Original research
The state of MCP compliance: 16 real servers, measured
Measured 2026-08-11 · against MCP 2026-07-28 · sample of 16
The headline
20
servers approached
16
measured
0
classified as 2026-07-28
8
rejected modern discovery
The single most common failure is a server demanding Mcp-Session-Id, a header 2026-07-28 removed along with the initialize handshake. 8 of 16 servers answered a modern discovery request with an error rather than a result. From a current client's point of view those servers are not slow or partially broken — they are unreachable.
12 of the 16 measured servers tripped at least one MUST-level rule.
Which revision are they speaking?
Era detection asks a server to answer a modern request, and falls back to the legacy handshake if it refuses. The distribution is the clearest signal in the dataset.
| Era | Servers | What it means |
|---|---|---|
| dual | 1 | Answers both the legacy and modern request shapes |
| legacy | 3 | Completed a 2025-era initialize handshake |
| unknown | 12 | Refused modern requests AND did not complete a legacy handshake |
Not one of the 16 was classified as speaking 2026-07-28. The rule catalogue only permits a legacy classification when the initialize handshake actually succeeds, so a server that refuses both shapes is recorded as unknown rather than assumed to be old. That is conservative on purpose — but it means 12 of these are very probably legacy servers that also reject our probe for an unrelated reason, most often authorization.
Which rules failed, and how often
Counts are servers, not occurrences — a rule that failed twice on one server counts once. Every rule below links to the exact sentence of the specification it comes from.
| Rule | Servers | Share of the 16 measured |
|---|---|---|
| MCP-DSC-001 | 8/16 | 50% |
| MCP-AUT-006 | 6/16 | 38% |
| MCP-AUT-011 | 3/16 | 19% |
| MCP-AUT-004 | 2/16 | 13% |
| MCP-AUT-005 | 2/16 | 13% |
| MCP-AUT-001 | 1/16 | 6% |
| MCP-AUT-002 | 1/16 | 6% |
| MCP-AUT-003 | 1/16 | 6% |
| MCP-HDR-004 | 1/16 | 6% |
| MCP-HDR-007 | 1/16 | 6% |
| MCP-SEC-001 | 1/16 | 6% |
Seven of the eleven are authorization rules. That is worth reading carefully: it does not mean auth is the ecosystem's worst area, it means auth rules are the ones that can still be evaluated on a server that refuses everything else. A 401 with a discoverable metadata document is checkable without the server ever accepting a protocol request.
| Rule | What we check | Level | If it fails |
|---|---|---|---|
| MCP-DSC-001 | server/discover is implemented | MUST | fail |
| MCP-AUT-006 | WWW-Authenticate includes a scope parameter | SHOULD | warn |
| MCP-AUT-011 | AS supports Client ID Metadata Documents, not DCR alone | SHOULD | warn |
| MCP-AUT-004 | Each listed authorization server exposes RFC 8414 or OIDC discovery metadata | MUST | fail |
| MCP-AUT-005 | AS advertises authorization_response_iss_parameter_supported: true | SHOULD | warn |
| MCP-AUT-001 | Unauthenticated request returns 401 with WWW-Authenticate resource_metadata | MUST | fail |
What this cannot tell you
This is a sample of 16, not a census. The servers were hand-picked as recognisable public endpoints, which biases toward established projects. Do not read any figure here as “X% of MCP servers”.
Coverage was low. Median rule coverage was 2.5%, with a maximum of 45.6%. Most rules depend on a server answering a modern request, and most of these did not, so most rules were skipped rather than passed or failed. Aggregate outcomes across the run were 82 pass, 16 fail, 11 warn and 89 skip — the skip column is the story.
Every server was graded unrated for that reason. A grade requires enough of the catalogue to have been checked; unrated means too little was evaluated to judge, not that the server failed.
It is one moment in time. Probed on 2026-08-11, roughly two weeks after the revision shipped. Re-running this in three months is the interesting comparison, and we intend to.
Method
20 public MCP endpoints were probed once each. Four disallowed us in robots.txt and were not probed — the same rule the validator applies to any target. Every request went through SSRF admission control, and every probe is read-only: no tool is called, no resource is read, and requests needing a tools/call shape use a reserved sentinel name that cannot collide with a real tool.
Results were produced by the same validator the website runs, at ruleset version recorded with each run, and were manually reviewed — that review found and fixed three bugs before these numbers were published. The raw output and the review are in the repository.
FAQ
Frequently asked
How many MCP servers support the 2026-07-28 specification?
Of 16 public MCP servers we probed on 2026-08-11, none could be classified as speaking 2026-07-28. One answered both the legacy and modern request shapes, three were identifiably legacy, and twelve refused the modern requests without completing a legacy handshake either, so they could not be classified at all. This is a hand-picked sample of 16, not a census of the ecosystem.
What is the most common MCP compliance failure?
Requiring a session header the specification removed. 8 of the 16 servers we probed rejected a discovery request with an error such as "Bad Request: Mcp-Session-Id header is required". The 2026-07-28 revision removed protocol-level sessions and the initialize handshake, so a modern client never sends that header.
Why are so many results marked unrated?
Because a grade requires enough rules to have been checked. Median coverage across these 16 servers was 2.5% — most refused the modern requests that the majority of rules depend on, so there was nothing to grade. An unrated result means too little could be evaluated to award a grade, not that the server failed.
Can I check my own MCP server against these rules?
Yes, free and without an account. Paste a server URL into the validator and it reports every rule as pass, warn or fail, each linked to the exact sentence of the specification it comes from. The same checks run from the command line with npx createmcps validate.
Measure your own server
These are other people's servers. Point the validator at yours and it reports every rule as pass, warn or fail, each linked to the specification sentence behind it.
Validate a server →