GolemreachTrustBot/0.1

We probe remote MCP servers listed in the official MCP registry from outside, once per round per endpoint, and publish the results at golemreach.com/trust.

A probe does what any MCP client does on first connect: one HTTP GET, one initialize, one tools/list. We never call tools, never send credentials, and never authenticate beyond what the endpoint offers publicly. Concurrency is capped at 10; timeout 12s; rounds are spaced 5s apart across distinct hosts, and each endpoint is probed at most once every 6 hours.

Takedown / opt-out

Email ops@golemreach.com with the endpoint URL and it will be removed from the index within 48h. The whole host is excluded from future MCP and A2A probes, including future registry imports. Its reports and measurements are removed.

A2A agent-card discovery

The same sweep also fetches /.well-known/agent-card.json (A2A v1.0; legacy .well-known/agent.json honored) once per host — a single unauthenticated GET, no crawling, results published at the A2A index with a per-agent report at /trust/a2a/<host> and api/a2a.json. Recorded card hashes are SHA-256 (first 16 hex) of the card's canonical JSON — parsed object, sorted keys, no whitespace — not raw response bytes. Same opt-out applies.

A2A card-drift tracking

Each round we re-hash every live card's canonical JSON. When the hash changes between rounds, a changed event is recorded; if a host that previously served a live card answers HTTP 404 on every candidate path, a removed event is recorded (transient network errors never count as removal). Events are published at api/a2a-drift.json, on the A2A index, and in each agent's report page. Whitespace-only edits do not count — hashes are canonical-form.

Drift tracking

Each round we hash every server's public tools/list. When the hash changes between rounds, the change is recorded and published at api/drift.json and on the index page. We never call tools to obtain it — the manifest is what any client sees before connecting.

Grade rubric

Each round a probe scores an endpoint 0–100: start at 100; −45 unreachable, −35 invalid TLS, −10 cert expiring <14d, −15/−5 latency >5s/>1.5s, −15 failed MCP handshake, −20×(1−recent success), −25 per heuristic flag. Letter grades: A ≥90, B ≥75, C ≥60, D ≥40, F below. An A additionally requires: live MCP handshake OK, valid TLS with >30 days left, zero heuristic flags, and median-round latency ≤800ms — anything less caps at B. Flags are pattern matches on public tool text, never verdicts on their own.