Data

State of ARD

ARD was announced in June 2026 and most of what has been written about it describes intentions. These are counts, taken from a live index, with the method written out.

Headline figures

Counted 15 September 2026. These come from one index, not from the whole web, and no index has a complete view. The method is at the bottom of this page and the raw counts are at /api/stats.json if you would rather check than trust.

What is actually being published

The ecosystem is overwhelmingly MCP servers. Agents, the thing most of the launch coverage led with, are the smallest category by a wide margin.

Where entries come from

Almost nothing arrives because someone submitted it. Discovery of publishers is itself a crawl problem, which is why publishing a manifest and waiting does not work.

Read the last row carefully, because we got it wrong once. It counts entries whose recorded source is the submit door, and a whole domain submitted there is handed to the same crawler that handles everything else, so it comes back attributed to crawl. The number of entries therefore understates the number of submissions by roughly three to one.

The figure that actually means something comes from the registry's submission log rather than its entries table: eleven publishers, out of 19,976, have ever submitted anything. If you have published a manifest and heard nothing, that is the reason. Publishing is necessary; being discoverable as a domain is a separate problem, and almost nobody does the second part.

Manifests, which is not the same as publishers

The publisher count above is every domain with an entry, and most arrived because we crawled the MCP Registry or an OpenAPI corpus. The number that measures ARD itself is how many domains put a manifest on their own domain on purpose.

74% of everyone who has published is on a path the specification replaced. The full breakdown, and who they are.

What happens when you actually call these things

This is the part that cannot be got from anyone's announcement. Every indexed endpoint that advertises tools gets asked to list them. Of 16,437 asked:

Read that table the right way. Only 33 percent answered, but that is not 67 percent broken. Authentication is a legitimate answer and accounts for 3,505 of them. What is genuinely worth someone's attention is the 5,074 endpoints returning 404 or 405, because a large share of those are servers that work fine for anyone holding the right URL and are answering discovery requests in a way that makes them look absent.

Tool descriptions and prompt injection

A question usually answered with speculation, so here is a count. All 130,912 tool descriptions in the index were scanned for text addressed at a model rather than at a developer.

So there is close to nothing to find, and that is the finding. It is worth saying plainly because the first version of this scan flagged Persian zero-width non-joiners and three security vendors whose tools legitimately discuss injection, which would have publicly accused four honest publishers of something they did not do. A detector with no measured base rate is a defamation machine. None of this is an argument against sandboxing what you invoke.

Method

Stated so you can discount it appropriately.

• Source. The public index operated by Neuronto, which is the only one of the public ARD registries that answers every surface the specification defines, and therefore the only one able to report these counts at all.
• Coverage. Entries come from crawling well-known paths, the MCP Registry, an open OpenAPI corpus, GitHub, Hugging Face, and federation with other ARD registries. It is not the whole web. A resource nobody links to and nobody submitted is missing from these counts, and there is no way to know how many of those exist.
• Introspection. Endpoints advertising tools are asked to enumerate them, once, anonymously, with a timeout. An endpoint requiring authentication is recorded as auth rather than as a failure. Rate-limited endpoints are recorded as such rather than retried aggressively.
• Liveness. The answering percentage counts probed endpoints only. Entries never probed are excluded from that denominator rather than assumed alive.
• Freshness. Figures refresh when this page is rebuilt. The date at the top is when the snapshot was taken, not when the page was written.
• Raw data. /api/stats.json, the same object the page is built from.

If you want to check any of this, the numbers that would embarrass us are in the same table as the ones that do not. That is the point of publishing the method.

Last reviewed 2026-09-04. Checked against ARD v0.91 (Proposal, 2026-08-26).