Anima's post "Your MCP Server Is Invisible to Directories" is the best first-person account of the 401-on-initialize problem published so far. Their MCP server required a Bearer token on every request (including initialize), so every directory crawler got a 401 before it could list a single tool: Glama marked the connector Unhealthy ("No tool schema history has been recorded yet"), Smithery burned 5m 12s waiting for an auth handshake that was never going to complete. The listing existed; the server was invisible anyway.
We've been measuring that exact failure mode at registry scale. Numbers first (n = 6,249 unique HTTPS MCP endpoints, single snapshot 2026-09-18, credential-less client, receipts kept):
| state | n | % |
|---|---|---|
OPEN — credential-less initialize and a served tools array |
1,755 | 28.1% |
LATE-GATE — handshake + tools/list open, tools/call gated |
22 | 0.4% |
HARD-GATE — 401 on initialize (invisible to every directory) |
1,865 | 29.8% |
| RESPONDS_NOT_SERVING — HTTP 200, never serves a tools array | 703 | 11.2% |
| protocol mismatch / invalid / network errors | 2,005 | 32.5% |
Valid RFC 9728 protected-resource metadata was served by 32.5% of endpoints; 68.4% of gated endpoints are gated but discoverable — a client that follows the WWW-Authenticate pointer can still learn where to authenticate.
Three findings that map directly onto Anima's story:
1. The state Anima escaped is 29.8% of the registry. 1,865 endpoints hard-gate on initialize. Every one of them is invisible to every directory that indexes by opening a connection and listing tools: the listing exists, the tools never get recorded, search excludes the connector. Anima's Glama screenshot is what a third of the registry looks like from the outside.
2. The fix Anima shipped is the rarest state in the registry. Their anonymous allowlist (initialize, notifications/initialized, ping, tools/list, prompts/list, resources/list open; everything else — tools/call included — still 401) is exactly what we classify as LATE-GATE: 22 endpoints out of 6,249 (0.4%). When servers gate, they gate at initialize 98.8% of the time. Almost nobody separates "tool discovery is public API-surface documentation" from "tool execution is authenticated" — the 22 that do are the pattern worth copying.
3. The rate-limit trap compounds at directory scale. Anima's second outage — anonymous sessions sharing the authenticated bucket (ten concurrent, keyed on the shared string "anonymous", 30-minute idle timeout, crawlers never sending DELETE) — is not just a Glama problem. Multiple directories hitting the same endpoint compete for the same anonymous slots, so the endpoint looks flaky to all of them simultaneously. Their fix (a separate anonymous class: 250 concurrent / 2-minute idle) is the right shape. Our probe saw the residue of this pattern all over the registry: endpoints that pass one credential-less handshake and 429 the second.
The 68K context. The write-ups describing this problem — Anima's included — come from a smaller-registry era. The MarketNow catalog now tracks 68,387 servers / 132,736 skills across 7 sources (official registry, npm, PyPI, GitHub, Smithery, crates.io, Docker), and the 401 problem didn't shrink as the registry grew — it scaled with it. While ~30% of endpoints are un-listable, every directory's tool counts are systematically undercounted, and the RFC 9728 pointer is the only discovery path that survives gating for the other two-thirds.
The dataset is public and live:
- Aggregate distribution: https://www.marketnow.site/api/auth-gate-distribution.json
- Per-skill joinable index (6,165 skills): https://www.marketnow.site/api/auth-gate-skills.json
Method: single-shot JSON-RPC over streamable-HTTP, initialize → notifications/initialized → tools/list, plus GET /.well-known/oauth-protected-resource on each origin. An endpoint only counts as open if tools/list returns an actual tools array — HTTP 200 alone counts for nothing. That's the same lesson as Anima's closing line ("a green suite is not evidence that anyone else can see your server"): a handshake that succeeds and a tools/list that returns tools are different facts. Endpoint URLs are published SHA-256-hashed, aggregate-first.
If you run an MCP server: Anima's 30-second curl check is the right place to start. If you want the population-level numbers for a talk, post, or threat model: the JSON above is live, schema-versioned, and the per-skill index is joinable.
(We build MarketNow — an MCP catalog with trust infrastructure. The auth-gate probe is the measurement layer; the trust side — credential verification, revocation checking, conformance vectors — is the product.)
Top comments (0)