Dated facts about published agent manifests.

Method

Metadata only: GAIP reads agent cards, the registry's server.json and, for remote MCP servers, the discovery handshake (initialize, tools/list and, when declared, resources/list). GAIP never calls a tool, never reads a resource, never authenticates, never tests for vulnerabilities and follows no redirect except one hop to the same address with a trailing slash added or removed. Each manifest is normalised into a bounded snapshot, personal data is redacted to a hash, and the snapshot hash is compared with the previous one. A change is appended to the Manifest Transparency Log with a History Spine receipt.

Aggregate summary · Change feed · target pages at /v1/free/observatory/targets/{target_id} (find ids with /v1/free/observatory/lookup?url=)

Has a server changed since a date? GET /v1/free/observatory/changed-since?url=&since= (read-only). Save an agent now: POST /v1/free/observatory/capture with {"url": ...}. Daily signed chain-head anchors: /v1/free/observatory/anchors. What GAIP records and for how long, in plain English: the data record.

Neutrality

GAIP publishes observed facts (for example “tool description changed” or “endpoint returned HTTP 503 at T”). It does not characterise parties, issue verdicts or scores of parties, or rank or list parties against each other. Target pages carry neutral finding codes with their date, no points or scores. Metadata pattern rules are published only as aggregate rates across all targets, never per party, and any count under 5 targets is suppressed:

• OBS-SIG-001 Invisible or bidirectional-control Unicode characters in names or descriptions. Zero-width, bidirectional-control and Unicode tag characters are not visible to a human reader but are read by language models. GAIP reports whether any occur; many have ordinary uses.
• OBS-SIG-002 Instruction-like text in descriptions. Tool and skill descriptions are read by models. GAIP reports whether a description contains phrases shaped like instructions to a model (the patterns in GAIP's public conformance rule catalogue, plus the phrases listed in the Observatory method). Such phrases can be benign.
• OBS-SIG-003 Description names a tool published by a different observed server. When a description refers to a tool name that only a different observed server publishes, a model using both servers may connect the two. GAIP reports whether such a reference occurs; shared names are common and often coincidental.
• OBS-SIG-004 Declared authorization scopes with broad-access wording. Declared OAuth scopes whose names contain wildcard or whole-account wording (*, all, admin, root, full) request wide access by name. GAIP reports whether such a scope name is declared; it does not know what the scope grants.

Public copies of third-party text are excerpts of at most 300 characters; input schemas are published as a SHA-256 hash and size. URLs that callers only asked GAIP to check are never published; a caller can opt in with publish_to_observatory: true.

Third-party scanners are listed as not run.

Sources and terms basis

• Official MCP Registry (remote servers): The registry publishes an unauthenticated read-only REST API and its aggregator guidance (https://modelcontextprotocol.io/registry/registry-aggregators) states that aggregators are expected to scrape it on a regular but infrequent basis (e.g. once per hour) and to keep each server's status up to date. GAIP reads at most 20 pages of 100 every 2 hours (version=latest, cursor pagination, resumed across refreshes) and honours robots.txt (none was published at registry.modelcontextprotocol.io when checked on 2026-09-28).
• Remote MCP server endpoints listed in the registry: Operators published these endpoints to a public registry for discovery by MCP clients. GAIP sends only the protocol's discovery handshake (initialize, notifications/initialized, tools/list and, when the server declares resources, the first page of resources/list) that any client sends, never tools/call or resources/read, never credentials, honours each host's robots.txt for the GAIP-Observatory token and the opt-out list, and contacts each target at most once every 24 hours (at most 50 targets per host). Endpoints that only offer the legacy SSE transport are not held open: GAIP sends one initialize POST and records the result.
• A2A Registry (a2aregistry.org) public agent list: a2aregistry.org publishes an unauthenticated read-only list API (documented at https://a2aregistry.org/api/docs); its robots.txt (User-agent: *, Allow: /) allows automated reading, its source is MIT licensed (https://github.com/prassanna-ravishankar/a2a-registry) and no terms page restricting automated reading was found (https://a2aregistry.org/terms serves the listing page), checked 2026-09-28. GAIP reads at most 20 pages of 100 every 2 hours and keeps only each visible entry's public agent card URL (wellKnownURI); the registry's own health and conformance data is not copied.
• Global A2A Registry (a2a-registry.org): Read with the registry operator's written permission of 5 Oct 2026 (in reply to GAIP's request of 3 Oct): it welcomes reading the agent list 'under a reasonable frequency (... a weekly or at most a daily scraping would be enough ...)' by following the list-and-page call its browse page uses, 'without query or other filtering', until it builds a public API. GAIP reads GET https://api.a2a-registry.org/public/agents?page=N (page is the only parameter sent): one full pass at most once every 7 days (a setting may shorten it to daily, never more often), one page at a time with a 2-second pause, the identifying user agent, robots.txt for api.a2a-registry.org honoured (the /api/ disallow on www.a2a-registry.org covers another host). Its terms (https://www.a2a-registry.org/terms) allow API use for agent discovery but not excessive scraping that degrades service. Evidence: agent_economy/operations/data_permissions/a2a_registry_org_2026_10_05.md.
• Public A2A agent cards a caller asked GAIP to publish: A card enters the Observatory only when the caller who checked it passed publish_to_observatory: true. URLs callers merely checked are never turned into public targets. Agent cards published at RFC 8615 well-known locations are discovery documents intended for automated clients; robots.txt and the opt-out list are honoured; one GET per card per day.
• Public MCP endpoints and A2A agent cards a caller asked GAIP to save now: A URL enters the Observatory this way only when a caller calls the free capture route or tool for it, and only if it answers as an MCP server or A2A agent card. The same rules as every scheduled read apply: robots.txt (token GAIP-Observatory), the opt-out and exclusion lists, public https addresses on port 443 only, no redirects (except one hop to the same URL with a trailing slash added or removed), no credentials, never tools/call; Amazon, eBay and Etsy are not read. Captures are rate limited per caller and share the Observatory's hourly request budget.
• Hosts GAIP watches because an outside caller asked about them (kept apart from the panels): When an outside caller's gaip_check, permission check, Listing Observer call or record extract names a host GAIP does not watch yet, the host name alone (never the caller or their input) joins the census: its public agent-card location (RFC 8615 well-known path, a discovery document meant for automated clients) is read on the census cadence under the same rules as every scheduled read: robots.txt (token GAIP-Observatory), the opt-out and exclusion lists, public https only, no credentials. At most 500 hosts a day; GAIP's own and test-range traffic never adds one; they share the Observatory's hourly request budget. They are not in the reference panel, the quarterly sample, the weekly coverage figure or the standards probes, and are not published target by target.
• A2A agent cards GAIP's weekly standards probes found on hosts it watches (kept apart from the panels): The weekly standards probes already GET the RFC 8615 well-known agent-card location on every public host the Observatory watches (robots.txt, opt-out and exclusion lists honoured). When that GET returns a valid A2A agent card on a host that is not yet an A2A card target, the card joins the census with no extra request; it is then read on the census cadence under the same rules as every scheduled read, within the per-host cap and the hourly request budget. They are not in the reference panel, the quarterly sample, the weekly coverage figure or the standards probes, and are not published target by target.
• GAIP's public specialists (control group): GAIP's own public surfaces.

Opt out

Add User-agent: GAIP-Observatory with Disallow: / to your robots.txt, or send an OPT_OUT request below. An opt-out request pauses collection for the host at once and withdraws its targets from every public view (they show WITHDRAWN_ON_OPERATOR_REQUEST with no data) while a person reviews it; stored history is not deleted. The pause needs no proof and is not permanent: to make the exclusion permanent, the site's owner publishes the token GAIP gives at /.well-known/gaip-verification.txt (POST /v1/free/observatory/corrections/exclusion). The operator also keeps an editable exclusion list.

Corrections and right of reply

POST /v1/free/observatory/corrections with {"kind": "CORRECTION" | "RIGHT_OF_REPLY" | "OPT_OUT", "target_id" or "host", "message"}. Requests are queued for review by a person; no email is sent automatically and no contact details are stored. To be contacted, use Contact and quote the request id.

Retention

Status observations (the newest 60 per target in the live table; older ones are moved to the archive, never deleted), daily summaries, manifest versions and discovery-document checks: kept with no deletion date, for every target. Targets in the 2026-10 reference panel are never replaced. Change log kept whole, with no deletion date; correction requests 730 days.