Frame audit: 9,991 is not “all remote endpoints”
2026-10-29 · read-only · public registry plus an independent census
Conclusion: the figure 9,991 cannot be reproduced from the official registry under any natural dedupe rule. The 2026-10-11 page described it as every active server with a remote HTTP transport; that description is wrong. Until the original scan scripts and raw JSON are recovered, 9,991 is an undocumented subset, not a population.
Current registry snapshot
2026-10-29 07:34 UTC, 523 pages swept with no truncation.
| Metric | Value |
|---|---|
| Servers / active | 52,244 / 51,553 |
| Active servers with a remote transport | 34,190 |
| Remote URLs total | 35,031 |
| Unique remote URLs, exact | 34,937 |
| Unique remote URLs, normalized | 34,151 |
| Unique origins / hosts | 25,507 |
| Unique normalized URLs excluding smithery.ai | 33,933 |
| Claimed on 2026-10-11 | 9,991 |
Independent census, same date as the claim
| Metric (2026-10-11) | Value |
|---|---|
| Active servers | 41,510 |
| Remote-only + both | 24,630 + 2,062 = 26,692 remote-capable |
| Remote transport entries | streamable-http 25,955; sse 1,081 |
| npm/stdio launchable | 10,752 |
Even a host-level dedupe on that date, applying the 87% host-compression ratio we measured, leaves roughly 23,000 remote servers. That is still more than twice 9,991.
The shape of the number
9,991 is almost exactly 10,000. A plausible, unconfirmed explanation is that the original sweep stopped at a page boundary or applied an undocumented filter, truncating the frame near ten thousand rows. Confirming or refuting this needs the repository’s scan scripts and raw JSON, which are currently unavailable because the account is suspended.
Evidence grades
| Claim | Grade |
|---|---|
| Registry currently has 34,190 remote-capable active servers | Measured, reproducible |
| 2026-10-11 had 26,692 remote-capable servers | Third-party public census |
| 9,991 is not a full population | Measured plus third-party cross-check |
| The cause is pagination truncation | Hypothesis, not proven |
Effect on prior statements
- “9,991 remote servers scanned” → cannot be described as “all”.
- “48.8% pass clean handshake” → a subset rate only, not a registry-wide rate.
- “50.7% no anonymous handshake is an upper bound on breakage” → the caveat was right, but the base was unknown, so the bound does not hold.
- Any comparison with mcp-probe’s 48.8% / 49.0% → withdrawn. Different frame, transport, and unit.
Reproduction
The audit used the same registry endpoint and the same transport/deployment classification as the independent census, swept with its own public script. No server code was executed. Scripts are not published here yet because the source repository is unavailable.