We already measured the public registry once. WARDEN scanned 1,108 servers, blocked 50, and published that only 4 of those blocks were real.
That was a snapshot. A server can pass that snapshot and change one sentence in a tool description the next day. Your client will hand the new sentence to the model without asking you again.
HISTOR is the public memory of what remote MCP endpoints in the official registry advertised. It reads initialize and tools/list. It never calls a tool. It signs what it saw, appends it, and tells you when the digest changed.
Live: histor.modelmarket.dev · Source: github.com/alexar76/histor (MIT)
The last crawl that actually sealed
These figures are from the last completed crawl, finished 2026-09-23 11:33 UTC. The desk says so. A newer crawl was still running while this was written, and its counters were climbing. They are not in the signed tree yet.
| Count | |
|---|---|
| Remote endpoints in the registry | 21,742 |
| Endpoints dialled | 20,445 |
Answered tools/list (ok) |
11,749 |
Asked for a login (http-401) |
4,753 |
Rate-limited (http-429) |
1,544 |
| Labels in the signed log | 33,928 |
| Client reports, 7 days | 0 |
Eleven thousand seven hundred forty-nine servers handed over a tool list. Nothing was installed. No tool was invoked. Private addresses are refused before a connection opens.
The 4,753 login walls stay on the list as not observed. They are counted. They are not dropped, and they are not treated as a quiet pass.
The signed tree head at shoot time was still that September 23 head: size 33,928, root acca0547…. A crawl that has not finished has not sealed. The log only grows when a head is signed.
A change is a date and a diff
While the new crawl was in progress, the desk was already showing definition changes: tools added, tools removed, schema sentences rewritten. The 7-day counter moved past a thousand and kept moving. Quoting one number from the middle of a crawl would be a lie by the time you finish this paragraph. The live desk is the number. This page is the method.
What a change looks like on the desk:
- amber, dated
- a per-tool diff — added, removed, or a field inside a description or a schema
- never the words compromised, rug pull, or unsafe
A description that updates a tool count is a change. So is one new sentence. What you do with it is yours: re-read, re-approve, or pin the old digest.
Four labels. Three of them never fail.
| Label | What it commits to | fail |
|---|---|---|
| Observation | The tool set was drained and digested | never |
| Pattern scan | Which published WARDEN patterns matched the text | never — a match is inconclusive, a reason to read |
| Continuity | Same digest as the previous label, or not | only when two digests differ |
| Name | The name and endpoint are on a threat list, or not | never — a naming signal, not the code |
There is no score. The only number a label could invent would be a product of gate constants, and publishing that as a 0–1 safety score would be the most misleading thing it could do.
WARDEN still answers a different question: right now, on my client, does this look like poison? HISTOR answers: is what I was just sent the set the public log observed, and when did it last change? THEMIS answers a third: should this capability be admitted to a Hub catalogue? Collapsing those three into one word is how a clean report hides a rewritten description.
Paste what your client received
curl -sS https://histor.modelmarket.dev/api/v1/check \
-H 'Content-Type: application/json' \
-d '{"endpoint":"https://example.com/mcp","tools":[ …the tools/list you received… ]}'
The answer is signed. match is one of same, different, previously-observed, not-observed, not-listed, no-digest. It names the tree head it was given under.
Keep yesterday's head. Ask for a consistency proof to today's. If a leaf was removed or rewritten, the proof fails.
curl -sS https://histor.modelmarket.dev/api/v1/log/sth
curl -sS "https://histor.modelmarket.dev/api/v1/log/proof/consistency?first=1000&second=1200"
What a label does not say
The profile forbids safe, secure, audited, certified, approved, and trusted. So does the desk.
- Not the code. No source is read. No package is resolved. A server can keep identical definitions and change its behaviour. The log cannot see that, and says so.
- Not a rating. A pattern match is a reason to read a definition. Sixty-nine endpoints currently carry a block-tier pattern match. That is a reason to open the text. It is not a finding, and it is not the four substantiated cases from the WARDEN survey.
- One operator, one key. What the signature proves is who said it. A second observer is the next step. Until then, do not confuse a signed statement with a second witness.
- stdio servers are out of reach. HISTOR runs nothing. A local server becomes visible only if a client checks the digest it received and chooses to contribute a count. The count is a count. The tools are not stored.
Where to look
🌐 histor.modelmarket.dev · 📦 github.com/alexar76/histor
If a public memory of tool definitions is your kind of boring, a ⭐ on the repo helps it travel.
Top comments (0)