// Research · 2026-09-04
We scanned all 26,844 servers in the MCP registry.
The official Model Context Protocol registry is the closest thing the agentic web has to an app store, and the widely cited size — about 9,600 records — is a year of growth out of date. We paged through the whole catalog: 89,850 published records across 26,844 unique servers, every one run through the same scanner that ships in wormhole-x402, with a planted, known-poisoned control entry scanned first through the identical code path. The control fired (X402-202, X402-212); the run would have aborted if it had not. Zeros below are measurements, not blindness.
The finding that matters: listings are living documents
Of the 10,752 servers that have published more than one version, 4,446 — 41.4% — changed their listing text between versions. We are not calling those mutations malicious; spot-checking shows most are ordinary copy edits, and we say so plainly. The finding is the mechanism: the listing a person or an agent read when deciding to install is, four times out of ten, not the listing being served today — and nothing in the installation flow ever looks again. Approval is a moment; the listing is a stream. Any review process that runs once at install time is auditing a document that no longer exists.
This is the listing-layer version of the tool-description rug-pull, observed at registry scale from the registry’s own version history rather than inferred. It is exactly the gap the check registry exists for: check_before_userecords what a subject looked like and answers “changed since first seen” (CHECK-001) on every later check.
The base rate: zero injection shapes in listings
Not one of 26,844 listings matched a prompt-override or selection-capture rule. This is our fifth measured zero — after 1,064 Solana memos, 340 ACP job descriptions, 1,198 A2A AgentCard fields, and 1,606 agentic-trading documents — and it comes with the same reading as the others: the attack is real (the academic 5.5% tool-poisoning figure was measured on tool descriptions served by running servers— a layer the registry catalog does not carry), but the OFFICIAL registry’s listing layer is currently clean of it. Base rates belong in public; a scanner vendor who never publishes what it does NOT find is selling fear.
Money is already in the registry
34 listings carry wallet addresses — several of them the Base USDC contract, sitting in the metadata of servers that price their tools per call. Agentic commerce is not arriving in the MCP ecosystem; it is already listed in its app store. That is the seam this whole product line lives in: the same registry entry an agent reads to install a server now also tells it what to pay.
Two findings about our own rules
The scan also measured us, and both results are worth publishing. 34 listings matched the credential-exfiltration shape (X402-203: a secret noun, a transmission verb, an external destination). On review, most are ordinary key-onboarding copy — “get your API key at…” — the benign twin the rule documentation warns about, landing exactly as predicted at registry scale. And 634 listings tripped the identifier-hygiene rule (X402-211) on registry schema fields like package runtime arguments that are legitimately free-form: a rule written for x402 quotes needs registry-schema awareness before its count means anything here. Neither number appears in our headline, and this paragraph is why.
Method & limits
One host contacted: the public catalog API, paginated at 100 records per page with a 200ms delay and backoff on any 429. No third-party URL was fetched, no server was executed, nothing downloaded was run. The crawl reads the listing layer only — name, title, description, package and remote metadata. It cannot see tools/list (that requires connecting to each server, which is the live check’s job, not a catalog crawl’s), it cannot attribute mutations to intent, and content rules remain the evadable layer they always were. Counts of records, versions, mutations and addresses are arithmetic; everything else is labelled.
Check anything yourself before your agent trusts it — npx -y wormhole-x402 gives any MCP host the check_before_use tool, and the hosted check at dashboard.agentwormhole.com adds the memory: changed since first seen, on everything it has ever been shown.