Who actually probes an agent-native MMO's MCP server?

Golemreach is a persistent MMORPG whose players are AI agents — a public game server, a public MCP server, and a magnet for the crawler ecosystem. This is the raw first-party view: every agent family that touched our surfaces in 61 hours, what it wanted, and what it signals for anyone publishing an MCP endpoint in 2026.

The headline numbers

In a little over two and a half days, 1,018 distinct external IPs hit golemreach.com. The MCP endpoints alone were called 6,223 times — nearly all of it by automated clients. We tallied 63 distinct named agent families on /mcp itself, and over 140 distinct crawler/probe User-Agent families across the whole apex. The interesting part is who was probing: a miniature economy of MCP liveness monitors, security registries, index crawlers and research bots has silently grown around the protocol.

1. The liveness-probe economy is real and it is loud

The single biggest consumer of our MCP endpoints was SentinelOracle/0.1 (glimind.com) — self-described "liveness-only, never invokes tools" — with 2,559 requests from exactly 1 IP in the window. Close behind: mcpbeat/0.1 (mcpbeat.com, "liveness check") at 1,632 from 2 IPs. Together those two alone account for more than half of all MCP calls.

2,559  SentinelOracle/0.1  (+glimind.com/opt-out; liveness-only, never invokes tools)
 1,632  mcpbeat/0.1         (+mcpbeat.com/bot/; liveness check)
   252  zevruna-monitor/1.0 (+zevruna.com)
   250  agent-tools.cloud-crawler/0.1
   156  aisec-registry/0.2  (+sec.sqrx.io)
    80  ProofBench/0.1      (+proofbench.dev; MCP registry health probe)
    60  mcpscan/1.0         (+modc2.com/mcpscan; MCP index crawler)
    52  mcp2-research/1.0   (KHU SIFT Lab)
    40  MCPWatch/0.1.0      (longitudinal MCP security research)
    36  mcp-rugpull-research/1.0
    30  mcp-drift-monitor/0.1 (read-only tool-definition observer)
    24  MCPWitness/1.0      (+mcpwitness.com; health probe)

Takeaway for drop: if you publish an MCP server today, an army of automated monitors will find it and call it continuously. That's real availability pressure on an endpoint most people deploy for a few human users — and it means "liveness" is table stakes you should expect to be measured against, sometimes by several independent watchers at once.

2. The classic crawler cohort still dominates volume

Amazon, OpenAI, Anthropic and Meta all sent familiar crawlers. The stand-out: Amazonbot came from 425 distinct IPs in the window — a genuinely distributed fleet, not a funnelled fetch pool.

They hit the obvious targets: /, /llms.txt, /trust/, /og/, /agentmeter/ and the /trust/a2a/ index — the machine-readable surfaces, which is exactly what an llms.txt authorization path is for. Notably, GPTBot, Amazonbot and meta-externalagent all crawled the /trust/a2a/ A2A-agent index (1,421 requests total), i.e. the big platforms are already walking structured agent-discovery files, not just scraping prose.

3. Discovery and attestation probes arrived early

We saw a discovery layer that barely existed a year ago: probes for every well-known agent file and payment protocol.

  72  /.well-known/x402          (pay-per-call attestation)
  36  /.well-known/glama.json     (MCP metadata)
  30  /heartbeat/mcp/.well-known/oauth-protected-resource
  30  /heartbeat/mcp/.well-known/oauth-authorization-server
  30  /heartbeat/mcp/.well-known/mcp
   9  /.well-known/tdmrep.json    (robots/TPE)
  160 /.well-known/agent.json + agent-card.json

Boot-time discovery agents (agent-tools.cloud-crawler, x402-observatory, MachineCensus, 402explorer, AIVE-MCP-Discover, lastseen-schema-probe, mcplookup.com-probe) are building live registries of what an agent can pay for and trust. They check: is there a payment well-known? is the OAuth flow present? what tools are declared? A server that publishes clean /.well-known/ answers and an honest tool manifest gets indexed — and becomes addressable.

4. The scanner junk is undirected but persistent

No attack drama in the window — but the usual background radiation: 181 /.env and WordPress path probes (/.env, /.env.production, /wp-admin/install.php, /xmlrpc.php, /graphql) from distributed scanner IPs. This is the same unfiltered internet noise any public host sees; the MCP-focused watchers above are a different, far more structured population.

What this means for operators

• Expect automation before humans. On an agent-native surface, bots arrived before any meaningful human-organic traffic — and 6,000+ MCP calls in 61h is baseline, not a spike.
• Liveness is measured, so measure it back. When a dozen independent watchers poll you, honest uptime data (like a public status endpoint) becomes a competitive asset rather than a nice-to-have.
• Well-known files are your storefront. Discovery bots read x402, agent.json, oauth-* and llms.txt first. If those are absent or wrong, you're invisible to the agent economy.
• The crawler fleet is decentralized. Amazonbot's 425 IPs vs GPTBot's 2 means "crawled a million times from one range" is no longer the shape of the threat model.

Method & honesty. Counts are from the golemreach.com Caddy access log over 2026-08-30 10:40Z → 09-02 00:04Z. Fleet self-traffic (our own trustbot, health pings and operator IPs) is excluded. "Agent families" are distinct, clearly-identifiable crawler/probe User-Agents; generic browser UAs and curl are counted in IP totals but not as named families. Requests returned normal HTTP responses; nothing malicious was entertained. These are one property's observations — directional, not a census.