Method

A read-only connector tries each endpoint, records what answers and never calls a tool. A server counts only if the connector lists its tools; a sign-in challenge is shown separately and not counted. This page gives the status words, the six allowed methods, the host rubric, the crawl slice and the limits of the data.

What counts as an MCP server

Only a server whose tools the connector listed counts as having an MCP server: 263 of 1,336. A sign-in challenge is its own state, "sign-in required, tools not seen, not counted" (533 rows), because the connector never signs in and so confirmed nothing behind it. A credential wall without OAuth metadata is not counted either, because the same answer comes from any protected API. 472 rows have no endpoint on record, so nothing was connected for them; the other 864 were tried and 852 answered at all (the rest failed before any HTTP answer). "With neither" in the count line means no counted MCP server and no CLI on record: 1,044 companies. Counting OpenAPI as well, 952 companies have none of the three.

How the connector checks

1. Take the endpoint a source lists. For Developer Tools and Infrastructure rows with no listed endpoint whose mcp.<domain> subdomain resolved in DNS, the seed script added mcp.<domain>/mcp as a guess; a row that listed tools is labelled "endpoint found by subdomain guess, verified by connecting", and a row that only answered with a sign-in challenge is labelled "endpoint found by subdomain guess; it answered with a sign-in challenge and was not verified". No other row without an endpoint was guessed, and a row with no endpoint is not connected at all.
2. Open a Streamable HTTP session with protocol revision 2026-07-28, fall back to 2025-11-25, then to the legacy SSE transport. Time out after 15 seconds.
3. If the server answers 401 or 403, read the WWW-Authenticate header and the OAuth metadata at the protected resource and authorization server paths. Record the auth type: none, API key, OAuth with client registration, or OAuth without. Stop there.
4. If the server answers without credentials, list tools, resources and prompts. Record the counts and up to 40 tool names.
5. Write a log line for every connection with the time, the methods sent, the result and the duration. The entry page shows it.

The allowlist of methods

The connector never sends tools/call, resources/read, prompts/get or any method that acts. A method outside the allowlist throws before any request leaves, and a test asserts the list. The 2026-07-28 revision replaces initialize with server/discover, which is also read-only; it joins the allowlist from the next run, and servers on the new revision were reached through the fallback in this edition. The connector's source and its test are in the repository.

The host and registry rubric

AI gateways are scored on five lines of their own: protocols fronted, auth passthrough, caching, pricing, observability. Every cell carries the evidence, a source link and the date read. A cell changes only with a source. See the scores.

The crawl slice

The census and the WebMCP, A2A and OpenAPI columns come from the shared crawl of 4 November 2026: 13,071 domains, last request 2026-11-04 20:16 UTC. 830 directory companies are in it. The slicing script, scripts/slice-crawl.mjs, and a test that recomputes a headline number are in the repository. The census gives the rules for counting a file as found.

Ora on this layer

Ora's public check catalog (GET /api/checks, contract 1.38.0, read 5 November 2026) lists 132 checks in four layers: Discovery 16, Access 42, Usability 68 and Payments 6, weighted 20, 30, 40 and 10 points of 100. Usability is the layer closest to this directory: whether an agent can use what it finds, through an MCP server or a CLI, an API with OpenAPI, and sign-in an agent can finish. The Usability count was 62 when this directory first read Ora's methodology on 4 November 2026 and is 68 in the catalog read on 5 November 2026, a reminder that Ora's checks move. These are Ora's published figures, not this directory's.

28 of the 132 checks apply to an MCP server URL. Ora is the check this directory recommends for testing a server; the reasons, the limits and the alternatives are on their own page, and the 28 checks are listed. Ora's Journey runs a real agent against a domain with an intent such as finding pricing and records every step, stall and outcome, which is the check for whether the surfaces listed here work in practice.

The Ora score column in the directory is Ora's own cached score for each company's domain, read on 5 November 2026: 323 through GET /api/score/{domain} and 610 from the same day's GET /api/leaderboard, with no scan triggered and a blank cell where Ora has none. Ora is also a row in the directory like every other company, verified the same way; its MCP server and tools. To check your own site, run Ora's scan at ora.ai or npx ax audit yourdomain.com, and see the CLI guide for how that command is documented.

Logos

A logo appears next to a company only where an official one exists: a mark from the simple-icons package (CC0) whose own source page belongs to the company's domain, a mark for the company's other domain from a short reviewed table, a mark accepted after a recorded hand review of the company's name, site and the icon's source (data/logo-reviews.json), or the company's own published file fetched once. A mark that a review found to belong to another entity is rejected and the name stands alone. Each logo's source and basis are in the repository's data/logo-sources.json; the marks remain the property of their owners.

The API, the MCP server and the ask endpoint

The rows the pages show are also served to agents three ways, documented on the API and MCP server page: an MCP server at /mcp (Streamable HTTP, five read-only tools over the directory rows and the census), a REST API under /api/v1/ described by openapi.json, and an NLWeb /ask endpoint that searches the rows and pages and returns schema.org objects with a source URL each. Every surface reads the published files in /data when a request arrives and keeps each file for ten minutes per running instance, so an answer and the page it cites come from the same edition and follow the same counting rule: only a server whose tools the connector listed counts. The surfaces never call a company's server, nothing writes and nothing needs a credential; auth.md says so.

What this directory does not do

• It does not call a tool, sign in, register a client or submit a form on any server.
• It does not prove that a company has no server. A "none found" row means no source read for this edition names an endpoint.
• The CLI column is a floor: a package is checked only where a source names one.
• Categories follow Ora's leaderboard where the company is scored there, and a registry description elsewhere. The fact sheet on each entry says which.
• Rows are discovered from the official MCP Registry, the GitHub MCP Registry, the awesome-remote-mcp-servers list, vendor documentation and Ora's leaderboard, so companies outside those lists are missing. Platform domains that host other people's sites are not listed as companies.
• Markdown copies are reached through each page's rel="alternate" link and the .md path (/<path>/index.md). On the Lovable host, prerendered pages are served before any worker runs, so Accept: text/markdown negotiation is not available there; the Vercel preview negotiates it in a root middleware that serves the twin.
• The site's own MCP server serves this directory read-only and is not a row in it, because the directory lists companies and not this publication. It cannot call a tool on a company's server, sign in or submit a form, and it adds no data that the pages do not show. See the API and MCP server page.