The latest articles on DEV Community by Toolweather (@toolweather). https://dev.to/toolweather https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4187550%2Fb94f8af8-cfca-4fa9-9a44-8416a4b139cb.png https://dev.to/toolweather en Toolweather Thu, 15 Oct 2026 22:34:23 +0000 https://dev.to/toolweather/74-of-mcp-servers-arent-ready-for-the-2026-07-28-spec-what-we-learned-from-live-probes-56ic https://dev.to/toolweather/74-of-mcp-servers-arent-ready-for-the-2026-07-28-spec-what-we-learned-from-live-probes-56ic <p>Every ~15 minutes we run a handshake against about 2,043 public MCP servers. The results are on a live board at <a href="https://toolweather.pages.dev" rel="noopener noreferrer">https://toolweather.pages.dev</a>, and they're a useful reality check for anyone building agents.</p> <h2> The numbers </h2> <ul> <li> <strong>~74% legacy-only</strong> (706 of 952 classified servers): not ready for the 2026-07-28 spec. Only ~26% are dual-era or modern.</li> <li><strong>~47% healthy/open, ~51% behind auth.</strong></li> <li> <strong>128 ms median handshake</strong>, 14,938 tools tracked.</li> </ul> <h2> Why it matters </h2> <p>If your client only speaks the new protocol, most servers will fail quietly. And agents that call tools or pay merchants they've never seen need a cheap "should I?" check first.</p> <h2> What we built (free, no signup) </h2> <p>All of this runs on free Cloudflare Workers + D1, exposed as MCP:</p> <ul> <li> <strong>Toolweather</strong>: health/protocol/latency for any listed MCP server. <a href="https://toolweather.toolweather.workers.dev" rel="noopener noreferrer">https://toolweather.toolweather.workers.dev</a> </li> <li> <strong>Upstream</strong>: upgrade/dependency checks.</li> <li> <strong>SpendGate</strong>: approve / ask a human / block before an agent spends. <a href="https://spendgate.toolweather.workers.dev" rel="noopener noreferrer">https://spendgate.toolweather.workers.dev</a> </li> <li> <strong>PayCheck</strong>: trust verdict (trusted / unknown / suspicious / block) for a merchant, URL or 0x wallet. <a href="https://paycheck.toolweather.workers.dev" rel="noopener noreferrer">https://paycheck.toolweather.workers.dev</a> — <code>POST /v1/check</code> with <code>{"target": "example.com"}</code>.</li> </ul> <p>SpendGate uses a local allowlist for well-known merchants (no network call), and asks PayCheck about everything else. Workers on the same account talk through a service binding, because a workers.dev self-fetch fails. If the lookup fails, it falls back to local classification.</p> <p>One MCP connection to the Toolweather bundle gets you all of it. Paid usage beyond free quota is via x402 (USDC on Base).</p> <h2> For server authors </h2> <p>Free live badge for your README:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight markdown"><code><span class="p">[</span><span class="nv">![Toolweather</span><span class="p">](</span><span class="sx">https://toolweather.toolweather.workers.dev/badge/YOUR.SERVER.ID.svg</span><span class="p">)</span>](https://toolweather.pages.dev/) </code></pre> </div> <p>Also on Glama: <a href="https://glama.ai/mcp/servers/toolweather/paycheck" rel="noopener noreferrer">https://glama.ai/mcp/servers/toolweather/paycheck</a></p> <p>Feedback on the methodology welcome.</p> mcp ai agents cloudflare