An MCP server answers one unauthenticated initialize POST with its name and version

A JSON-RPC `initialize` sent as an HTTP POST is the entire discovery primitive. A real MCP server answers with a protocol version and a `serverInfo` block giving the implementation name and version, and the demo capture shows protocol version 2025-06-18 from a server calling itself mcp-open 1.4.2 ^[12]. That costs one request, needs no credentials, and works whatever the service calls itself ^[13]. Port scanning cannot substitute, because the port an MCP server picked tells you nothing about it ^[11].

There is a second transport to probe. Before Streamable HTTP, MCP ran over HTTP+SSE: a `GET /sse` that opens an event stream and announces where to POST, and plenty of deployed servers still run it ^[14]. A GET answered with `text/event-stream` and an `event: endpoint` line is an MCP server too ^[15]. The scanner tries the current transport first and falls back to SSE ^[16], which puts the upper bound at two requests per address ^[28].

The five-address network ships with the scanner ^[3], so the output is a demonstration of the probe. Two of the four MCP servers in it answered with no auth ^[17], in a five-host demo network. One of those five hosts is an ordinary web dashboard, put there so the output shows the scanner keying on the protocol ^[19]. The runtime is the part that transfers: about fifteen seconds for five endpoints, with Docker as the only dependency ^[3].

1,402 tools across 492 servers averages about 2.9 tools per server ^[26]. More than 90% of those servers offered direct read access to a data source ^[6], which puts at least 443 of them one anonymous call away from someone's database ^[24]. About 74% sat on AWS, Azure, GCP or Oracle ^[7], roughly 364 hosts ^[25].

For 492 to still describe the internet, counting would have had to keep pace with deploying. r/mcp posts about a dozen new servers on an ordinary day ^[9]. Between the July 2025 count and this post's publication on 16 September 2026 ^[4] runs about fourteen months, and at a dozen a day that is on the order of 5,000 announcements from one subreddit in the interval ^[27]. That number holds only if an ordinary day is typical and each post is a separate server, and both of those remain assumptions.

The case for scanning inside rests on scope. A server bound to a VPC, reachable by every workload in the cluster and every laptop on the VPN, fell outside the 492 from the start ^[10]. Nobody has counted that population, and the demo network here is five addresses.

`initialize` establishes that a server exists. `tools/list` says what it can do, and an open server answers that for an anonymous caller as readily as for an authorised one ^[21]. In the demo output the summary line for the warehouse tool is truncated mid-word, and the full description reads: "Execute a read-only SQL statement against the analytics warehouse (warehouse-prod.internal:5439, service account svc_analytics)." ^[23]