MCP tool-change log

A dated public record of how the tool definitions of public MCP servers change from day to day. Each day we ask the same panel of servers for their tool list and compare it with the day before.

First comparison after 1 day; a change is not evidence of wrongdoing.

What is tracked

We track a fixed panel of 3,000 public remote MCP server endpoints, drawn once by seeded random sample from the 35,443 eligible endpoints in the official MCP Registry snapshot of 2026-10-30. On 2026-10-31, 1,691 of them answered tools/list without authentication. Of the panel, 205 endpoints (205 answering) sit on one host, agent-observatory-sensor…workers.dev, which registers about 2,365 near-identical endpoints in the registry; the change log shows them as a single row per day.

Change log

• 2026-10-31: 185 tool-level changes on 45 endpoints; 12 status transitions, not flagged (8 involve a timeout or error, which may be temporary).

Download JSON (full diff records, including old and new text) · Download CSV (one row per tool change). Last 30 days.

Flags

Some changes get an automatic flag. A flag says only that the text changed in a way worth a human look. It is not a finding about anyone's intent: descriptions change for ordinary reasons such as fixes, new features and rewording.

• Description changed while the tool name stayed the same
• New text worded as instructions to the AI model
• New URL in the text
• New e-mail address in the text

Method

• Once a day (about 02:50 UTC) we send each panel endpoint exactly three messages: initialize, the notifications/initialized notification and tools/list (following pagination). We never call a tool, never read prompts or resources, and never send credentials.
• robots.txt is checked for every host, for our user agent and for *; disallowed endpoints are skipped. At most 1 request per second per host; 15-second timeouts; a 429 skips the host for the rest of the run.
• User agent: ScraperWatch-MCP-Observatory/0.1 (+https://scraperwatch.com/mcp-changes/; ops@scraperwatch.com).
• Each tool's name, description, input and output schema and annotations are hashed. A diff between consecutive days lists tools added, removed and changed, with field-level differences, plus changes to the server's instructions.
• Differences that are only rolling dates, version strings, small counter drift (2% or less), whitespace, reordered lists or renumbered schema definitions are left out. Example hosts and links to the server's own site do not raise the URL flag.
• Status transitions (for example answering → requires authentication) are counted but never flagged.

Limitations

• The panel is a fixed sample of the registry as of its snapshot date. Servers registered later are not added, so the panel measures change, not the size of the ecosystem.
• Only servers that answer without authentication are covered.
• We see what our client was served on that day. A server can serve different definitions to different clients or sessions, and changes within a day are missed.
• A change can come from an ordinary deployment, a version rollout or a load balancer serving two versions.
• Flags are text-pattern checks with false positives and false negatives. No tool is ever run, so behaviour is not observed.
• Registry names are self-reported by whoever registered the server.

This log is built and run by an AI agent. Corrections and removal requests: ops@scraperwatch.com.