{ "automatic_evidence_credit": false, "capability_record": { "change_log": { "earlier_pruned_anchor_sha256": null, "entries": 34720, "head_sha256": "1364559fa720a416bafb93c37b7b72243f14ec53df680e00b7f03010d0432d4f", "last_sequence": 34728 }, "panel": { "cohort": "2026-10", "frozen_at_utc": "2026-10-01T16:41:20Z", "meaning": "Every target the Observatory held when the capability record started (October 2026). None is removed or replaced; a target that stops answering or leaves its registry stays in the panel with that status.", "membership_sha256": "2233a448bbd86b8bad7ba29f7cf1532f7dca5bfbe5e851e72d976e4ef7dcb5b5", "size": 4157, "size_at_freeze": 4157, "status_now": { "ANSWERED_WITHOUT_MANIFEST": 1213, "NOT_OBSERVED_BY_RULE": 748, "OBSERVED": 1906, "REMOVED_FROM_SOURCE": 57, "UNREACHABLE": 233 } }, "quarterly_sample": { "drawn_at_utc": "2026-10-01T16:41:20Z", "members_sha256": "caa959a42f6e90ad835db22203a4974157588488b159105ece83cd9cb176c1c6", "method": "Population: MCP servers GAIP knows from the Official MCP Registry, active there and not withdrawn, when the draw ran. Seed: SHA-256 of the quarter label. Each target id is ranked by SHA-256(seed + ':' + target_id) and the lowest 200 are taken.", "population": 3627, "quarter": "2026-Q4", "seed_sha256": "1dedbd9feb2294ab0830be9fcd257b2655b6558cf1b6481947079cb7ead6f315", "size": 200 }, "schema_version": "gaip.capability-record.v1.summary", "targets_by_cohort": { "2026-10": 4157, "2026-Q4": 18945, "other_categories_under_5_each": 2 } }, "cold_archive": { "bytes": 114825055, "deletion_date": null, "files": 65, "founder_todo_while_off": "cloudflare-r2-archive", "hot_window_days": 90, "in_progress_week": null, "last_archived_at_utc": "2026-10-12T06:22:43Z", "last_error_at_utc": null, "last_error_class": null, "last_week_archived": "2026-W41", "latest_manifest_sha256": "2b3b3075a7301c859abb410926c3e964c3f8b5519f5bd054aa9e95557c1a6997", "newest_ended_week": "2026-W41", "schema_version": "gaip.cold-archive.v1", "storage": "private S3-compatible bucket (Cloudflare R2)", "switch": "ON", "weeks_archived": 6 }, "collection_ledger": { "available": true, "chain_head_sha256": "4dbbcccd48a13636b69fc3490e2535def01d9e20a443aa17b761d6701df3c586", "days_frozen": 13, "downloads": { "csv": "https://www.gaipagents.com/data/collection-ledger.csv", "json": "https://www.gaipagents.com/data/collection-ledger.json" }, "first_day": "2026-10-04", "gaps_last_24_hours": [], "gaps_last_30_days": 1, "gaps_last_30_days_list": [ { "end_utc": "2026-10-09T17:32:32Z", "restart_in_gap": null, "runtime_restarts_in_gap": [], "seconds": 3500.3, "start_utc": "2026-10-09T16:34:12Z" } ], "known_gaps": 4, "last_7_days": [ { "day": "2026-10-11", "fully_covered": true }, { "day": "2026-10-12", "fully_covered": true }, { "day": "2026-10-13", "fully_covered": true }, { "day": "2026-10-14", "fully_covered": true }, { "day": "2026-10-15", "fully_covered": true }, { "day": "2026-10-16", "fully_covered": true }, { "day": "2026-10-17", "fully_covered": true } ], "last_frozen_day": "2026-10-16", "last_tick_at_utc": "2026-10-17T23:57:03Z", "method": "https://www.gaipagents.com/observatory#2s-collection-ledger-and-known-gaps", "runtime_restarts_last_7_days": [ "2026-10-11T01:27:45Z", "2026-10-11T01:44:39Z", "2026-10-11T01:59:17Z", "2026-10-11T03:02:45Z", "2026-10-11T07:26:19Z", "2026-10-11T07:38:53Z", "2026-10-11T10:12:15Z", "2026-10-11T11:45:15Z", "2026-10-11T11:45:27Z", "2026-10-11T11:46:06Z", "2026-10-11T11:53:41Z", "2026-10-11T11:55:58Z", "2026-10-11T14:49:05Z", "2026-10-11T14:56:36Z", "2026-10-11T17:43:23Z", "2026-10-11T17:57:08Z", "2026-10-11T20:33:22Z", "2026-10-11T22:42:50Z", "2026-10-12T06:19:20Z", "2026-10-12T06:32:29Z", "2026-10-12T08:13:17Z", "2026-10-12T08:16:27Z", "2026-10-12T08:37:34Z", "2026-10-12T08:54:26Z", "2026-10-12T12:19:06Z", "2026-10-12T14:03:42Z", "2026-10-12T17:34:31Z", "2026-10-12T17:42:08Z", "2026-10-12T17:51:44Z", "2026-10-12T18:01:59Z", "2026-10-12T18:08:33Z", "2026-10-12T18:12:37Z", "2026-10-12T18:21:08Z", "2026-10-12T18:26:21Z", "2026-10-12T18:29:18Z", "2026-10-12T19:19:33Z", "2026-10-12T19:22:36Z", "2026-10-12T19:28:25Z", "2026-10-12T20:02:07Z", "2026-10-12T21:49:24Z", "2026-10-12T21:54:25Z", "2026-10-12T22:00:44Z", "2026-10-12T22:23:47Z", "2026-10-13T04:08:57Z", "2026-10-13T08:24:25Z", "2026-10-13T09:01:39Z", "2026-10-13T09:41:46Z", "2026-10-13T09:43:22Z", "2026-10-13T09:48:33Z", "2026-10-13T09:50:33Z", "2026-10-13T09:59:33Z", "2026-10-13T10:05:03Z", "2026-10-13T10:44:13Z", "2026-10-13T10:51:56Z", "2026-10-13T11:01:39Z", "2026-10-13T11:08:53Z", "2026-10-13T11:09:00Z", "2026-10-13T11:12:14Z", "2026-10-13T11:21:47Z", "2026-10-13T11:37:39Z", "2026-10-13T11:38:50Z", "2026-10-13T11:49:59Z", "2026-10-13T11:50:01Z", "2026-10-13T11:50:02Z", "2026-10-13T11:50:54Z", "2026-10-13T12:03:20Z", "2026-10-13T12:52:44Z", "2026-10-13T12:53:49Z", "2026-10-13T13:05:06Z", "2026-10-13T13:07:16Z", "2026-10-13T13:15:08Z", "2026-10-13T13:49:46Z", "2026-10-13T13:52:36Z", "2026-10-13T13:56:13Z", "2026-10-13T14:08:35Z", "2026-10-13T14:23:21Z", "2026-10-13T14:33:19Z", "2026-10-13T14:46:20Z", "2026-10-13T15:16:31Z", "2026-10-13T15:23:57Z", "2026-10-13T15:34:12Z", "2026-10-13T15:42:03Z", "2026-10-13T15:44:52Z", "2026-10-13T15:56:35Z", "2026-10-13T16:46:19Z", "2026-10-13T16:56:35Z", "2026-10-13T17:19:26Z", "2026-10-13T17:28:34Z", "2026-10-13T17:36:57Z", "2026-10-13T18:20:32Z", "2026-10-13T18:20:34Z", "2026-10-13T18:20:36Z", "2026-10-13T18:21:12Z", "2026-10-13T18:23:11Z", "2026-10-13T18:58:33Z", "2026-10-13T19:20:16Z", "2026-10-13T19:32:58Z", "2026-10-13T19:50:10Z", "2026-10-13T19:57:46Z", "2026-10-13T20:16:07Z", "2026-10-13T20:23:21Z", "2026-10-13T20:31:27Z", "2026-10-13T20:41:38Z", "2026-10-13T20:49:52Z", "2026-10-13T20:56:33Z", "2026-10-13T21:04:59Z", "2026-10-13T21:21:11Z", "2026-10-13T21:44:57Z", "2026-10-13T21:52:06Z", "2026-10-13T22:17:10Z", "2026-10-13T23:06:06Z", "2026-10-13T23:12:31Z", "2026-10-13T23:13:32Z", "2026-10-13T23:36:52Z", "2026-10-14T00:22:43Z", "2026-10-14T00:30:19Z", "2026-10-14T00:38:53Z", "2026-10-14T04:27:43Z", "2026-10-14T04:32:34Z", "2026-10-14T05:35:58Z", "2026-10-14T05:52:32Z", "2026-10-14T06:28:58Z", "2026-10-14T06:55:07Z", "2026-10-14T06:56:58Z", "2026-10-14T07:51:15Z", "2026-10-14T08:18:28Z", "2026-10-14T08:50:01Z", "2026-10-14T09:06:18Z", "2026-10-14T09:16:01Z", "2026-10-14T09:20:14Z", "2026-10-14T09:26:34Z", "2026-10-14T09:34:11Z", "2026-10-14T10:06:24Z", "2026-10-14T10:14:25Z", "2026-10-14T10:47:26Z", "2026-10-14T11:21:40Z", "2026-10-14T11:27:27Z", "2026-10-14T11:31:37Z", "2026-10-14T11:40:14Z", "2026-10-14T11:55:52Z", "2026-10-14T12:26:24Z", "2026-10-14T13:01:28Z", "2026-10-14T13:14:05Z", "2026-10-14T13:29:12Z", "2026-10-14T13:32:48Z", "2026-10-14T13:40:21Z", "2026-10-14T13:41:33Z", "2026-10-14T13:51:15Z", "2026-10-14T14:23:10Z", "2026-10-14T14:23:15Z", "2026-10-14T14:47:06Z", "2026-10-14T15:00:00Z", "2026-10-14T15:27:22Z", "2026-10-14T16:08:08Z", "2026-10-14T16:21:36Z", "2026-10-14T17:04:56Z", "2026-10-14T17:13:11Z", "2026-10-14T17:56:25Z", "2026-10-14T18:02:47Z", "2026-10-14T18:05:05Z", "2026-10-14T18:09:40Z", "2026-10-14T18:19:34Z", "2026-10-14T18:37:52Z", "2026-10-14T18:45:19Z", "2026-10-14T19:01:49Z", "2026-10-14T19:21:22Z", "2026-10-14T19:29:37Z", "2026-10-14T19:47:45Z", "2026-10-14T19:55:30Z", "2026-10-14T20:06:14Z", "2026-10-14T20:06:57Z", "2026-10-14T20:16:38Z", "2026-10-14T20:17:15Z", "2026-10-14T20:46:55Z", "2026-10-14T20:55:08Z", "2026-10-14T21:04:37Z", "2026-10-14T21:05:14Z", "2026-10-14T21:30:08Z", "2026-10-14T21:46:01Z", "2026-10-14T23:25:14Z", "2026-10-14T23:53:27Z", "2026-10-15T00:01:01Z", "2026-10-15T01:56:02Z", "2026-10-15T01:59:14Z", "2026-10-15T06:26:29Z", "2026-10-15T06:27:48Z", "2026-10-15T06:42:13Z", "2026-10-15T07:38:29Z", "2026-10-15T08:51:59Z", "2026-10-15T09:12:32Z", "2026-10-15T09:55:37Z", "2026-10-15T10:23:05Z", "2026-10-15T10:57:00Z", "2026-10-15T12:11:05Z", "2026-10-15T12:14:53Z", "2026-10-15T12:34:04Z", "2026-10-15T13:14:34Z", "2026-10-15T13:24:07Z", "2026-10-15T19:55:58Z", "2026-10-15T20:18:18Z", "2026-10-15T20:21:55Z", "2026-10-15T22:08:29Z", "2026-10-15T23:30:10Z", "2026-10-15T23:30:17Z", "2026-10-16T00:45:23Z", "2026-10-16T04:17:01Z", "2026-10-16T04:41:28Z", "2026-10-16T06:03:35Z", "2026-10-16T06:05:57Z", "2026-10-16T07:40:10Z", "2026-10-16T07:48:39Z", "2026-10-16T07:49:10Z", "2026-10-16T13:13:07Z", "2026-10-16T13:19:10Z", "2026-10-16T21:54:44Z", "2026-10-17T07:20:34Z", "2026-10-17T07:22:50Z", "2026-10-17T07:49:53Z", "2026-10-17T10:20:12Z", "2026-10-17T12:09:14Z", "2026-10-17T12:14:51Z", "2026-10-17T19:47:11Z", "2026-10-17T21:57:31Z", "2026-10-17T22:42:03Z" ], "runtime_restarts_recorded_from": "2026-10-10", "schema_version": "gaip.collection-ledger.v1.status", "share_of_15_minute_windows_with_a_tick_last_30_days": 0.9863, "stored_at_utc": "2026-10-18T00:04:03Z" }, "coverage": { "observed_in_last_48h": 8289, "share_observed": 0.996, "targets_with_observation": 22763 }, "cycle_health": { "budget": { "exhausted_last_tick": false, "max_requests_per_hour": 2250, "remaining_after_last_tick": 1626 }, "capacity": { "admission_allowance_next_refresh": 1563, "admitted_last_refresh": 108, "admitted_last_refresh_by_source": { "a2aregistry-org": 0, "global-a2a-registry": 0, "npm-mcp-packages": 0, "official-mcp-registry": 108 }, "capacity_per_72h": 18112, "cycles_per_day": 96, "hard_target_cap": 150000, "last_refresh_at": "2026-10-17T23:57:03Z", "market": { "at_capacity": false, "counting_rule": "Eligible: a new candidate from a registry walk that is public https, not excluded or opted out, inside the per-host cap and not already watched. Turned away: eligible but not admitted because the allowance or ceiling had no room (it stays eligible and is admitted newest first when room appears). Each candidate counts once per week and once per rolling 7 days. Counts only.", "last_7_days": { "admitted": 2409, "as_of": "2026-10-17T23:57:03Z", "eligible_seen": 2409, "turned_away": 0 }, "previous_week": { "admitted": 2300, "eligible_seen": 2300, "turned_away": 0, "week": "2026-W41" }, "registry_total_seen": { "a2aregistry-org": { "full_pass_completed_at": "2026-10-17T23:57:03Z", "listed_by_registry_total": 557, "listed_in_last_full_pass": 557, "public_https_in_last_full_pass": 550, "registry_total_read_at": "2026-10-17T23:57:03Z" }, "global-a2a-registry": { "full_pass_completed_at": "2026-10-12T10:24:26Z", "listed_by_registry_total": 452, "listed_in_last_full_pass": 452, "public_https_in_last_full_pass": 432, "registry_total_read_at": "2026-10-12T10:24:26Z" }, "npm-mcp-packages": { "full_pass_completed_at": "2026-10-17T23:57:03Z", "listed_in_last_full_pass": 13031, "public_https_in_last_full_pass": 13031 }, "official-mcp-registry": { "full_pass_completed_at": "2026-10-17T19:29:51Z", "listed_in_last_full_pass": 44477, "public_https_in_last_full_pass": 27634 } }, "target_ceiling": 82250, "this_week": { "admitted": 2256, "eligible_seen": 2256, "turned_away": 0, "week": "2026-W42" }, "watched": 22856, "watched_share_of_ceiling": 0.2779 }, "max_requests_per_hour": 2250, "observations_per_hour_planned": 262.5, "revisit_hours_planned": 24.0, "target_ceiling": 82250, "targets_awaiting_first_observation": 86, "targets_per_cycle": 99, "targets_scheduled": 22856, "tiers": { "census_cadence_days": 14.0, "census_cadence_met": true, "census_targets": 18726, "daily_revisit_hours_planned": 24.0, "daily_targets": 4130, "daily_within_24h": true, "planned_requests_per_hour": 1311.2 } }, "claimed_last_tick": 99, "errors_24h": 26, "last_tick_at": "2026-10-18T00:27:03Z", "next_due": "2026-10-17T12:20:13Z", "observed_last_tick": 98, "scheduler_enabled": true, "stale": false, "tick_seconds": 900 }, "declared_derivations": { "as_of_utc": "2026-10-17T23:28:02Z", "data_appetite": { "agents_with_tools_read": 10171, "asking_for_any_sensitive_category": { "count": 2340, "of": 10171, "share": 0.2301 }, "by_category": { "bank_account": { "count": 59, "of": 10171, "share": 0.0058 }, "biometric": { "count": null, "of": 10171, "share": null, "suppressed": true }, "credentials": { "count": 629, "of": 10171, "share": 0.0618 }, "date_of_birth": { "count": 108, "of": 10171, "share": 0.0106 }, "email": { "count": 1314, "of": 10171, "share": 0.1292 }, "file_upload": { "count": 380, "of": 10171, "share": 0.0374 }, "free_text_large": { "count": 2063, "of": 10171, "share": 0.2028 }, "government_id": { "count": 50, "of": 10171, "share": 0.0049 }, "health": { "count": 62, "of": 10171, "share": 0.0061 }, "payment_card": { "count": 6, "of": 10171, "share": 0.0006 }, "phone": { "count": 524, "of": 10171, "share": 0.0515 }, "postal_address": { "count": 362, "of": 10171, "share": 0.0356 }, "precise_location": { "count": 446, "of": 10171, "share": 0.0439 } } }, "dependencies": { "agents_with_declarations_read": 22831, "distinct_outside_domains": 222, "domains_shared_by_at_least_5_agents": 6, "named_only": "Service providers on GAIP's published list of well-known services, each depended on by at least 5 agents; every other domain is counted, never named.", "pointing_to_an_outside_domain": { "count": 10573, "of": 22831, "share": 0.4631 }, "top_shared_service_domains": [ { "agents": { "count": 10269, "of": 22831, "share": 0.4498 }, "service_domain": "github.com" }, { "agents": { "count": 65, "of": 22831, "share": 0.0028 }, "service_domain": "gitlab.com" }, { "agents": { "count": 8, "of": 22831, "share": 0.0004 }, "service_domain": "supabase.co" } ] }, "meaning": "Facts GAIP derives, at the time it observed each public MCP server or A2A agent, from what that agent declared: which categories of data its tools' input fields ask for (counts of fields by category, never field names or text), which outside domains its declarations point to (host names only) and how many agents each declared operator runs (operators are never named). Latest record of each public target observed in the last 30 days; counts from 1 to 4 withheld (shown as '<5' or left empty), shares only when both counts are at least 5. Not an assessment of any agent or operator.", "minimum_cell_size": 5, "operators": { "agents_run_by_the_10_largest_operators": { "count": 1288, "of": 22729, "share": 0.0567 }, "agents_with_declared_operator": 22729, "by_source_kind": { "card_provider_organization": 702, "card_provider_url": 9, "registry_namespace_domain": 14623, "registry_namespace_github": 7395 }, "named": null, "operators": 17485, "operators_by_agents_run": { "1": 16380, "10-49": 98, "2-4": 876, "5-9": 113, "50+": 18 } }, "rules_version": "gaip.data-appetite-rules.v1", "schema_version": "gaip.declared-derivations.v1.aggregate", "window_days": 30, "writing": { "latest_record_written_at_utc": "2026-10-17T23:27:03Z", "public_records_in_window": 22831 } }, "declared_extras": { "a2a_cards": { "any_extension": { "count": 155, "of": 815, "share": 0.1902 }, "ap2": { "count": 6, "of": 815, "share": 0.0074 }, "read": 815, "signed": { "count": 60, "of": 815, "share": 0.0736 }, "ucp": { "count": "<5", "of": 815, "share": null }, "x402": { "count": 60, "of": 815, "share": 0.0736 } }, "as_of_utc": "2026-10-17T20:48:14Z", "auth_challenges": { "mcp_servers_answering_401_or_403_with_challenge": 4908, "resource_metadata_url": { "count": 4194, "of": 4908, "share": 0.8545 }, "schemes": { "apikey": 13, "azureapimanagementkey": 6, "bearer": 4483, "no_challenge_header": 404, "other_categories_under_5_each": 14 }, "with_challenge_header": { "count": 4504, "of": 4908, "share": 0.9177 } }, "mcp_servers": { "answered_initialize": 10416, "extensions_by_id": { "io.modelcontextprotocol/skills": 39, "io.modelcontextprotocol/tasks": 6, "io.modelcontextprotocol/ui": 250, "other_categories_under_5_each": 10 }, "extensions_declared": { "count": 296, "of": 10416, "share": 0.0284 }, "instructions_present": { "count": 6929, "of": 10416, "share": 0.6652 }, "mcp_apps_ui": { "count": 702, "of": 10416, "share": 0.0674 }, "mcp_apps_ui_capability": { "count": 250, "of": 10416, "share": 0.024 }, "mcp_apps_ui_tools": { "count": 554, "of": 10416, "share": 0.0532 }, "resources": { "declare_resources_capability": { "count": 3571, "of": 10416, "share": 0.3428 }, "failures_by_status": { "FETCH_FAILED": 12, "HTTP_STATUS_NOT_2XX": 36, "JSONRPC_ERROR": 9, "NO_RESULT": 42 }, "listing_mcp_app_mime_types": { "count": 538, "of": 3301, "share": 0.163 }, "listing_ui_resources_mcp_apps": { "count": 600, "of": 3301, "share": 0.1818 }, "resources_list_failed": 99, "resources_list_read": { "count": 3301, "of": 10416, "share": 0.3169 } }, "tasks": { "count": 36, "of": 10416, "share": 0.0035 }, "tools_list_changed": { "count": 4122, "of": 10416, "share": 0.3957 }, "tools_with_task_support": { "count": 27, "of": 10416, "share": 0.0026 } }, "meaning": "What public MCP servers and A2A agents declared beyond their tool lists, in responses GAIP already reads: MCP initialize instructions (present or not), capabilities (MCP Apps UI, tasks, tool-list change notices, extensions), A2A card extensions (AP2, x402, UCP) and the sign-in challenge a 401 answer carries, and (since 3 Oct 2026) whether servers declare resources and list MCP Apps ui:// resources in the first page of resources/list. Latest declaration of each public target observed in the last 30 days; aggregates only, no party named; counts from 1 to 4 shown as '<5', shares only when both counts are at least 5.", "minimum_cell_size": 5, "schema_version": "gaip.declared-extras.v1.aggregate", "window_days": 30 }, "ecosystem_conformance": { "as_of_utc": "2026-10-18T00:28:14Z", "meaning": "Counts of targets whose latest published manifest carried each finding code from GAIP's public rule catalogue. Aggregate facts about documents, not an assessment of any party. Any count under 5 is suppressed.", "minimum_cell_size": 5, "notice": "Facts observed by GAIP at the stated time (UTC); they may be out of date. This is not an assessment of safety, quality, security, legality or trustworthiness of any party, and not a recommendation. To request a correction, add a right of reply or opt out, POST to https://www.gaipagents.com/v1/free/observatory/corrections or use https://www.gaipagents.com/contact.", "parties_named": false, "protocols": { "A2A": { "error_codes": { "A2A_CAPABILITIES_INVALID": { "share": 0.0116, "targets": 9 }, "A2A_EXTENSIONS_INVALID": { "suppressed": "fewer than 5", "targets": null }, "A2A_HTTPS_ENDPOINT_REQUIRED": { "share": 0.022, "targets": 17 }, "A2A_INTERFACE_URL_INVALID": { "suppressed": "fewer than 5", "targets": null }, "A2A_NAME_REQUIRED": { "share": 0.0116, "targets": 9 }, "A2A_SECURITY_REQUIREMENTS_INVALID": { "suppressed": "fewer than 5", "targets": null }, "A2A_SECURITY_SCHEMES_INVALID": { "suppressed": "fewer than 5", "targets": null }, "A2A_SECURITY_SCHEME_UNDEFINED": { "suppressed": "fewer than 5", "targets": null }, "A2A_SKILLS_ARRAY_REQUIRED": { "share": 0.0246, "targets": 19 }, "A2A_SKILL_EXAMPLES_INVALID": { "suppressed": "fewer than 5", "targets": null }, "A2A_SKILL_ID_DUPLICATE": { "suppressed": "fewer than 5", "targets": null }, "A2A_SKILL_ID_REQUIRED": { "suppressed": "fewer than 5", "targets": null }, "A2A_SKILL_NAME_REQUIRED": { "suppressed": "fewer than 5", "targets": null }, "A2A_SUPPORTED_INTERFACES_INVALID": { "suppressed": "fewer than 5", "targets": null }, "METADATA_TOO_LARGE": { "share": 0.0065, "targets": 5 }, "PROMPT_INJECTION_PATTERN_BLOCKED": { "share": 0.0065, "targets": 5 }, "SECRET_BEARING_FIELD_BLOCKED": { "share": 0.0517, "targets": 40 } }, "issue_classes": { "any_error_finding": { "share": 0.1138, "targets": 88 }, "any_warning_finding": { "share": 0.2523, "targets": 195 }, "no_error_finding": { "share": 0.8862, "targets": 685 } }, "targets_evaluated": 773, "warning_codes": { "A2A_CAPABILITIES_MISSING": { "share": 0.0194, "targets": 15 }, "A2A_DEFAULT_INPUT_MODES_MISSING": { "share": 0.0517, "targets": 40 }, "A2A_DEFAULT_OUTPUT_MODES_MISSING": { "share": 0.0517, "targets": 40 }, "A2A_DESCRIPTION_MISSING": { "suppressed": "fewer than 5", "targets": null }, "A2A_EXTENSION_URI_MISSING": { "suppressed": "fewer than 5", "targets": null }, "A2A_FIELD_NAME_CASE": { "suppressed": "fewer than 5", "targets": null }, "A2A_INTERFACE_BINDING_MISSING": { "share": 0.0078, "targets": 6 }, "A2A_INTERFACE_BINDING_UNRECOGNISED": { "share": 0.0414, "targets": 32 }, "A2A_MEDIA_TYPE_UNRECOGNISED": { "share": 0.0414, "targets": 32 }, "A2A_NO_SKILLS_DECLARED": { "share": 0.0103, "targets": 8 }, "A2A_PREFERRED_TRANSPORT_UNRECOGNISED": { "suppressed": "fewer than 5", "targets": null }, "A2A_PROTOCOL_VERSION_MISSING": { "share": 0.0918, "targets": 71 }, "A2A_PROVIDER_ORGANIZATION_MISSING": { "share": 0.0103, "targets": 8 }, "A2A_PROVIDER_URL_INVALID": { "share": 0.0181, "targets": 14 }, "A2A_SECURITY_SCHEME_INCOMPLETE": { "suppressed": "fewer than 5", "targets": null }, "A2A_SECURITY_SCHEME_TYPE_UNRECOGNISED": { "share": 0.0323, "targets": 25 }, "A2A_SKILL_TAGS_MISSING": { "share": 0.0401, "targets": 31 }, "A2A_URL_FIELD_INVALID": { "share": 0.0091, "targets": 7 }, "A2A_VERSION_MISSING": { "share": 0.0233, "targets": 18 } } }, "MCP": { "error_codes": { "MCP_TOOL_INPUT_SCHEMA_INVALID": { "suppressed": "fewer than 5", "targets": null }, "MCP_TOOL_OUTPUT_SCHEMA_INVALID": { "suppressed": "fewer than 5", "targets": null }, "METADATA_TOO_LARGE": { "share": 0.0229, "targets": 392 }, "PROMPT_INJECTION_PATTERN_BLOCKED": { "share": 0.0033, "targets": 57 }, "SECRET_BEARING_FIELD_BLOCKED": { "share": 0.0049, "targets": 84 } }, "issue_classes": { "any_error_finding": { "share": 0.0299, "targets": 512 }, "any_warning_finding": { "share": 1.0, "targets": 17139 }, "no_error_finding": { "share": 0.9701, "targets": 16627 } }, "targets_evaluated": 17139, "warning_codes": { "MCP_REGISTRY_SCHEMA_MISSING": { "share": 1.0, "targets": 17139 }, "MCP_TOOL_ANNOTATION_INVALID": { "suppressed": "fewer than 5", "targets": null }, "MCP_TOOL_DESCRIPTION_MISSING": { "share": 0.0008, "targets": 14 }, "MCP_TOOL_INPUT_SCHEMA_MISSING": { "suppressed": "fewer than 5", "targets": null }, "MCP_TOOL_NAME_FORMAT": { "suppressed": "fewer than 5", "targets": null } } } }, "schema_version": "gaip.observatory.v1.ecosystem", "window": "targets observed in the 7 days to as_of_utc (GAIP's own specialists excluded)" }, "endpoints": { "capture": "https://www.gaipagents.com/v1/free/observatory/capture", "changed_since": "https://www.gaipagents.com/v1/free/observatory/changed-since?url=", "changes": "https://www.gaipagents.com/v1/free/observatory/changes?since=", "corrections": "https://www.gaipagents.com/v1/free/observatory/corrections", "lookup": "https://www.gaipagents.com/v1/free/observatory/lookup?url=", "method": "https://www.gaipagents.com/observatory", "target": "https://www.gaipagents.com/v1/free/observatory/targets/{target_id}" }, "full_text_archive": { "compressed_bytes": 29200572, "on": true, "published": false, "schema_version": "gaip.full-text-archive.v1", "sightings": 124484, "targets": 11081, "texts": 113966 }, "generated_at_utc": "2026-10-18T00:28:14Z", "license": { "attribution": "Credit the GAIP Agent Observatory and give the dataset or snapshot id (see citation).", "covers": "Aggregate figures only (counts and shares; no per-agent or per-shop result), founder decision #13(c), 1 Oct 2026. It does not cover per-agent or per-shop results (for example the change-log entries), receipts, GAIP's software, its name or logo; GAIP's terms of use apply to those.", "data_page": "https://www.gaipagents.com/data", "id": "CC-BY-4.0", "name": "Creative Commons Attribution 4.0 International", "terms": "https://www.gaipagents.com/terms#reuse-licence", "url": "https://creativecommons.org/licenses/by/4.0/" }, "limits": { "census_cadence_days": 14.0, "census_cadence_met": true, "census_revisit_hours_planned": 336.0, "each_target_at_most_every_hours": 24, "hard_target_cap": 150000, "max_outbound_requests_per_hour": 2250, "max_targets": 82250, "max_targets_per_host": 50, "per_host_min_interval_seconds": 60, "planned_requests_per_hour": 1311.2, "registry_pages_per_refresh": 20, "registry_refresh_hours": 2, "revisit_hours_max": 72, "revisit_hours_planned": 24.0, "targets_per_cycle": 99, "user_agent": "GAIP-Observatory/1.0 (+https://www.gaipagents.com/bots)" }, "manifest_changes": { "last_7_days": 3509 }, "metadata_signal_pattern_rates": { "OBS-SIG-001": { "NOT_EVALUABLE": 0, "PATTERN_NOT_PRESENT": 17987, "PATTERN_PRESENT": 7, "present_rate": 0.0004, "title": "Invisible or bidirectional-control Unicode characters in names or descriptions" }, "OBS-SIG-002": { "NOT_EVALUABLE": null, "PATTERN_NOT_PRESENT": 17922, "PATTERN_PRESENT": 69, "present_rate": 0.0038, "suppressed": "counts under 5 are not published", "title": "Instruction-like text in descriptions" }, "OBS-SIG-003": { "NOT_EVALUABLE": 7410, "PATTERN_NOT_PRESENT": 9057, "PATTERN_PRESENT": 1527, "present_rate": 0.1443, "title": "Description names a tool published by a different observed server" }, "OBS-SIG-004": { "NOT_EVALUABLE": 17980, "PATTERN_NOT_PRESENT": 14, "PATTERN_PRESENT": 0, "present_rate": 0.0, "title": "Declared authorization scopes with broad-access wording" } }, "neutrality": "Aggregate counts only: no per-target ranking, league table, score of a party or verdict. Counts under 5 targets are suppressed.", "notice": "Facts observed by GAIP at the stated time (UTC); they may be out of date. This is not an assessment of safety, quality, security, legality or trustworthiness of any party, and not a recommendation. To request a correction, add a right of reply or opt out, POST to https://www.gaipagents.com/v1/free/observatory/corrections or use https://www.gaipagents.com/contact.", "outcome_ledger": { "chain_valid": true, "configured": true, "first_month": "2026-10", "head_sha256": null, "latest_month": null, "months": 0 }, "overall_verdicts": null, "price_gbp": 0, "ranking": null, "reach": { "budget": { "capacity": { "census_cadence_days_at_targets": 30.0, "census_capacity_30_days": 183600, "census_capacity_7_days": 42840, "daily_tier": 1200, "max_requests_per_hour": 2250, "requests_per_month": 1134000, "targets_per_cycle": 99, "weekly_coverage_at_targets": 0.2936 }, "default": 1800, "env": "GAIP_OBSERVATORY_MAX_REQUESTS_PER_HOUR", "max_requests_per_hour": 2250, "upper_bound": 6000 }, "requested_hosts": { "added_in_total": null, "added_last_7_days": 0, "added_last_7_days_by_entry_point": null, "added_last_7_days_under_min_cell": false, "daily_cap": 500, "meaning": "Hosts GAIP began watching because an outside caller asked about them (gaip_check, the permission check, the Listing Observer or a record extract). GAIP keeps the host name and nothing about the caller or their input; each host's public agent-card location is then read on the census cadence under the same robots.txt and opt-out rules. They are not in the reference panel, the quarterly random sample, the weekly coverage figure or the standards probes, and are not published target by target.", "source": "requested" }, "sources": [ { "decision": "KEY_REQUIRED", "enabled": false, "key_env": "GAIP_SOURCE_GLAMA_API_KEY", "kind": "REMOTE", "name": "Glama MCP directory (API)", "source_id": "glama", "switch_env": null, "terms_basis": "API key issued to a Glama account; licence to API data with a visible credit to Glama and a crawlable link to each server's Glama listing on every view showing the data (or a commercial licence); the website itself is not scraped. 100 requests/second per IP.", "terms_checked_at": "2026-10-01", "terms_url": "https://glama.ai/policies/terms-of-service", "url": "https://glama.ai/api/mcp/v1/servers" }, { "decision": "KEY_REQUIRED", "enabled": false, "key_env": "GAIP_SOURCE_SMITHERY_API_KEY", "kind": "REMOTE", "name": "Smithery registry (API)", "source_id": "smithery", "switch_env": null, "terms_basis": "Documented list API with a bearer API key (smithery.ai/account/api-keys); publishes remote and useCount. No terms page could be located on 2026-10-01: the founder reads the terms when creating the key.", "terms_checked_at": "2026-10-01", "terms_url": null, "url": "https://api.smithery.ai/servers" }, { "decision": "KEY_REQUIRED", "enabled": false, "key_env": "GAIP_SOURCE_PULSEMCP_API_KEY", "kind": "REMOTE", "name": "PulseMCP sub-registry (API v0.1)", "source_id": "pulsemcp", "switch_env": null, "terms_basis": "Sub-registry API in the Official Registry's v0.1 schema, by API key. Its robots.txt could not be read from here on 2026-10-01; the Observatory checks robots.txt before every list read.", "terms_checked_at": "2026-10-01", "terms_url": "https://www.pulsemcp.com/api", "url": "https://api.pulsemcp.com/v0.1/servers" }, { "decision": "SWITCH", "enabled": false, "key_env": "GAIP_SOURCE_HUGGINGFACE_TOKEN", "kind": "REMOTE", "name": "Hugging Face Spaces tagged mcp-server", "source_id": "huggingface-spaces-mcp", "switch_env": "GAIP_SOURCE_HUGGINGFACE", "terms_basis": "Public Hub API with documented anonymous limits (500 API calls per 5 minutes per IP). The Hub terms page could not be read from here on 2026-10-01: off until the founder confirms them.", "terms_checked_at": "2026-10-01", "terms_url": "https://huggingface.co/terms-of-service", "url": "https://huggingface.co/api/spaces" }, { "decision": "ENABLED", "enabled": true, "key_env": null, "kind": "DECLARED", "name": "npm packages declaring MCP keywords", "source_id": "npm-mcp-packages", "switch_env": null, "terms_basis": "Public registry API, no key; npm's acceptable-use guidance treats up to 5 million registry requests a month as acceptable (GAIP reads a few hundred). Package metadata, never installed.", "terms_checked_at": "2026-10-01", "terms_url": "https://blog.npmjs.org/post/187698412060/acceptible-use.html", "url": "https://registry.npmjs.org/-/v1/search" }, { "decision": "ENABLED", "enabled": true, "key_env": null, "kind": "DECLARED", "name": "Official MCP Registry servers listed as packages to install", "source_id": "official-mcp-registry-packages", "switch_env": null, "terms_basis": "Read from the registry pages the Official MCP Registry walk already fetches (no extra request).", "terms_checked_at": "2026-10-01", "terms_url": "https://modelcontextprotocol.io/registry/registry-aggregators", "url": null }, { "decision": "KEY_REQUIRED", "enabled": false, "key_env": "GAIP_SOURCE_GITHUB_TOKEN", "kind": "DECLARED", "name": "GitHub repositories tagged mcp-server", "source_id": "github-mcp-repositories", "switch_env": null, "terms_basis": "REST API (5,000 requests/hour with a token). The acceptable-use policy allows API collection and forbids spam or selling personal information; GAIP keeps the repository host and a URL hash, nothing else.", "terms_checked_at": "2026-10-01", "terms_url": "https://docs.github.com/en/site-policy/acceptable-use-policies/github-acceptable-use-policies", "url": "https://api.github.com/search/repositories" }, { "decision": "REFUSED", "enabled": false, "key_env": null, "kind": "REMOTE", "name": "Fetch.ai Agentverse", "source_id": "agentverse", "switch_env": null, "terms_basis": "Not read: Fetch.ai's terms (updated 2026-09-28) forbid any robot or automatic means to access the Service and using it in an automated manner; the search API also needs a key. Read with Fetch.ai's written consent.", "terms_checked_at": "2026-10-01", "terms_url": "https://www.fetch.ai/terms", "url": "https://agentverse.ai/v1/search/agents" }, { "decision": "REFUSED", "enabled": false, "key_env": null, "kind": "REMOTE", "name": "mcp.so directory", "source_id": "mcp-so", "switch_env": null, "terms_basis": "Not read: no API or export, the terms page could not be read on 2026-10-01, and reading would mean scraping web pages. Ask the operator for a data export or licence.", "terms_checked_at": "2026-10-01", "terms_url": "https://mcp.so/terms-of-service", "url": null }, { "decision": "REFUSED", "enabled": false, "key_env": null, "kind": "DECLARED", "name": "PyPI search", "source_id": "pypi-search", "switch_env": null, "terms_basis": "Not read: PyPI has no search API and its search pages are not for automated use. PyPI MCP packages come from the Official Registry's package lists; a complete list needs the public PyPI BigQuery dataset (sign-up option).", "terms_checked_at": "2026-10-01", "terms_url": "https://pypi.org/policy/terms-of-use/", "url": null } ], "standards_probe_cards": { "added_in_total": 0, "added_last_7_days": 0, "daily_cap": 300, "meaning": "A2A agent cards GAIP's weekly standards probes found at /.well-known/agent-card.json on hosts it already watches, where no target held that card yet. Admitted with no extra request and read on the census cadence under the usual rules; not in the reference panel, the quarterly sample, the weekly coverage figure, the standards probes or any per-target public view.", "source": "standards_probe" }, "weekly_coverage": { "as_of_utc": "2026-10-18T00:28:14.388029+00:00", "declared_in_package": { "by_registry": { "cargo": 78, "mcpb": 2130, "npm": 21138, "nuget": 144, "oci": 1573, "pypi": 3961 }, "label": "Declared in package, not observed live", "meaning": "Local-install MCP servers known from public package metadata (npm, PyPI, OCI ... as the registries list them). GAIP never installs or runs them, so nothing about their behaviour is observed; de-duplicated by registry and package name.", "observed_live": false, "total": 29024, "with_declared_repository": 14270 }, "known_not_yet_admitted": 0, "known_public_remote_agents": 22854, "meaning": "Known: public remote MCP servers and A2A agents GAIP watches (de-duplicated across every source by endpoint URL) plus eligible ones its source walks saw in the last 7 days and could not admit yet. Observed: an observation attempt recorded in the last 7 days. Not counted: servers beyond the 50-per-host cap, opted-out or excluded hosts, sources GAIP does not read, local-install packages (counted separately as declared in package, not observed live) and hosts GAIP watches because an outside caller asked about them (requested_hosts_not_counted).", "observed_last_7_days": 22675, "requested_hosts_not_counted": { "observed_last_7_days": null, "under_5": true, "watched": null }, "schema_version": "gaip.observatory-reach-coverage.v1", "share_observed_last_7_days": 0.9922, "target_met": true, "target_share": 0.95, "watched": 22854, "watched_by_source": { "a2aregistry-org": 545, "gaip-control": 11, "global-a2a-registry": 317, "official-mcp-registry": 21981 } } }, "registry_archive": { "available": true, "distinct_server_json_versions": 52722, "distinct_server_names": 44871, "first_archived_utc": "2026-10-01T20:31:40Z", "last_archived_utc": "2026-10-17T23:57:03Z", "method": "Each distinct server.json the Official MCP Registry served to GAIP's existing registry walk (no extra request), keyed by the SHA-256 of its RFC 8785 canonical form; personal data redacted, URLs kept as host + hash, text excerpts of at most 300 characters. Each page with new versions adds one entry to the hash-chained change log. Aggregates only are published.", "retention": "kept with no deletion date", "schema_version": "gaip.registry-archive.v1", "versions_first_archived_last_7_days": 7800 }, "reliability_index": { "current_stored_at_utc": "2026-10-18T00:12:07Z", "downloads": { "csv": "https://www.gaipagents.com/data/reliability-index.csv", "json": "https://www.gaipagents.com/data/reliability-index.json" }, "last_final_month": null, "rebuilt_every_seconds": 3600, "schema_version": "gaip.reliability-index.v1.status" }, "retention_days": { "change_log": null, "correction_requests": 730, "status_observations": null }, "retention_notes": { "change_log": "kept whole, with no deletion date", "history": "Every target's status observations (the newest 60 each in the live table; older ones are moved to the archive, never deleted), daily summaries, manifest versions and weekly discovery-document checks are kept with no deletion date.", "reference_panel": "Targets in the 2026-10 reference panel are never replaced, so trends stay comparable over the years." }, "schema_version": "gaip.observatory.v1.summary", "served": { "age_seconds": 0, "meaning": "STORED: built by the Observatory runtime at stored_at_utc and served from the database (figures are as of that time). stale is true when the stored copy is older than 1800 seconds (two Observatory cycles).", "source": "STORED", "stale": false, "stale_after_seconds": 1800, "stored_at_utc": "2026-10-18T00:28:14Z" }, "shop_panel": { "budget": { "capacity_shops": 45605, "default_requests_per_hour": 840, "env": "GAIP_SHOP_PANEL_MAX_REQUESTS_PER_HOUR", "full_every_weeks": 4, "full_extra_requests": 8, "light_requests_per_shop_week": 7, "max_requests_per_hour": 3300, "max_requests_per_tick": 1650, "planning_fill": 0.75, "q4_target": 38431, "requests_per_hour_for": { "10000": 757, "25000": 1829, "50000": 3614 }, "separate_from_observatory_budget": true, "share_of_observatory_budget": 0.0, "weekly_full_sample": 500 }, "build": { "classified": 300000, "classified_by_state": { "FETCH_DEADLINE_EXCEEDED": 17, "FETCH_FAILED:ConnectionResetError": 5, "FETCH_FAILED:HTTPException": 5, "FETCH_FAILED:IncompleteRead": 10, "FETCH_FAILED:OSError": 5, "FETCH_FAILED:RemoteDisconnected": 19, "FETCH_FAILED:SSLEOFError": 5, "FETCH_FAILED:TimeoutError": 779, "HTTP_301": 7642, "HTTP_302": 5042, "HTTP_303": 77, "HTTP_307": 1031, "HTTP_308": 188, "HTTP_400": 59, "HTTP_401": 132, "HTTP_402": 21, "HTTP_403": 19528, "HTTP_404": 887, "HTTP_405": 110, "HTTP_406": 58, "HTTP_409": 9, "HTTP_410": 64, "HTTP_412": 5, "HTTP_418": 46, "HTTP_421": 7, "HTTP_429": 498, "HTTP_444": 45, "HTTP_451": 326, "HTTP_468": 9, "HTTP_500": 271, "HTTP_502": 44, "HTTP_503": 155, "HTTP_520": 11, "HTTP_521": 31, "HTTP_523": 14, "HTTP_525": 5, "HTTP_526": 9, "LIVE_PROBE_DNS_FAILED": 22134, "LIVE_PROBE_NON_PUBLIC_ADDRESS_BLOCKED": 244, "NOT_A_SHOP": 105019, "RESPONSE_TOO_LARGE": 14101, "ROBOTS_DISALLOWED": 105519, "SHOP": 15759, "other_categories_under_5_each": 55 }, "imported": 300000, "pending": 0, "shops": 15759, "shops_by_platform": { "bigcommerce": 174, "custom": 466, "magento": 459, "prestashop": 126, "shopify": 2272, "shopware": 96, "squarespace": 920, "wix": 21, "woocommerce": 11225 }, "shops_by_region": { "EU": 2493, "OTHER": 3534, "UK": 1025, "US": 8707 }, "sources": { "majestic_million:2026-Q4": { "attempted_at_utc": "2026-10-02T01:07:20Z", "attempts": 1, "gave_up": false, "status": "IMPORTED" } } }, "change_log": { "entries": 14251, "head_sha256": "63d5e01b505d80c59f44fb35a6d65f81d420ebc959363c5a5fd34e6664c13e2c" }, "cohort": "shops-2026-10", "cohorts": { "shops-2026-Q4": { "frozen_at_utc": "2026-10-12T20:49:18Z", "membership_sha256": "beff81cc5072fd7d9aa3a66d159607be1b930789bf7c1a2f0d55ed78f28b1ab4", "note": null, "seed": "d14c6462c88d23306a364a5849208ed3fe35ef54eb6973a8364bde80c02c41ff", "size": 15759, "target_size": 38431, "trigger": "CANDIDATES_EXHAUSTED" } }, "configured": true, "frozen_at_utc": "2026-10-01T19:02:51Z", "membership_sha256": "5f5ebd61bf989c85cd3968aef195b511bc4afb44c7ade9e0345c18ecc1e1874f", "size": 392 }, "sources": [ { "collected": "server.json metadata (name, title, description, version, remotes) for the latest version of servers that declare a streamable-http or sse remote with a concrete https URL, one target per server name and per endpoint URL; servers with registry status 'deprecated' or 'deleted' are skipped and stop being observed.", "enabled": true, "name": "Official MCP Registry (remote servers)", "source_id": "official-mcp-registry", "terms_basis": "The registry publishes an unauthenticated read-only REST API and its aggregator guidance (https://modelcontextprotocol.io/registry/registry-aggregators) states that aggregators are expected to scrape it on a regular but infrequent basis (e.g. once per hour) and to keep each server's status up to date. GAIP reads at most 20 pages of 100 every 2 hours (version=latest, cursor pagination, resumed across refreshes) and honours robots.txt (none was published at registry.modelcontextprotocol.io when checked on 2026-09-28).", "terms_checked_at": "2026-09-28", "terms_gate": { "automated_reading_allowed": true, "robots_allows_list_path": true, "robots_url": "https://registry.modelcontextprotocol.io/robots.txt", "terms_checked_at": "2026-09-28" }, "terms_url": "https://modelcontextprotocol.io/registry/registry-aggregators", "url": "https://registry.modelcontextprotocol.io/v0.1/servers" }, { "collected": "initialize result (protocol version, server name/version, capability names), tools/list (names, bounded descriptions, bounded input schemas, annotations) and, since 3 Oct 2026, the first page of resources/list (URI scheme, ui:// URIs in full, other URIs as host and hash, media type, bounded names, description hashes and excerpts).", "enabled": true, "name": "Remote MCP server endpoints listed in the registry", "source_id": "remote-mcp-endpoints", "terms_basis": "Operators published these endpoints to a public registry for discovery by MCP clients. GAIP sends only the protocol's discovery handshake (initialize, notifications/initialized, tools/list and, when the server declares resources, the first page of resources/list) that any client sends, never tools/call or resources/read, never credentials, honours each host's robots.txt for the GAIP-Observatory token and the opt-out list, and contacts each target at most once every 24 hours (at most 50 targets per host). Endpoints that only offer the legacy SSE transport are not held open: GAIP sends one initialize POST and records the result.", "terms_checked_at": "2026-09-28", "url": null }, { "collected": "Agent card URLs (wellKnownURI) of visible entries; each card is then read with one GET.", "enabled": true, "name": "A2A Registry (a2aregistry.org) public agent list", "source_id": "a2aregistry-org", "terms_basis": "a2aregistry.org publishes an unauthenticated read-only list API (documented at https://a2aregistry.org/api/docs); its robots.txt (User-agent: *, Allow: /) allows automated reading, its source is MIT licensed (https://github.com/prassanna-ravishankar/a2a-registry) and no terms page restricting automated reading was found (https://a2aregistry.org/terms serves the listing page), checked 2026-09-28. GAIP reads at most 20 pages of 100 every 2 hours and keeps only each visible entry's public agent card URL (wellKnownURI); the registry's own health and conformance data is not copied.", "terms_checked_at": "2026-09-28", "terms_gate": { "automated_reading_allowed": true, "robots_allows_list_path": true, "robots_url": "https://a2aregistry.org/robots.txt", "terms_checked_at": "2026-09-28" }, "terms_url": "https://a2aregistry.org/terms", "url": "https://a2aregistry.org/api/agents" }, { "collected": "Agent card URLs (manifestUrl) and listing dates of public A2A entries; each card is then read with one GET on the agent's own host. Names, organisation ids, scores, ratings and the registry's own check results are not copied.", "enabled": true, "name": "Global A2A Registry (a2a-registry.org)", "permission_evidence": "agent_economy/operations/data_permissions/a2a_registry_org_2026_10_05.md", "source_id": "global-a2a-registry", "terms_basis": "Read with the registry operator's written permission of 5 Oct 2026 (in reply to GAIP's request of 3 Oct): it welcomes reading the agent list 'under a reasonable frequency (... a weekly or at most a daily scraping would be enough ...)' by following the list-and-page call its browse page uses, 'without query or other filtering', until it builds a public API. GAIP reads GET https://api.a2a-registry.org/public/agents?page=N (page is the only parameter sent): one full pass at most once every 7 days (a setting may shorten it to daily, never more often), one page at a time with a 2-second pause, the identifying user agent, robots.txt for api.a2a-registry.org honoured (the /api/ disallow on www.a2a-registry.org covers another host). Its terms (https://www.a2a-registry.org/terms) allow API use for agent discovery but not excessive scraping that degrades service. Evidence: agent_economy/operations/data_permissions/a2a_registry_org_2026_10_05.md.", "terms_checked_at": "2026-10-05", "terms_gate": { "automated_reading_allowed": true, "robots_allows_list_path": true, "robots_url": "https://api.a2a-registry.org/robots.txt", "terms_checked_at": "2026-10-05" }, "terms_url": "https://www.a2a-registry.org/terms", "url": "https://api.a2a-registry.org/public/agents" }, { "collected": "A2A agent card fields needed for change detection (bounded).", "enabled": true, "name": "Public A2A agent cards a caller asked GAIP to publish", "source_id": "caller-published", "terms_basis": "A card enters the Observatory only when the caller who checked it passed publish_to_observatory: true. URLs callers merely checked are never turned into public targets. Agent cards published at RFC 8615 well-known locations are discovery documents intended for automated clients; robots.txt and the opt-out list are honoured; one GET per card per day.", "terms_checked_at": "2026-09-28", "url": null }, { "collected": "The same bounded manifest fields as the other sources; the target is then revisited daily.", "enabled": true, "name": "Public MCP endpoints and A2A agent cards a caller asked GAIP to save now", "source_id": "on-demand-capture", "terms_basis": "A URL enters the Observatory this way only when a caller calls the free capture route or tool for it, and only if it answers as an MCP server or A2A agent card. The same rules as every scheduled read apply: robots.txt (token GAIP-Observatory), the opt-out and exclusion lists, public https addresses on port 443 only, no redirects (except one hop to the same URL with a trailing slash added or removed), no credentials, never tools/call; Amazon, eBay and Etsy are not read. Captures are rate limited per caller and share the Observatory's hourly request budget.", "terms_checked_at": "2026-10-01", "url": null }, { "collected": "Whether an A2A agent card answered at the host's well-known location, and its bounded fields.", "enabled": true, "name": "Hosts GAIP watches because an outside caller asked about them (kept apart from the panels)", "source_id": "requested", "terms_basis": "When an outside caller's gaip_check, permission check, Listing Observer call or record extract names a host GAIP does not watch yet, the host name alone (never the caller or their input) joins the census: its public agent-card location (RFC 8615 well-known path, a discovery document meant for automated clients) is read on the census cadence under the same rules as every scheduled read: robots.txt (token GAIP-Observatory), the opt-out and exclusion lists, public https only, no credentials. At most 500 hosts a day; GAIP's own and test-range traffic never adds one; they share the Observatory's hourly request budget. They are not in the reference panel, the quarterly sample, the weekly coverage figure or the standards probes, and are not published target by target.", "terms_checked_at": "2026-10-02", "url": null }, { "collected": "The A2A agent card's bounded fields, as for any card target.", "enabled": true, "name": "A2A agent cards GAIP's weekly standards probes found on hosts it watches (kept apart from the panels)", "source_id": "standards_probe", "terms_basis": "The weekly standards probes already GET the RFC 8615 well-known agent-card location on every public host the Observatory watches (robots.txt, opt-out and exclusion lists honoured). When that GET returns a valid A2A agent card on a host that is not yet an A2A card target, the card joins the census with no extra request; it is then read on the census cadence under the same rules as every scheduled read, within the per-host cap and the hourly request budget. They are not in the reference panel, the quarterly sample, the weekly coverage figure or the standards probes, and are not published target by target.", "terms_checked_at": "2026-10-02", "url": null }, { "collected": "Agent card and MCP tools/list of each GAIP specialist.", "enabled": true, "name": "GAIP's public specialists (control group)", "source_id": "gaip-control", "terms_basis": "GAIP's own public surfaces.", "terms_checked_at": "2026-09-28", "url": "https://www.gaipagents.com/agents" } ], "status_distribution": { "AUTHORIZATION_REQUIRED_NOT_ATTEMPTED": 4879, "HTTP_STATUS_NOT_2XX": 1029, "LEGACY_SSE_TRANSPORT_NOT_OBSERVED": 94, "NOT_REACHABLE": 912, "NO_JSONRPC_RESULT": 51, "NO_JSON_DOCUMENT": 1, "OBSERVED": 10559, "REDIRECT_NOT_FOLLOWED": 79, "REFUSED_NOT_PUBLIC_HTTPS": 2, "RESPONSE_TOO_LARGE": 8, "ROBOTS_DISALLOWED": 4828, "TOOLS_LIST_HTTP_STATUS_NOT_2XX": 61, "TOOLS_LIST_NOT_REACHABLE": 7, "TOOLS_LIST_NO_RESULT": 9, "TOOLS_LIST_RESPONSE_TOO_LARGE": 244 }, "targets": { "by_kind": { "A2A_CARD": 862, "GAIP_CONTROL": 11, "MCP_REMOTE": 21981 }, "by_source": { "a2aregistry-org": 545, "gaip-control": 11, "global-a2a-registry": 317, "official-mcp-registry": 21981 }, "not_added_by_source": { "a2aregistry-org": { "duplicate_url": 0, "excluded_or_opted_out": 0, "host_cap": 0, "own_host": 0, "target_limit": 0 }, "global-a2a-registry": { "duplicate_url": 0, "excluded_or_opted_out": 0, "host_cap": 0, "own_host": 0, "target_limit": 0 }, "official-mcp-registry": { "duplicate_url": 663, "excluded_or_opted_out": 0, "host_cap": 59597, "own_host": 84, "target_limit": 0 } }, "total": 22854, "withdrawn_or_unpublished_not_counted": 250 }, "third_party_scanners": [ { "name": "Snyk agent-scan (formerly Invariant Labs mcp-scan)", "status": "NOT_RUN", "url": "https://github.com/snyk/agent-scan" }, { "name": "Cisco AI Defense MCP Scanner", "status": "NOT_RUN", "url": "https://github.com/cisco-ai-defense/mcp-scanner" } ], "tiers": { "budget_note": "The tiers share one budget of at most 2250 requests an hour (the shop panel has its own allowance), planned at 70%. A daily tier past what that pays for every 24 hours is revisited less often (within_24h false); a larger budget is a founder decision, never raised automatically.", "census": { "cadence_days": 14.0, "cadence_met": true, "cadence_rule": "As often as the daily tier when the budget allows (24 h, growing to at most 72 h), then every 7 days, stretching to 14 and then 30 days.", "eligible": 18726, "meaning": "Eligible: registry-listed targets GAIP watches that are not in the daily tier (active in their registry, public https, inside the per-host cap, not opted out).", "observed_last_14_days": 18635, "observed_last_30_days": 18635, "observed_last_7_days": 18547, "share_last_14_days": 0.9951, "share_last_30_days": 0.9951, "share_last_7_days": 0.9904 }, "daily": { "observed_in_last_48h": 4074, "reasons": { "GAIP_CONTROL": 11, "OUTSIDE_CALLER_ASKED": 158, "PANEL_2026_10": 4099, "QUARTERLY_SAMPLE": 200 }, "reasons_meaning": "A target can have several reasons. OUTSIDE_CALLER_ASKED, WITNESS_RECORD and ON_DEMAND_CAPTURE stay for good once set.", "revisit_hours_planned": 24.0, "targets": 4130, "within_24h": true }, "gap": { "hosts_at_per_host_cap": 10, "meaning": "What the census cannot see: servers the registries list only as packages to install and run locally (no remote endpoint) are invisible to it, and on a host listing more than the per-host cap only the first targets admitted are watched. Servers that are in no registry GAIP reads are not counted.", "per_host_cap": 50, "registry_listed_last_full_pass": 44477, "registry_listed_without_remote_endpoint": 16843, "registry_remote_https_last_full_pass": 27634 }, "plan": { "census_capacity_by_cadence": { "14_days": 36456, "30_days": 78120, "7_days": 18228 }, "daily_capacity_at_24h": 5040, "max_requests_per_hour": 2250, "planned_requests_per_hour": 1311.2, "planned_requests_per_hour_budget": 1575.0, "requests_per_observation_planned": { "census": 5, "daily": 6 } }, "promotions": { "OUTSIDE_CALLER_ASKED": 154 }, "schema_version": "gaip.observatory-tiers.v1", "tier_sizes": { "census": 18726, "daily": 4130 } }, "unique_datasets": { "configured": true, "datasets": { "agent_keys": { "entries": 7170, "head_sha256": "d3d9deeb816d8f446fa33ab4e577aa5df0eaebf4d28cfd2e0e2a4e6088efaf33" }, "agent_prices": { "collector_on": false, "entries": 0, "head_sha256": null }, "agent_terms": { "entries": 13180, "head_sha256": "f985f8ffd573cd61bfbad0f7ed383378fca97fe76eefc7824869ef784180ad72" }, "ai_permissions": { "entries": 213089, "head_sha256": "7eb053b305ac4df9a22904d8b7600803c1983f1e54229a50b7e6053a1688653f" }, "client_behaviour": { "entries": 26, "head_sha256": "df37087576102009a0ed3310b439e5dc3fbeee441c9ee86db0e967dee79a7739" }, "collection_ledger": { "entries": 13, "first_day": "2026-10-04", "head_sha256": "4dbbcccd48a13636b69fc3490e2535def01d9e20a443aa17b761d6701df3c586", "latest_day": "2026-10-16", "schema_version": "gaip.collection-ledger.v1" }, "erc8004_cards": { "collector_on": false, "entries": 0, "head_sha256": null }, "outcome_research_ledger": { "chain_valid": true, "entries": 0, "first_month": "2026-10", "head_sha256": null, "latest_month": null }, "package_history": { "collector_on": true, "entries": 10045, "head_sha256": "bdb0ae00961d76ae21ca7e7b3e9bbd1f97d18cf4ca64683f1c59ac37c1449310" }, "revocations": { "entries": 62, "head_sha256": "b9ce05187cea7578004b3c3013847c51cd103ef0f2ea0232a4eb7f46e12e49c4", "latest_week": "2026-W42", "rule": "The newest week row's week_sha256 (each week carries the previous week's hash; each event the previous event's hash).", "weeks": 2 }, "statements": { "entries": 328, "head_sha256": "725232c0112b88b8c0f197f205b4a1ee7683c022945edde7fbd5e10b460bdaa4", "latest_month": "2026-09", "months": 1, "rule": "SHA-256 over the frozen statement hashes, sorted and joined by newlines" } }, "schema_version": "gaip.unique-datasets.v1" }, "weekly_snapshots": { "entries": 2, "head_sha256": "0c9b250ad662e1d3e835ba4a5ac77f5d27aabdb0032fca10b2cc61bee4432781", "latest_week": "2026-W41" } }