GAIP Agent Observatory
State of public AI agents, October 2026
What GAIP observed across public MCP servers and A2A agents: how many answered, which protocol versions they report, how many ask for credentials and which discovery standards hosts publish. Aggregate facts only; no party is scored or ranked.
GAIP Agent Web Index — October 2026 (provisional: the month has not ended)
Declared versus observed: what public AI agents declared and what changed this month. Beside each: the frozen panel AGENTS-COHORT-2026-10, 4157 public MCP servers and A2A agents on 3677 hosts. Registry size: the Official MCP Registry listed 44477 server entries in GAIP's last complete walk this month (completed 2026-10-17), 27634 of them with a remote endpoint GAIP can read. Aggregates only: a count is shown only when it and its total are at least 5; no host, agent or caller is named; facts are as observed by GAIP at the stated time and assess no one. A month is final only after it ends; until then it is provisional.
| Figure | All watched agents | Out of | Panel AGENTS-COHORT-2026-10 | Out of |
|---|---|---|---|---|
| Agents whose declared tools changed | not available this month | every public MCP server and A2A agent GAIP watched when this copy was built (all sources; hosts an outside caller asked about and GAIP's own agents left out); the agents counted are among them | 472 of 4157 (11%) | every member of the frozen panel AGENTS-COHORT-2026-10 |
| Hosts whose declared terms, limits or prices changed | 928 of 10745 (9%) | every public host whose declared terms GAIP read this month (hosts an outside caller asked about and rows under a method version with a known defect left out) | 336 of 1794 (19%) | panel hosts whose declared terms GAIP read this month (agent_terms rows) |
| Agent cards carrying a signature | 60 of 806 (7%) | every public host whose A2A agent card GAIP read this month (latest read; hosts an outside caller asked about and rows under a method version with a known defect left out) | 40 of 487 (8%) | panel hosts whose A2A agent card GAIP read this month (latest read) |
| Most frequent failure types diagnosed for outside callers | too few diagnoses to show (under 5 per type) | front-door gaip_diagnose answers to outside callers this month | ||
| Hosts carrying any AI-preference signal | 2140 of 21601 (10%) | every agent host whose robots.txt or responses GAIP read this month (latest read; hosts an outside caller asked about and rows under a method version with a known defect left out) | 365 of 3487 (10%) | panel hosts whose robots.txt or responses GAIP read this month (latest read) |
| Agent prices (x402 Bazaar listings) | not collected yet (switched off until the founder confirms the source terms) | |||
| ERC-8004 agent registration files | not collected yet (switched off until the founder confirms the source terms) | |||
| Reachability and response times (the 30 days to 21 October 2026) | 97.1% of 109077 visits reachable; 93.1% of 20208 agents reachable on at least 95% of visits; response time p50 231 ms, p95 1150 ms | |||
| Reachability and response times, panel AGENTS-COHORT-2026-10 | 97.6% of 63829 visits reachable; 92.2% of 3795 agents reachable on at least 95% of visits; response time p50 227 ms, p95 1128 ms | |||
What agents ask for, depend on and who runs them (latest frozen week, all watched agents): Agents whose tools ask for personal, payment or secret data (by field category): 2444 of 10594 (23%); Agents asking for payment card fields: 6 of 10594 (0%); Agents asking for email fields: 1375 of 10594 (13%); Agents asking for phone fields: 549 of 10594 (5%); Agents asking for credentials fields: 651 of 10594 (6%); Agents asking for precise location fields: 461 of 10594 (4%); Agents whose declarations point to an outside domain: 10753 of 23609 (46%); Declared operators: 18076; agents run by the 10 largest: 1288 of 23508 (5%).
Cite as: GAIP Agent Web Index, October 2026, gaipagents.com/state-of-agents?month=2026-10, CC BY 4.0. Machine-readable: /v1/free/agent-web-index. How to reproduce each figure: /v1/free/agent-web-index/queries.
Reachability and response times: the 30 days to 21 October 2026 (provisional)
Aggregate facts observed by GAIP at the stated times: how often public agents answered and how fast. Not an assessment of any party; no agent or host is named. Cells under 5 agents are withheld.
| Cohort | Protocol | Figures |
|---|---|---|
| All public agents | MCP and A2A | 97.1% of 109077 visits reachable; 93.1% of 20208 agents reachable on at least 95% of visits; response time p50 231 ms, p95 1150 ms |
| All public agents | MCP | 97.0% of 99075 visits reachable; 93.1% of 19298 agents reachable on at least 95% of visits; response time p50 241 ms, p95 1184 ms |
| All public agents | A2A | 98.2% of 10002 visits reachable; 93.1% of 910 agents reachable on at least 95% of visits; response time p50 178 ms, p95 792 ms |
| Panel AGENTS-COHORT-2026-10 | MCP and A2A | 97.6% of 63829 visits reachable; 92.2% of 3795 agents reachable on at least 95% of visits; response time p50 227 ms, p95 1128 ms |
| Panel AGENTS-COHORT-2026-10 | MCP | 97.4% of 54924 visits reachable; 91.6% of 3334 agents reachable on at least 95% of visits; response time p50 244 ms, p95 1174 ms |
| Panel AGENTS-COHORT-2026-10 | A2A | 98.9% of 8905 visits reachable; 96.3% of 461 agents reachable on at least 95% of visits; response time p50 176 ms, p95 799 ms |
Cite as: GAIP Agent Reliability Index, the 30 days to 21 October 2026, gaipagents.com/state-of-agents, CC BY 4.0. Downloads: CSV · JSON.
Collection record
When GAIP's Observatory was running, from its own daily ledger (since 2026-10-04; 17 days frozen and hash-chained, head 00b4bc9e7c7e61d9a8215b4b0ffdaa5d30c5a37243196993a7ecc3a79c778a6d).
Last 30 days: 17 days, 1755 ticks, 15 days fully covered; a tick started in 98.8% of 15-minute windows. Gaps (no tick start for more than 30 minutes): 1.
- 2026-10-09T16:34:12Z to 2026-10-09T17:32:32Z (58 min)
Known gaps (register, append-only):
- 2026-10-02T23:16:00Z to 2026-10-03T07:52:15Z (times partly estimated): Observatory observations: every tick claimed and observed 0 targets (tick lines showed budget_exhausted or TimeoutError), so no status observations, manifest changes or capability records were written. Cause: Registry walks read up to 20 pages from one host while the outbound gate allows 10 requests a minute per host; the 11th page raised _BudgetExhausted out of the walk, the cursor was never saved and the cycle returned before observing, on every tick (the refresh livelock). Fixed by PR #824.
- 2026-10-01T21:09:04Z to 2026-10-03T10:02:34Z (times partly estimated): About 75% (estimate) of shop-host AI-permission facts (ai_permissions dataset, shop hosts) were evicted from an in-memory queue before they were written; the rest were written. Cause: The in-memory buffer evicted entries waiting for an extra read before they were written; the shop panel did not read tdmrep.json itself. Fixed by PR #826.
- 2026-10-03T16:55:00Z to 2026-10-03T17:14:00Z (times partly estimated): One Observatory tick observed nothing: the tick right after the data5 deploy ended with DatabaseError. Cause: Deploy overlap during the PR #843 deploy (as recorded in the handover); no code fix was needed, the next tick was clean.
- 2026-09-28T00:00:00Z to 2026-10-01T19:30:20Z (times partly estimated): No independent daily timestamp (Sigstore/Rekor anchor) of the history log's chain head was kept for 28, 29 and 30 Sep 2026 or the morning of 1 Oct. The history log itself kept every entry; the 1 Oct anchor's chain head covers every entry before it, so those entries are dated no later than 1 Oct by an outside witness, not day by day. Cause: The anchor workflow's runs on 28 Sep failed twice and were then cancelled; it ran on GitHub Actions only on a push or by hand until the COO schedule dispatcher began running it daily on 1 Oct 2026 (moat moves), and dated anchor files began the same day (record durability).
Method: collection ledger and known gaps. Downloads: collection-ledger.csv · collection-ledger.json.
Week 2026-W42 (frozen)
| Public AI agents and MCP servers in the Observatory | 23767 |
|---|---|
| Observed this week | 21513 |
| Answered at least once | 16010 of 21513 (74%) |
| Median response time (ms) | 231 |
| MCP servers that asked for credentials | 4619 of 20632 (22%) |
| MCP servers listing tools without credentials | 10592 of 20632 (51%) |
| New this week | 3096 |
| Published a new manifest version | 4788 |
| Hosts probed for discovery standards | 0 |
| Protocol versions reported | 0.2.5: 5, 0.3: 23, 0.3.0: 341, 1.0: 101, 1.0.0: 12, 2024-11-05: 480, 2025-03-26: 498, 2025-06-18: 1592, 2025-11-25: 6806, 2026-07-28: 124, other_categories_under_5_each: 14 |
This week so far (2026-W43, provisional)
| Public AI agents and MCP servers in the Observatory | 24498 |
|---|---|
| Observed this week | 15338 |
| Answered at least once | 11441 of 15338 (75%) |
| Median response time (ms) | 234 |
| MCP servers that asked for credentials | 3390 of 14429 (23%) |
| MCP servers listing tools without credentials | 7242 of 14429 (50%) |
| New this week | 731 |
| Published a new manifest version | 1998 |
| Hosts probed for discovery standards | 0 |
| Protocol versions reported | 0.2.5: 5, 0.3: 22, 0.3.0: 334, 1.0: 97, 1.0.0: 19, 2024-11-05: 282, 2025-03-26: 238, 2025-06-18: 1155, 2025-11-25: 4705, 2026-07-28: 103, other_categories_under_5_each: 12 |
Delivery outcomes, 2026-10
What happened to calls outside callers made to GAIP's own public agents this month, and the verdicts of the Witness delivery checks they asked for. Counts about GAIP's own service only; no caller or third party is named. A share is shown only when both numbers are at least 5.
Outside calls: 2017
| Error | 85 of 2017 (4%) |
|---|---|
| Blocked | 664 of 2017 (33%) |
| Completed | 941 of 2017 (47%) |
| Needed more input | 327 of 2017 (16%) |
| GAIP agent | Outside calls | Completed | Needed more input | Blocked | Error |
|---|---|---|---|---|---|
| witness | 104 | 37 | 0 | 63 | 0 |
| front-door | 3 | 0 | 0 | 0 | 0 |
| unattributed | 1434 | 800 | 327 | 226 | 81 |
| trust-assurance | 36 | 26 | 0 | 10 | 0 |
| listing-observer | 3 | 0 | 0 | 0 | 0 |
| integration-repair | 8 | 0 | 0 | 5 | 0 |
| procurement-verify | 285 | 0 | 0 | 284 | 0 |
| integration-protocol | 144 | 73 | 0 | 71 | 0 |
Witness delivery checks: 0
| Met the registered terms | 0 of None |
|---|---|
| Did not meet the registered terms | 0 of None |
| Could not be decided | 0 of None |
Outcome ledger, 2026-10
GAIP's own outcome ledger: one row per month of what happened in agent work GAIP saw, for outside callers only, frozen after the month ends and hash-chained to the month before (never changed or deleted; the chain head is signed in the daily Sigstore anchor). Counts only; categories under 5 are folded together; no caller or third party is named.
This month's row is frozen once the month has ended (from 1 November 2026).
Agentic-commerce shop panel, week 2026-W42
A fixed panel of 392 online shops (cohort shops-2026-10), read once a week: which agent-commerce discovery documents they publish and whether product prices and stock agree across a page, its structured data and the shop's UCP catalog. No shop is named; shares are shown only when both numbers are at least 5.
Shops observed: 326
| UCP profile (/.well-known/ucp) | 209 of 326 (64%) |
|---|---|
| /.well-known/x402 | 0 of 326 |
| llms.txt | 198 of 326 (61%) |
| A2A agent card | 0 of 326 |
| x402 payment request on the declared UCP endpoint | 0 of None |
| Products read | 258 |
| Price agreement across sources | SAME: 175, NOT OBSERVED: 78, other categories under 5 each: 5 |
| Stock agreement across sources | SAME: 105, NOT OBSERVED: 151, other categories under 5 each: 2 |
Cohort shops-2026-Q4
15759 shops drawn by region and platform with a published seed; shops observed this week: 13339
| UCP profile (/.well-known/ucp) | 213 of 13339 (2%) |
|---|---|
| /.well-known/x402 | under 5 of 13339 (not shown) |
| llms.txt | 1654 of 13339 (12%) |
| A2A agent card | 16 of 13339 (0%) |
What agents changed this week (2026-W42, frozen)
Changes to what public MCP servers and A2A agents declare, by kind. A change of the protocol version an agent answered with is not counted as the agent changing what it offers; it is shown on its own line. A substantive change is silent when no declared version (registry or card version, server version) moved that week. Observed at the stated time; no agent is named. Kinds with fewer than 5 agents show as under 5.
| Agents | All watched | Panel AGENTS-COHORT-2026-10 |
|---|---|---|
| Agents watched | 23767 | 4145 |
| Agents that changed what they declare (protocol-version-only changes left out) | 2329 of 23767 (10%) | 394 of 4145 (10%) |
| Agents whose only change was the protocol version they answered with | 6 of 23767 (0%) | 2 of 4145 |
| Agents with a substantive change (tools, descriptions, formats, labels, sign-in, terms, endpoint) | 1575 of 23767 (7%) | 250 of 4145 (6%) |
| Of those, changed without any declared version change (silent) | 986 of 1575 (63%) | 176 of 250 (70%) |
| Tools added | 619 | 76 |
| Tools removed | 119 | 20 |
| Tool descriptions re-worded | 1121 | 189 |
| Input or output format changed | 902 | 131 |
| Behaviour labels changed (read-only, destructive and similar hints) | 185 | 18 |
| Sign-in requirements changed | 19 | 5 |
| Terms or prices changed | 6 | under 5 |
| Endpoint moved to another host | 5 | under 5 |
| Declared version changed | 1272 | 200 |
| Protocol version changed | 39 | 9 |
| Tools per MCP server | 0: 7, 1: 665, 2-5: 4283, 6-10: 3030, 11-20: 1658, 21-50: 1016, 51-100: 213, 101 or more: 43 |
|---|---|
| Tools marked read-only (readOnlyHint) | 70098 of 110362 (64%) |
| Tools marked destructive (destructiveHint) | 57612 of 110362 (52%) |
| MCP servers declaring an output format on a tool | 3194 of 10908 (29%) |
| MCP sign-in asked for in the registry entry | other header: 238, none declared: 14605, authorization header: 2304, api key or token header: 628 |
| A2A sign-in scheme types | http: 62, x402: 19, apiKey: 98, oauth2: 15, httpAuth: 39, none declared: 66, other categories under 5 each: 8 |
| A2A cards mentioning x402 | 283 of 821 (34%) |
| Registry entries this week (new, changed, removed) | 3096, 1781, 196 |
Long-run records, week 2026-W42
Four dated, hash-chained records GAIP keeps for the long run: the public keys agent hosts publish, what sites tell AI systems they may do with their content, how AI clients behave at GAIP (by client family only) and what agent services promise and charge; and the public npm and PyPI facts of MCP server packages with the security advisories OSV publishes for them (maintainers counted, never named). No host, package or client is named; shares are shown only when both numbers are at least 5.
| Agent hosts with a key history this week | 4675 |
|---|---|
| Agent cards carrying a signature | 48 of 660 (7%) |
| Agent hosts publishing /.well-known/jwks.json | 155 of 3693 (4%) |
| Panel shops blocking at least one AI crawler from the home page | 428 of 8614 (5%) |
| Panel shops with a Content-Signal ai-train=no | 58 of 8614 (1%) |
| Panel shops publishing a TDMRep reservation file | 1 of 8936 |
| Agent hosts declaring terms, limits or prices | 8697 |
| Client families seen at GAIP (5+ requests) | 7 |
| MCP server packages (npm, PyPI) recorded this week | 4955 |
| Packages whose latest version declares install scripts | 118 of 4943 (2%) |
| Packages whose latest version has provenance | 2657 of 4939 (54%) |
| Packages with a published advisory affecting the latest version | 0 of 4955 |
AI-preference signals, 2026-10
How many hosts carried each machine-readable AI-preference signal when GAIP last read them this month: agent hosts (the Observatory's MCP servers and agents) and the fixed shop panel. Observed at the stated time; no host is named and nothing here assesses a site. A count is shown only when it and its total are at least 5. Parser: aipref-signals (MIT), following draft-ietf-aipref-vocab-08 (14 Sep 2026).
| Signal | Agent hosts | Panel shops |
|---|---|---|
| IETF AI preferences (Content-Usage) | 35 of 21600 (0%) | under 5 |
| IETF AI preferences: training refused | 9 of 21600 (0%) | under 5 |
| RSL licence link | 37 of 21600 (0%) | under 5 |
| W3C TDMRep file (tdmrep.json) | under 5 | under 5 |
| W3C TDMRep header | 30 of 21600 (0%) | 6 of 13072 (0%) |
| Content Signals | 2099 of 21600 (10%) | 222 of 13072 (2%) |
| Content Signals: ai-train=no | 688 of 21600 (3%) | 180 of 13072 (1%) |
| Any of these | 2140 of 21600 (10%) | 230 of 13072 (2%) |
What agents ask for, depend on and who runs them, week 2026-W42
Derived from what public MCP servers and A2A agents declared: the categories of data their tools' input fields ask for (counted by field category, never field names or text), the outside domains their declarations point to (well-known services named, others only counted) and how concentrated their declared operators are (no operator named). Not an assessment of any agent or operator.
- Agents whose tools ask for personal, payment or secret data (by field category): 2444 of 10594 (23%)
- Agents asking for payment card fields: 6 of 10594 (0%)
- Agents asking for email fields: 1375 of 10594 (13%)
- Agents asking for phone fields: 549 of 10594 (5%)
- Agents asking for credentials fields: 651 of 10594 (6%)
- Agents asking for precise location fields: 461 of 10594 (4%)
- Agents whose declarations point to an outside domain: 10753 of 23609 (46%)
- Most shared outside services: github.com (10445 of 23609 (44%)), gitlab.com (65 of 23609 (0%)), supabase.co (9 of 23609 (0%))
- Declared operators: 18076; agents run by the 10 largest: 1288 of 23508 (5%)
Cite this
GAIP Agent Observatory, State of public AI agents, October 2026. https://www.gaipagents.com/state-of-agents?month=2026-10 (weekly snapshots 2026-W41, 2026-W42; latest SHA-256 6ead3cf7c37f5f4e1efd167e9b6dc883f43c76fa58c01c3263ca7b95e4972a7e) Capability change-log head SHA-256 46fbf546079dbe3afb93c87d107bbdf70269c4c0c029b3d1f54659f67c6309d3 (41441 entries).
Machine-readable: /v1/free/state-of-agents. Weekly snapshots, hash-chained: /v1/free/ecosystem/snapshots. Method: /methodology. Aggregate figures are licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/): reuse them freely with credit to the GAIP Agent Observatory and the citation shown. Founder decision #13, 1 Oct 2026.