2,073 listed MCP servers point at source code that is no longer publicly accessible.

On 2026-07-20 we checked every repository and website URL carried by the 17,673 servers in the official MCP registry. 1,834 of the 13,105 distinct GitHub repositories those servers reference could not be reached — one in seven. The packages themselves still install. What has gone is the ability to read the code before you hand it to an agent.

Every MCP registry has this problem, mcpindex’s own catalog included — these are our listings. The difference is that we measure it and publish the measurement.

What we found

Why “not publicly accessible” and not “deleted”

GitHub returns the same 404 for a repository that was deleted and one that was made private. We cannot tell those apart, so we do not claim to. Both mean the same thing for the reader who matters: the source backing a tool your agent may call can no longer be audited by anyone. A maintainer who took a repository private on purpose has done nothing wrong, and the wording on every affected listing says so.

Method

1. Every repositoryUrl and websiteUrl in the 2026-07-20 registry snapshot, de-duplicated to distinct URLs (13,105 repositories from 17,673 servers).
2. Each repository probed with git ls-remote, then — this matters — corroborated through the authenticated GitHub API. Anonymous git answers a missing repository with a credential prompt rather than a 404, so a checker that trusts anonymous git alone reports zero casualties and looks healthy doing it. That bug hid all 1,834 of these from our own first two passes.
3. Only HTTP 404, 410, 451 and NXDOMAIN count as unreachable. Rate limits, timeouts, 401s, 403s and 5xx are recorded as unknown and never counted against a project.
4. A random sample of 150 was re-checked by hand through a different method (unauthenticated web), a different network, and no credentials. All 150 agreed, which bounds the false-positive rate at 2.0% (95% confidence).
5. The sweep’s result digest is stamped to Bitcoin via OpenTimestamps, so the date of this measurement is independently verifiable and cannot be backdated — including by us.

Limits

• Point in time. These are the counts on 2026-07-20. Per-listing flags carry a stricter bar than this aggregate: two failed checks at least 48 hours apart, plus agreement from a second independent vantage, before anything appears on a server page.
• Deleted and private are indistinguishable. Some share of the 1,834 are deliberate, not abandoned.
• 178 websites are invisible to us. They refuse connections from datacenter networks, so we record them as unknown rather than guessing. The website figure above comes from a single vantage and is not used for any per-listing flag.
• Repositories only. A reachable repository proves nothing about a running server — it proves a URL resolves. Liveness is only ever evidence against, never evidence for.

What to do about it

If you install MCP servers as packages, an unreachable repository is a real audit gap: pin the version you already reviewed, because you can no longer diff what you are running against anything. If you connect to a hosted server, the repository was never the code that executes — treat it as context, not as a reason to disconnect. Affected listings say which case applies, and maintainers can dispute any flag from the listing itself.

Cite this

The full dataset — aggregates, the per-server list, and the OpenTimestamps proof — is archived with a DOI and a CC-BY-4.0 license:

Bharti, G. (2026). mcpindex Source Liveness — Baseline v1. Zenodo. https://doi.org/10.5281/zenodo.21501868

Cite the concept DOI 10.5281/zenodo.21501867 to reference the series across editions.

Method and limits: how a verdict is produced. Corrections and disputes: hello@mcpindex.ai.