Skip to content
MCPSTAMP
Study · 7 November 2026

State of MCP readiness, November 2026

Fewer than three in ten remote MCP servers are ready for every store. We checked 34,728 of the 35,158 unique remote URLs in the official MCP Registry on 2 November 2026. Of the 33,003 that responded over HTTPS, 9,541 (28.9%) passed every blocking check for Claude, ChatGPT, Gemini and the MCP Registry.

The biggest gap isn't auth or transport. It's tool metadata. The three most common blockers are all missing tool hints or titles, and each takes a few lines of JSON to fix.

Headline numbers

of checked URLs responded over HTTPS33,003 of 34,728
95.0%
ready for all four stores9,541 servers
28.9%
blocked by missing ChatGPT tool hints10,372 servers
31.4%
set readOnlyHint or destructiveHint on every tool13,805 of 21,163
65.2%
use OAuth13,558 servers
41.1%
of OAuth servers offer refresh tokens12,514 of 13,558
92.3%
fail the Gemini metadata discovery orderof 13,435 OAuth servers
356
average score out of 100grade A for 12,738
83.1
Findings

The eight numbers

  1. Most registry servers answer

    33,003 of 34,728 checked URLs responded over HTTPS (95.0%). 30,351 of them (92.0% of responders) passed the MCP initialize check. 21,341 returned an initialize result and 9,010 returned a valid OAuth sign-in challenge. The registry lists 54,786 servers (latest versions), 35,817 of them list a Streamable HTTP remote, and that comes to 35,158 unique checkable URLs.

  2. Gemini is the easiest AI store to pass, ChatGPT the hardest

    StoreReadyShare of 33,003Unverified
    Claude12,27437.2%8,577
    ChatGPT9,81429.7%8,633
    Gemini20,08060.8%8,761
    MCP Registry30,35392.0%–
    All four9,54128.9%–

    Unverified means no blocking check failed, but one couldn't run, mostly because the tools sit behind sign-in and we check without credentials.

  3. The top blocker is one missing hint

    The check tool_open_world (explicit readOnlyHint, destructiveHint and openWorldHint, which ChatGPT asks for) blocks at least one store on 10,372 servers (31.4%). Next come tool_annotations on 7,358, tool_titles on 7,006, auth_resource on 1,872 and auth_prm on 1,628.

  4. About a third of servers skip tool annotations

    We could list the tools of 21,163 servers. 13,805 of them (65.2%) pass tool_annotations. Only 10,791 (51.0%) set all three hints ChatGPT wants, and 14,157 (66.9%) give every tool a title.

  5. Half the servers ask for no sign-in

    OAuth 13,558 (41.1%), open 16,534 (50.1%), and 1,327 (4.0%) use an API key or similar, which store clients can't send.

  6. OAuth servers mostly get the basics right

    Of 13,558 OAuth servers, 12,514 (92.3%) advertise the refresh_token grant and 13,138 (96.9%) offer client registration (DCR or CIMD).

  7. Two newer checks catch a few hundred servers

    Gemini's metadata discovery order (auth_gemini_discovery) fails on 356 of 13,435 OAuth servers where it ran. ChatGPT's metadata rules (auth_chatgpt_metadata, issuer equality and token_endpoint_auth_methods_supported) fail on 270 of 13,212.

  8. The average score is 83.1

    GradeServersReports
    A12,7381,837 grade A reports
    B11,7092,239 grade B reports
    C5,740455 grade C reports
    D18830 grade D reports
    F2,628439 grade F reports

    Protocol versions were 2025-11-25 on 13,186 servers, 2025-03-26 on 4,865 and 2025-06-18 on 2,623. Another 11,662 returned no initialize result, mostly because they sit behind OAuth.

Blockers

Top 10 store blockers

Servers where the check blocks at least one store, out of 33,003 that responded.

CheckWhat it testsServers blockedStores
tool_open_worldExplicit readOnlyHint, destructiveHint and openWorldHint (ChatGPT)10,372ChatGPT
tool_annotationsreadOnlyHint or destructiveHint on every tool7,358Claude, ChatGPT
tool_titlesHuman-readable title on every tool7,006Claude, ChatGPT
auth_resourceResource metadata "resource" equals the server URL1,872Claude
auth_prmProtected resource metadata (RFC 9728)1,628Claude, ChatGPT
initializeinitialize over Streamable HTTP1,588Claude, ChatGPT, Gemini, Registry
auth_as_metadataAuthorization server metadata (RFC 8414 / OIDC)1,560Claude, ChatGPT, Gemini
auth_methodSign-in method the store supports (OAuth or none)1,327ChatGPT, Gemini
protocol_versionSupported protocol version negotiated675Gemini
auth_gemini_discoveryFirst metadata URL Gemini tries answers 200 with the required fields356Gemini
Fixes

How to fix the top three blockers

All three live in your tool list, so one edit clears them. Give every tool a title and an annotations object with explicit true or false values.

Set readOnlyHint: true on tools that only read. Set destructiveHint: true on tools that change or delete data, and false on the rest. Claude needs one of the two on every tool (tool_annotations). ChatGPT needs all three hints written out, including openWorldHint, which says whether the tool reaches outside your own system (tool_open_world).

The title (tool_titles) is the short human name a store shows next to the tool. Keep it in plain words, not the snake_case name.

Then run McpStamp Check on your URL. It lists any tool that still misses a hint.

One tool in tools/list

{
  "name": "search_orders",
  "title": "Search orders",
  "description": "Find orders by customer, date range or status. Returns up to 50 orders with totals.",
  "inputSchema": { "type": "object", "properties": { "query": { "type": "string" } } },
  "annotations": {
    "readOnlyHint": true,
    "destructiveHint": false,
    "openWorldHint": false
  }
}
Method

Method and limits

We read every server in the official MCP Registry (registry.modelcontextprotocol.io, latest version of each) and kept the unique Streamable HTTP remote URLs, 35,158 in all. Each one got a single check with McpStamp Check engine 1.2.0 on 2 November 2026, between 07:38 and 11:25 UTC. We sent no credentials and ran at most one check at a time per domain.

A server counts as responded when it gave any HTTP response that isn't a firewall or gateway error, so 404, 500 and sign-in challenges count. A store is ready when no blocking check failed and every blocking check could run. Store status is the engine's own result for each store, not recomputed.

We left out 189 of our own URLs, 175 on hosts that returned HTTP 429 (not retried), 2 whose host resolved to a private or reserved address, 66 the engine refuses before any request (a port other than 443 or 8443, sslip.io and nip.io names, a redirect to http, a malformed URL) and 2 engine errors.

There are limits. We re-checked the URLs that had responded earlier the same day first, then took the rest in random order, so the response rate is biased upward. One check per URL means a server that was briefly down counts as not responding. Without credentials we can't see tools behind sign-in, which is why so many servers are unverified rather than ready. And a ready call means no blocking check failed. It isn't approval from Anthropic, OpenAI or Google.

Server reports

Look up a server

5,000 servers have a public report with their score, store calls and fixes. Browse the server reports or a grade list.

Grade A servers with the most tools

Missing the ChatGPT tool hints

Grade AGrade BGrade CGrade DGrade F

Cite

How to cite this study

You're welcome to quote any number here with a link. The aggregate data is on the Readiness Index page.

McpStamp. State of MCP readiness, November 2026. Scan of the official MCP Registry on 2 November 2026, McpStamp Check engine 1.2.0. https://www.mcpstamp.com/state-of-mcp-2026-11/

Check your own server

Paste a remote MCP URL. You get the score, the store blockers and the fix for each one in under a minute.