A registry tells you where to look.
The official MCP Registry stores standardized metadata. Its records identify the server, package or remote location, execution instructions, description, and version. Namespace checks tie a publisher to a GitHub account or domain. The registry delegates code scanning to package registries and downstream aggregators.[1]
That is useful identity and discovery data. It is not a recording of what a remote server returns when a client asks for tools/list. The official docs make another boundary plain. The registry is in preview, does not promise uptime or data durability, and expects aggregators to persist their own copies.[2]
Pin the listing. Record the live contract too.
The name can stay still while the contract moves.
An independent project called MCP Transparency Log has been crawling publicly listed remote servers and retaining their unauthenticated tool surfaces. The project says it records names, descriptions, JSON schemas, and annotation hints as raw bytes and normalized hashes.[3]
Its reported result is the useful warning. Across two fixed-hour daily comparisons, about 19.2 percent of roughly 8,300 enumerable servers changed within 24 hours. About 95 percent of those changes kept the same tool names while changing descriptions or schemas. One publisher accounted for 87 percent of the real edits in those comparisons. Excluding that fleet, the project reports about 2.3 percent daily change among independent servers.[3]
Those are measurements from one independent operator, not an official ecosystem audit. They cover public registry entries that declare a network endpoint and answer an unauthenticated tool-list request. Authenticated, private, local, and unreachable servers are outside the observed set.
The clock can manufacture drift.
The project's first analysis mixed crawls taken at different hours. Servers that embedded daily values in descriptions looked as if their contracts had changed. Fixed-hour sampling reduced that cyclic noise. The project also says an earlier parser handled plain JSON but skipped server-sent event frames, biasing the sample toward simpler servers.[3]
That correction is the point. A change detector needs stable collection time, raw responses, transport coverage, and a normalization rule you can rerun. A dashboard number without those records can measure the observer instead of the server.
Version pins and surface witnesses solve different jobs.
The registry requires a unique version for every published metadata record and recommends aligning a server version with its package or remote API version.[4] Keep that pin. Then add a surface hash and a retained response from the actual endpoint your client reached.
Before an agent receives a new or changed tool contract, compare the observed surface with the last approved one. Route a description-only edit, schema edit, added tool, removed tool, and annotation edit to different review questions. Save the decision beside the endpoint, time, negotiated protocol, and raw response hash. A green signature answers who published. The witness answers what arrived.