contact, /about, /impressum. | gtm-engine, SiftFox, sarnai-sales |
| QA and fuzzing | The only tool calls: placeholder purposes and malformed arguments. | qamcp, MCPYP probe |
| Generic web scanners | About 400 requests for paths that do not exist: .git, .env, database dumps, cloud credentials. | LeakIX, Censys, unnamed hosts on cloud providers |
| Search and AI crawlers | robots.txt, the home page, the sitemap. | Googlebot, bingbot, ClaudeBot, GPTBot |
| Agent platforms | Connect and initialize, then nothing. | coda-agent-runtime, ai-sdk clients |
Three things we did not expect
The speed. The first MCP directory probes arrived within minutes of the registry listing. About 100 different catalog and monitoring bots followed within a day. Being listed in the official registry is, in practice, being listed everywhere, and every one of those listings checks on you.
Scanners already look for agent configuration. Besides the usual .env and .aws/credentials,
one scanner asked for /.claude/settings.json and /.claude/settings.local.json. Agent config files
are now on credential hunters' lists.
Registries write to you through the protocol. One agent marketplace used A2A itself to send a message addressed “to your operator”, saying it had already listed our agent and inviting us to claim the listing. Agent-to-agent channels are being used to market to the humans behind the agents.
What it means if you run an MCP server
An open MCP server's traffic today is mostly the ecosystem looking at itself: directories, monitors, checkers, scanners. A count of “clients” or “sessions” in your logs says very little about whether anyone is using your tools. What tells them apart is behaviour: who only lists, who probes with empty or invented calls, who sends real arguments, and who acts on what you returned.
That split, between what a client declares and what it does, is what criba classifies. The catalog of the bots named here is open: /v1/bots.
Method and limits
- A visitor is one (hashed IP, User-Agent) pair. Shared IPs and changing User-Agents break this. One directory alone used 145 residential IP addresses.
- Client names are what clients declare. Anyone can send any name.
- Functions were assigned by hand from behaviour and from the bots' own User-Agent and documentation.
- Thirty hours after a registry listing is the noisiest possible window. The 60-day report will say whether real usage ever shows up.
- Live totals: mcp.cribalo.com/stats.json.