An observation record, not an assessment. Every row below is a change we recorded directly, with the content hash before and after. https://api.x-402.online/mcp
6 of these transitions happened while the reported version string stayed the same. A consumer pinning that version would have received a different tool surface with nothing in the version to indicate it. That is a compatibility and review fact, not a security finding and not an allegation of wrongdoing — unversioned iteration is normal practice and is frequently deliberate.
| observed at (UTC) | change | version signal | reported version | tools | surface hash |
|---|---|---|---|---|---|
| 2026-10-04 01:12:58Z | SURFACE_CHANGED | SILENT — version string did not move | 1.0.0 (unchanged) | +classify +publish | 8b1399d3c5c4 → 5377271203d3 |
| 2026-09-30 13:40:03Z | SURFACE_CHANGED | SILENT — version string did not move | 1.0.0 (unchanged) | +callbacks | b8d465bc1c86 → 8b1399d3c5c4 |
| 2026-09-27 19:40:02Z | SURFACE_CHANGED | SILENT — version string did not move | 1.0.0 (unchanged) | +site_agent-readiness +token_verdict | 69f9c81c7a41 → b8d465bc1c86 |
| 2026-09-27 13:40:04Z | SURFACE_CHANGED | SILENT — version string did not move | 1.0.0 (unchanged) | +crypto_funding-rate +crypto_market +fx_rates +stablecoins +token_price-history | d36f25992519 → 69f9c81c7a41 |
| 2026-09-25 19:40:04Z | SURFACE_CHANGED | SILENT — version string did not move | 1.0.0 (unchanged) | +apify_preflight +chain_abi +chain_ens +crypto_news +eu_mica-check +markets_prediction +route_directions +url_unwrap +vin_decode +vision +wiki_summary −extract-structured −fr_analyse-immo −fr_biens-sous-cotes −fr_bilans −fr_concurrents −fr_due-diligence −fr_enrich −fr_entreprise-360 −fr_entreprise-360_partial −fr_estimation-immo −fr_etude-implantation −fr_immo −fr_kyb_partial −fr_leboncoin −fr_marches-publics −fr_qualified-leads −fr_reseau-dirigeant −fr_score-entreprise −fr_score-entreprise_partial −fr_seloger −fr_valorisation −fr_verif-artisan −guard −links −maps −meta −uk_company −uk_company-check −uk_officers −uk_psc −unblock −us_filings −us_financials −us_snapshot | b76ba14e51cc → d36f25992519 |
| 2026-09-25 13:40:03Z | SURFACE_CHANGED | SILENT — version string did not move | 1.0.0 (unchanged) | +image | 7760455342d4 → b76ba14e51cc |
This section is identical for ~92% of publishers and is published as
shared context, not as a finding about api.x-402.online. 90 dependency
packages sit beneath the measured MCP population; 41 have a
single maintainer and 31 have not published in over two years.
The widest is zod at
80.46% of npm-backed servers (8529 servers,
1 maintainer, last publish 2026-09-13).
These are properties of the shared SDK dependency closure. Any page claiming this set as
one operator's personal exposure is misreading a universal fact as a private one.
Source: state/mcp-census/chokepoint-maintainers.json, as_of 2026-10-07.
Observation window 2026-09-21 → 2026-10-10.
22,294 servers were observed; 2,214
were seen to change and 20,080 were observed and
recorded no change — that negative control is why a non-zero count here means something.
Across the corpus, 4,781 of
6,334 changes carried no version signal, and
1,690 of those added or removed tools.
What this does NOT cover: servers outside the observed set; changes that
occurred before 2026-09-21; changes that began and reverted between two observations;
and any server reachable only with credentials we do not hold. A server's absence from this
record is not evidence it did not change — only that we did not observe it.
Universe captured 2026-10-10T19:40:03.823Z. Produced by core/surface_history_page.cjs (reads core/surface_clock producers).
Hashes are of the served tool surface and are recomputable from the server's own response.