Of 12,915 MCP servers HISTOR started in a sandbox, 41% never answered
HISTOR started 12,915 npm and PyPI MCP servers in a sandbox, and 5,259 (41%) never answered, according to its own post. About 24% were broken or not stdio servers at all. Another 16% depended on keys, flags or runtimes a client config can supply.
The Engineer · Build desk
Ranking of failure buckets by number of servers: broken as published 2,476; print a usage text 924; stop at a key or setting even with a placeholder 793; declare no command or exit 0 666; need something the machine lacks 236; start an HTTP server instead of answering on stdin 164.
Servers per failure bucket in HISTOR's sandbox run, per its post In servers
| Rank | Item | Value | Claim |
|---|---|---|---|
| 1 | Broken as published | 2,476 servers | 4 |
| 2 | Print a usage text | 924 servers | 6 |
| 3 | Stop at a key or setting | 793 servers | 5 |
| 4 | Declare no command, or exit 0 | 666 servers | 7 |
| 5 | Need something the machine lacks | 236 servers | 9 |
| 6 | Start an HTTP server instead | 164 servers | 8 |
What happened
- 7,656 of the 12,915 servers answered initialize and tools/list, 64% of the npm servers and 52% of the PyPI ones.
- Among the 2,476 servers broken as published, 874 crash with an error of their own and 636 will not install at all.
- Held to mcp<2, 207 of 269 PyPI servers that died on import under mcp 2.x answered.
- In the sandbox, 580 npm packages tried to reach the network while installing, mostly to fetch a prebuilt binary.
- 1,484 servers reached for the network at startup, before any tool was called.
Why it matters
- decision Before a registry entry goes into an agent config, someone has to start it: up to one listed server in eight is not a stdio MCP server as installed.
- constraint The post does not say how the 12,915 were chosen from the 47,586 listed, so 41% describes this cohort and cannot be applied to a registry as a whole.
- exposure The harness installs npm packages with --ignore-scripts and runs the scripts itself under trace, so an ordinary install on a developer or CI machine lets the same scripts reach the real network.
The 5,259 silent servers [25] fall into six buckets, and the counts reconcile: 2,476 broken as published [4], 793 that stopped at a key or setting [5], 924 that printed usage text [6], 666 that declared no command or exited 0 after doing something else [7], 236 that needed software or a network the sandbox lacked [9], and 164 that started an HTTP server instead of answering on stdin [8]. They sum to 5,259 [26].
Two of those buckets are broken in ways a key or a flag does not touch: the 2,476 and the 666. Together they hold 3,142 servers, about 24% of the 12,915 [27]. The other four buckets total 2,117, about 16%, and are the part a client config can change [28]. Not all of them will start. Many of the 924 usage-text packages are command-line tools that mention MCP somewhere, according to the post [6]. The 793 stopped, the post says, because they check a key's format at startup or call their own API before answering, and the trap is not their API [5]. The post also says the 164 HTTP servers get --transport=stdio on their next run [8], so 41% is a snapshot dated 13 October 2026 [2].
Counting the 1,239 servers that started only with a placeholder key or a start argument as working is the right call, because a client config would supply both [13]. The 1,039 that needed a placeholder key make a second point. The post's authors wrote, "A key that works nowhere was enough for every one of them to tell us its tools." [14] For those servers, listing tools needs no real credential.
The mcp break leaves recognizable errors. Version 2.0.0 of mcp, dated 28 July 2026, gave FastMCP a new name and altered the decorators on the low-level server. Any PyPI server whose mcp dependency lacks an upper bound pulls in 2.x, then dies on import with cannot import name 'FastMCP' or 'Server' object has no attribute 'list_tools' [10]. Of the servers it restarted under mcp<2, the authors wrote: "Anyone who installs them today gets the crash, not the server." [12]
The cohort is 27% of the 47,586 listed packages [29], drawn by a crawler that runs up to 8,000 per crawl [1]. The harness limits are tight: 512 MB, one CPU, 360 seconds to install and 150 to start and answer [15]. A server that needs longer is counted silent.
The harness is built well where it matters. The observer speaks MCP and calls up to 15 tools once each, and gVisor logs system calls to a trace held outside the sandbox, where a package has no way to cover up anything it opened, launched or connected to [17]. Placeholder names come only from a package's own error text or its registry entry, and the values work nowhere [18]. Every DNS name resolves to a trap that forwards nothing [16], so the startup counts are attempts. Across the 11,891 runs with a trace [20], the most requested names at startup were pypi.org (613), github.com (478), nodejs.org (245) and registry.npmjs.org (243), mostly version checks [24]. Install scripts ran in 2,239 npm packages, about 30% of those run [21].
What to watch
- Whether HISTOR's next runs, with start arguments for usage-text servers and --transport=stdio for HTTP ones, pull the 41% down.
- Whether HISTOR publishes what servers opened or sent to the decoy credential files and DNS traps, not just that they dialled out.
- Whether PyPI maintainers add an upper bound on mcp or port to 2.x, which decides how many of the 269 stay broken for new installs.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence66
- Adoption
- Insufficient
- Hype gap−10
- Incentives
- Insufficient
- Confidence64
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The registries HISTOR follows list 47,586 npm and PyPI packages, and it runs up to 8,000 per crawl.
- [2]
The post describes the state on 13 October 2026, after 12,915 servers had been run.
- [3]
7,656 of 12,915 servers answered initialize and tools/list: 64% on npm, 52% on PyPI.
- [4]
2,476 servers are broken as published: 874 crash with an error of their own, 636 will not install, 490 hang, stay silent or speak something that is not MCP, 292 were written for MCP SDK 1.x, and 184 miss one of their own files, ship TypeScript Node will not load from node_modules, or import an undeclared dependency.
- [5]
793 servers ask for a key or a setting and stop even with a placeholder, usually because they check the key's format at startup or call their own API before answering, and HISTOR's trap is not their API.
- [6]
924 servers print a usage text. Some want a start argument HISTOR passes next time, and many are command-line tools that mention MCP somewhere.
- [7]
666 servers declare no command at all, or exit 0 having done something else. With the 924 usage-text packages, up to one package in eight listed as an MCP server is not a stdio MCP server when installed the way its listing says.
- [8]
164 servers start an HTTP server instead of answering on stdin; their next run gets --transport=stdio.
- [9]
236 servers need something the machine does not have: another program (git, Java, Bun, a desktop app), the internet at startup, or another operating system.
- [10]
mcp 2.0.0 (28 July 2026) renamed FastMCP and changed the low-level server's decorators. A PyPI server that depends on mcp with no upper bound installs 2.x and dies on import with: cannot import name 'FastMCP', or 'Server' object has no attribute 'list_tools'.
- [11]
HISTOR started 269 such PyPI servers again with pip held to mcp<2, and 207 (77%) answered.
- [12]
Anyone who installs them today gets the crash, not the server.
- [13]
1,239 servers started only with something they asked for: 1,039 with a placeholder key, 177 with a start argument, 23 with both. A client config would have given them that, so HISTOR counts them as working.
- [14]
A key that works nowhere was enough for every one of them to tell us its tools.
- [15]
The sandbox uses gVisor (runsc), an unprivileged user, a read-only root, 512 MB and one CPU, with 360 s to install and 150 s to start and answer.
- [16]
The sandbox has no route out: every DNS name resolves to HISTOR's traps, which record what reaches them and forward nothing.
- [17]
The observer speaks MCP (initialize, tools/list, then up to 15 tools called once each with canary arguments), and gVisor writes its own syscall trace outside the sandbox, so a package cannot hide what it opened, started or dialled.
- [18]
Placeholder names only come from the package's own error text or its registry entry; the values are HISTOR's and work nowhere.
- [19]
npm packages are installed with --ignore-scripts, and the install scripts then run on their own, traced.
- [20]
11,891 runs carry a gVisor trace.
- [21]
2,239 npm packages ran install scripts, about 30% of the npm packages HISTOR ran.
- [22]
580 of the npm packages that ran install scripts tried to reach the network while installing, mostly to fetch a prebuilt binary (prebuild-install, node-gyp's headers, esbuild); in the sandbox that fails.
- [23]
1,484 servers reached for the network at startup, before any tool was called.
- [24]
The names reached for most at startup were pypi.org (613), github.com (478), nodejs.org (245) and registry.npmjs.org (243), mostly version checks.
- [25]
5,259 of the 12,915 servers did not answer, which is 40.7%, matching the post's 41%.
- [26]
The six failure buckets sum to the 5,259 silent servers.
- [27]
The broken-as-published servers plus those with no command or a stray exit 0 total 3,142, about 24% of the 12,915.
- [28]
The key/setting, usage-text, HTTP and missing-dependency buckets total 2,117 servers, about 16% of the 12,915.
- [29]
The 12,915 servers run are about 27% of the 47,586 listed packages.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- dev.toWe installed 12,915 MCP servers and started each one. 41% never answered.
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.