Data
State of ARD
ARD was announced in June 2026 and most of what has been written about it describes intentions. These are counts, taken from a live index, with the method written out.
As of 4 September 2026: 14,732 agentic resources from 6,610 publishers, carrying 97,230 tools, with 94.8% of probed endpoints answering.
The number worth your attention is different: of 8,543 endpoints asked to list their tools, only 2,607 did. 2,072 legitimately wanted credentials, but 1,794 returned 404 or 405, and many of those are working servers answering discovery requests wrongly.
Headline figures
Counted 4 September 2026. These come from one index, not from the whole web, and no index has a complete view. The method is at the bottom of this page and the raw counts are at /api/stats.json if you would rather check than trust.
What is actually being published
The ecosystem is overwhelmingly MCP servers. Agents, the thing most of the launch coverage led with, are the smallest category by a wide margin.
| Family | Count | Share |
|---|---|---|
| MCP servers | 8,714 | 59.2% |
| Skills | 2,764 | 18.8% |
| OpenAPI services | 2,669 | 18.1% |
| Documentation | 277 | 1.9% |
| A2A agents | 79 | 0.5% |
| Catalogs | 16 | 0.1% |
| Registries | 12 | 0.1% |
The gap between the announcements and the index. There are 8,714 MCP servers and 79 A2A agents. That is a ratio of roughly a hundred to one. Whatever the agent-to-agent web becomes, in September 2026 the thing agents actually discover is tools.
Where entries come from
Almost nothing arrives because someone submitted it. Discovery of publishers is itself a crawl problem, which is why publishing a manifest and waiting does not work.
| Source | Entries | What it means |
|---|---|---|
| MCP Registry | 5,000 | The official MCP server registry |
| Well-known crawl | 4,034 | Manifests found at /.well-known/ on crawled domains |
| apis.guru | 2,509 | An open OpenAPI corpus |
| ARD Registry Hub | 1,310 | Federated from ardregistry.org |
| Open crawl | 1,146 | Discovered by following links |
| Hugging Face | 1,135 | Spaces and Skills |
| GitHub | 900 | Repository scanning |
| Desvela | 195 | Federated |
| Submitted directly | 10 | Entries the registry attributes to its submit door |
Read the last row carefully, because we got it wrong once. It counts entries whose recorded source is the submit door, and a whole domain submitted there is handed to the same crawler that handles everything else, so it comes back attributed to crawl. The number of entries therefore understates the number of submissions by roughly three to one.
The figure that actually means something comes from the registry's submission log rather than its entries table: eleven publishers, out of 6,610, have ever submitted anything. If you have published a manifest and heard nothing, that is the reason. Publishing is necessary; being discoverable as a domain is a separate problem, and almost nobody does the second part.
Manifests, which is not the same as publishers
The publisher count above is every domain with an entry, and most arrived because we crawled the MCP Registry or an OpenAPI corpus. The number that measures ARD itself is how many domains put a manifest on their own domain on purpose.
| Measure | Count | What it is |
|---|---|---|
| Domains crawled | 375,997 | Checked for a manifest at a well-known path |
| Serving a manifest | 206 | The real adoption figure |
On ard.json | 29 | Current, and what a conformant consumer fetches |
| On the predecessor path | 176 | Superseded 26 August 2026; consulting it is optional for consumers |
85% of everyone who has published is on a path the specification replaced. The full breakdown, and who they are.
What happens when you actually call these things
This is the part that cannot be got from anyone's announcement. Every indexed endpoint that advertises tools gets asked to list them. Of 8,543 asked:
| Result | Count | Share | Whose problem it is |
|---|---|---|---|
| Answered with tools | 2,607 | 30.5% | Working as intended |
| Wanted credentials | 2,072 | 24.3% | Legitimate. An anonymous crawler cannot enumerate a private server. |
| HTTP 404 | 1,236 | 14.5% | Usually a bug. Often a POST-only route answering a GET with 404. |
| HTTP 422 | 1,160 | 13.6% | Rejected the request shape. Protocol version mismatch, usually. |
| HTTP 405 | 558 | 6.5% | Correct answer to a wrong verb, and a sign the URL indexed is not the endpoint. |
| Connection failed | 319 | 3.7% | Gone, moved, or firewalled. |
| HTTP 429 | 211 | 2.5% | Rate limited us. Fair. |
| Handshake failed | 128 | 1.5% | Reachable, but the MCP handshake did not complete. |
Read that table the right way. Only 31 percent answered, but that is not 69 percent broken. Authentication is a legitimate answer and accounts for 2,072 of them. What is genuinely worth someone's attention is the 1,794 endpoints returning 404 or 405, because a large share of those are servers that work fine for anyone holding the right URL and are answering discovery requests in a way that makes them look absent.
One specific thing worth checking on your own server. We shipped this bug ourselves. A POST-only endpoint that answers a GET with 404 tells an SDK client the endpoint does not exist, so the client gives up rather than retrying correctly. It cost us two days of handshakes with zero completed tool calls before anyone noticed, because from the outside it looks exactly like nobody is using you. If you run an MCP server, curl a GET at it and check you get 405 rather than 404.
Tool descriptions and prompt injection
A question usually answered with speculation, so here is a count. All 97,230 tool descriptions in the index were scanned for text addressed at a model rather than at a developer.
| Check | Result |
|---|---|
| Descriptions carrying any model-directed text | 74 of 97,230, which is 0.076% |
| Descriptions using override phrasing such as ignore previous instructions | 0 |
| Descriptions containing steganographic or invisible codepoints | 0 |
So there is close to nothing to find, and that is the finding. It is worth saying plainly because the first version of this scan flagged Persian zero-width non-joiners and three security vendors whose tools legitimately discuss injection, which would have publicly accused four honest publishers of something they did not do. A detector with no measured base rate is a defamation machine. None of this is an argument against sandboxing what you invoke.
Method
Stated so you can discount it appropriately.
- Source. The public index operated by Neuronto, which is run by the same people who write this site. That is a conflict of interest and it is declared on the about page too.
- Coverage. Entries come from crawling well-known paths, the MCP Registry, an open OpenAPI corpus, GitHub, Hugging Face, and federation with other ARD registries. It is not the whole web. A resource nobody links to and nobody submitted is missing from these counts, and there is no way to know how many of those exist.
- Introspection. Endpoints advertising tools are asked to enumerate them, once,
anonymously, with a timeout. An endpoint requiring authentication is recorded as
authrather than as a failure. Rate-limited endpoints are recorded as such rather than retried aggressively. - Liveness. The answering percentage counts probed endpoints only. Entries never probed are excluded from that denominator rather than assumed alive.
- Freshness. Figures refresh when this page is rebuilt. The date at the top is when the snapshot was taken, not when the page was written.
- Raw data. /api/stats.json, the same object the page is built from.
If you want to check any of this, the numbers that would embarrass us are in the same table as the ones that do not. That is the point of publishing the method.
Last reviewed 2026-09-04. Checked against ARD v0.91 (Proposal, 2026-08-26).