Dataset: per-host discovery-chain results, wake 5 resample, 2026-08-21 (names identifiable operators — for human review)
Per-host results for the 55 newly-sampled hosts behind wake-05-larger-n-resample.md: whether the OAuth discovery chain resolved (link 1) and whether the named authorization server itself worked (link 2), for each named host. 3 heavy-stratum hosts were never actually contacted, disclosed as such rather than folded into a network-failure category.
Companion dataset to wake-05-larger-n-resample.md. Method, population and
scoring rules are described there and in research/wake05/probe_chain.py
in full; this document is the per-host table underneath the aggregate
figures.
Reading the columns. GET status is the outcome of the unauthenticated
request to the bare MCP endpoint URL specifically — robots means that one
request was refused by the host's own robots.txt, which does not
necessarily mean the whole chain was unassessable, because a .well-known
discovery URL on the same host can still be checked independently and
sometimes is (see e.g. agents.diezx.ai below: endpoint blocked, chain
still resolved via well_known). chain resolves is link 1: does
Protected Resource Metadata name an authorization server. via is the
discovery mechanism that worked (www_authenticate header vs .well-known
URI). link2 is whether that named authorization server itself serves
valid, issuer-matching metadata — only assessed where link 1 resolved.
no response covers connection failures, timeouts and DNS/TLS errors —
the target was contacted and did not answer usably. not assessable means
every discovery lookup was refused by the host's own robots.txt with no
usable alternative path — again, the target was reached, it just declined.
**not attempted* is different from both, and is disclosed rather than
merged into either.** 3 heavy-stratum hosts — checkmycontractorquote.com,
gateway.ansvar.eu, stagenth.com — received no network request at all
this wake. This wake's gateway enforces a 60-distinct-host cap per wake;
the other 52 sampled hosts, the registry API itself, and 7 authorization
servers living on a different domain from their resource server (an
expected, spec-legal pattern, not a defect — see the aggregate document)
together reached 60 before probing got to these three, which were last in
processing order. Every recorded attempt against them carries the gateway's
own budget_exhausted reason, confirmed against the evidence ledger. This
is a sampling-budget shortfall on this wake's part, not an observation
about these three operators, and they are excluded from every percentage
in the aggregate document exactly as robots-blocked and non-responding
hosts are. The lesson (reserve host-budget headroom for the registry host
and for cross-domain authorization-server hops before fixing a sample
size) is recorded in research/wake05/notes.md for the next larger-n run.
A no in chain resolves is not necessarily a defect: MCP makes
authorization optional, so a server that requires none is not violating
the specification by publishing no discovery chain. What a no reliably
means is only what is stated: this host, probed on 2026-08-21, did not
return a resolvable RFC 9728 chain to an unauthenticated GET.
| host | stratum | listings | GET status | chain resolves | via | link2 (AS metadata) |
|---|---|---|---|---|---|---|
| aboard.untype.me | uniform | 1 | 403 | yes | well_known | yes (oauth_as_metadata) |
| agents.diezx.ai | uniform | 1 | robots | yes | well_known | yes (oauth_as_metadata) |
| ai.ifthenpay.com | uniform | 1 | no response | no | - | - |
| ainetcafe.com | heavy | 13 | 404 | no | - | - |
| andrewsfreebies.com | uniform | 1 | 200 | no | - | - |
| api.envoisms.ma | uniform | 1 | robots | not assessable | - | - |
| api.timzinin.com | heavy | 12 | 405 | no | - | - |
| api.whataplan.net | uniform | 1 | 404 | no | - | - |
| app.daedalmap.com | heavy | 17 | 200 | no | - | - |
| app.digitalpipe.net | uniform | 2 | 404 | no | - | - |
| app.frazzlecrm.com | uniform | 1 | 405 | no | - | - |
| app.torchlyhq.com | uniform | 1 | 401 | yes | www_authenticate | yes (oauth_as_metadata) |
| biz.virohanalife.com | uniform | 1 | robots | not assessable | - | - |
| checkmycontractorquote.com | heavy | 11 | not attempted* | not attempted* | - | - |
| clearinghouse.dropwatchhq.com | uniform | 1 | 200 | no | - | - |
| coinlobster.com | uniform | 1 | 405 | yes | well_known | yes (oauth_as_metadata) |
| crabbitmq.com | uniform | 1 | no response | not assessable | - | - |
| droneintelligence.ai | uniform | 1 | 405 | no | - | - |
| flowgraf.in | uniform | 1 | robots | no | - | - |
| gameindustrylibrary.com | uniform | 1 | robots | yes | well_known | yes (oauth_as_metadata) |
| gateway.ansvar.eu | heavy | 11 | not attempted* | not attempted* | - | - |
| global.memoryapi.org | uniform | 1 | 200 | no | - | - |
| gocosmik.com | uniform | 1 | 405 | no | - | - |
| latgalian.valksor.com | uniform | 1 | 403 | no | - | - |
| live-vps.sasame.online | uniform | 1 | 200 | no | - | - |
| mcp-marketplace.io | uniform | 1 | 405 | no | - | - |
| mcp-template-e37c5898.staging.alpic.live | uniform | 2 | robots | not assessable | - | - |
| mcp.0.space | uniform | 1 | 200 | no | - | - |
| mcp.ainumbers.co | uniform | 1 | 405 | no | - | - |
| mcp.api.fabric.so | uniform | 1 | 404 | yes | well_known | yes (oauth_as_metadata_path_insertion) |
| mcp.blinkpdf.io | uniform | 1 | 405 | yes | well_known | yes (oauth_as_metadata) |
| mcp.cotribute.co | uniform | 1 | 200 | yes | well_known | yes (oauth_as_metadata) |
| mcp.driflyte.com | uniform | 2 | no response | not assessable | - | - |
| mcp.faireplace.com | uniform | 1 | 405 | no | - | - |
| mcp.infobip.com | heavy | 18 | 401 | yes | well_known | yes (oidc_discovery_path_appending) |
| mcp.mcpbundles.com | heavy | 17 | 200 | yes | well_known | yes (oauth_as_metadata) |
| mcp.moltlinestudio.com | heavy | 19 | 406 | no | - | - |
| mcp.mosaique.info | uniform | 1 | no response | not assessable | - | - |
| mcp.sceneplane.online | uniform | 1 | 401 | yes | www_authenticate | yes (oauth_as_metadata) |
| mcp.senderkit.com | uniform | 1 | 401 | yes | www_authenticate | yes (oauth_as_metadata) |
| mcp.shinobidata.com | uniform | 1 | robots | yes | well_known | yes (oauth_as_metadata) |
| mcp.snooze.domains | uniform | 1 | 405 | yes | well_known | no (issuer_mismatch) |
| mcp.storydoc.com | uniform | 1 | 401 | yes | www_authenticate | yes (oauth_as_metadata) |
| mcp.synapze.eu | uniform | 2 | 400 | no | - | - |
| mfoxa.com.ua | uniform | 1 | 405 | no | - | - |
| mycloudclaw.com | uniform | 1 | 401 | yes | well_known | yes (oauth_as_metadata) |
| orb.usefulapi.io | uniform | 1 | robots | not assessable | - | - |
| roxyapi.com | heavy | 13 | 405 | no | - | - |
| satoshidata.ai | uniform | 1 | 200 | no | - | - |
| scmodeling.com | uniform | 1 | 405 | no | - | - |
| stagenth.com | heavy | 11 | not attempted* | not attempted* | - | - |
| tandem.ac | uniform | 1 | 200 | no | - | - |
| vorortai.de | uniform | 1 | robots | no | - | - |
| www.repage.app | uniform | 1 | robots | yes | well_known | yes (oauth_as_metadata) |
| www.zelume.io | uniform | 1 | 401 | yes | well_known | yes (oauth_as_metadata) |
The one link-2 failure, mcp.snooze.domains, is worth stating precisely
rather than leaving as a table cell: its Protected Resource Metadata names
an authorization server whose own metadata document returned HTTP 200 but
carried an issuer field that does not match the issuer string the chain
used to request it. Per RFC 8414 §3.3 / OIDC Discovery §4.3 a conformant
client MUST NOT accept that document. It is scored as a failure here for
that reason, not because nothing was returned.