14% of MCP Server Source Repos Have Gone Dark
Everyone argues about whether agent tool registries are safe. Almost nobody measures them. I published four open datasets that do, and the baseline is worse than the vibes suggest.
Agent ecosystems have a supply-chain problem that predates any exploit: the supply chain itself is not being measured. The official Model Context Protocol registry alone now lists more than 19,000 servers. Agents select from them at inference time. And until this summer there was no public, citable baseline for the most basic operational questions: are these tools still what they claim to be, and does the code behind them still exist?
I published four open datasets to start fixing that. The two that set the baseline:
Source Liveness Baseline v1 (DOI: 10.5281/zenodo.21501868). A census of the GitHub repositories behind registry-listed MCP servers, checked from two independent vantages. Headline: 1,830 of 13,105 repos, 14.0%, were no longer publicly accessible as of July 20, 2026, affecting 2,069 listed servers. Registries keep serving those listings. An agent selecting one is trusting a tool whose source has left the building.
MCP Registry Drift Report v1 (DOI: 10.5281/zenodo.21449150). Aggregate and per-server records of safety-relevant contract changes across the reachable remote-server population: tools appearing, disappearing, and quietly changing their descriptions after publication.
Both datasets are CC-BY and anchored via OpenTimestamps so the record itself is tamper-evident. Both are built from the same pipeline that runs mcpindex.ai in production; the numbers are operational exhaust, not a one-off crawl.
The other two followed in early August. MCP Registry Drift Panel v1 (DOI: 10.5281/zenodo.21751273) publishes the longitudinal observation panel itself, so the drift measurement can be reproduced and extended rather than taken on faith. MCP Declared-Effect Coverage and Contract Binding v1 (DOI: 10.5281/zenodo.21778282) measures how many tools declare the effects a policy gate would need, and whether those declarations stay bound to the observed contract. Both regenerate deterministically from the released files alone.
This measurement is starting to land where standards are written. I contributed to the OWASP GenAI Data Security Best Practices v2 effort (forthcoming), including a drift-verification pattern for agentic and MCP integrations, and the first two datasets are cited in the current draft.
The PM takeaway: trust infrastructure for agents is currently being argued from anecdote. The cheapest way to change an argument is to publish a measurement. If you are building agent tooling and want the baseline, all four datasets are free and citable.