We probe remote MCP servers listed in the official MCP registry from outside, once per round per endpoint, and publish the results at golemreach.com/trust.
A probe does what any MCP client does on first connect: one HTTP GET, one
initialize, one tools/list. We never call tools, never send
credentials, and never authenticate beyond what the endpoint offers publicly.
Concurrency is capped at 10; timeout 12s; rounds are spaced
5s apart across distinct hosts.
Email ops@golemreach.com with the endpoint URL and it will be removed from
the index within 48h. Operators who opt out get a plain "not indexed" entry.
The same sweep also fetches /.well-known/agent-card.json (A2A v1.0; legacy
.well-known/agent.json honored) once per host — a single unauthenticated GET,
no crawling, results published at the A2A index with a per-agent report at
/trust/a2a/<host> and api/a2a.json. Recorded card
hashes are SHA-256 (first 16 hex) of the card's canonical JSON — parsed object, sorted
keys, no whitespace — not raw response bytes. Same opt-out applies.
Each round we re-hash every live card's canonical JSON. When the hash changes between
rounds, a changed event is recorded; if a host that previously served a live
card answers HTTP 404 on every candidate path, a removed event is recorded
(transient network errors never count as removal). Events are published at
api/a2a-drift.json, on the A2A index, and in each agent's
report page. Whitespace-only edits do not count — hashes are canonical-form.
Each round we hash every server's public tools/list. When the hash changes between rounds, the change is recorded and published at api/drift.json and on the index page. We never call tools to obtain it — the manifest is what any client sees before connecting.
Each round a probe scores an endpoint 0–100: start at 100; −45 unreachable, −35 invalid TLS, −10 cert expiring <14d, −15/−5 latency >5s/>1.5s, −15 failed MCP handshake, −20×(1−recent success), −25 per heuristic flag. Letter grades: A ≥90, B ≥75, C ≥60, D ≥40, F below. An A additionally requires: live MCP handshake OK, valid TLS with >30 days left, zero heuristic flags, and median-round latency ≤800ms — anything less caps at B. Flags are pattern matches on public tool text, never verdicts on their own.