The MCP registry points at 13,698 GitHub repositories. About one in seven is not there.

2,049 of 13,698 GitHub repositories named by registry entries return NOT_FOUND. 11,649 resolve. Zero were left unanswered. Behind those 2,049 repositories sit 2,294 registry entries pointing somewhere a client cannot follow.

Why this figure is published rather than withheld. In July we published a number of exactly this shape, that 37.8 percent of registry-named npm packages returned 404, and retracted it the same day. It was wrong by about 43 times, because the measurement could not tell the server said no from we never got an answer. So this one had to clear three gates.

Three outcomes, never two. PRESENT, ABSENT and UNKNOWN stay distinct throughout, and nothing downstream may count UNKNOWN as ABSENT. In this run UNKNOWN was zero.

An independent method, with a control stratum. A seeded random sample of 40 repositories from each stratum was re-probed through anonymous, unauthenticated HTTPS to github.com: no token, no GraphQL, nothing shared with the first method. 40 of 40 suspects confirmed unreachable and 40 of 40 controls confirmed reachable. The control is the part that matters: had repositories we believe are present come back missing, the method would be broken and this section would say so.

That also rules out the specific error that would have inflated the number. GitHub redirects a renamed repository and the GraphQL lookup does not follow the redirect, so renames could have been counted as deletions. A renamed repository would have answered 200 to the anonymous probe. None did.

A skew check. The npm error survived because nobody asked whether the missing set looked different from the present set. It did. So: the 2,049 absences are spread across 1,601 distinct owners, and 93.9 percent of those owners have exactly one. The five largest account for 14.3 percent. This is a broad condition, not one bulk publisher deleting an account.

What absent does and does not mean. The declared URL is not publicly resolvable now. It does not distinguish a deleted repository from one made private from one moved without updating the registry. All three leave a client following a dead link, which is the practical point, but they are different causes and we did not measure which.

Across the 11,649 resolvable repositories there are 1,606,763 stars, and almost none of them belong to MCP servers.

An honest correction to our own headline. The median of zero is partly an artifact. Excluding the single largest bulk publisher, the median rises to 1 and the zero-star share falls from 52.0 percent to 46.4 percent. The concentration finding survives that adjustment. The median does not survive it cleanly, and quoting "the median MCP server has zero stars" without this sentence would mislead.

Stars measure attention, not use. A zero-star repository may be used heavily inside one company. What the distribution does show is that the registry is not a ranked market: a client picking a server by any popularity signal is choosing among a few hundred repositories, not eighteen thousand.

One owner publishes 1,270 servers, each from its own separate repository, every one at zero stars. That is 9.9 percent of all servers whose repository resolves, from a single account.

This is the same distortion our version-counting finding described, arriving from a different direction. A headline count of registry entries is not a count of servers, and a count of servers is not a count of the people building them.

Individual accounts own 61.7 percent of resolvable repositories against 38.3 percent for organizations, roughly three to two. Against the obvious expectation, the individually-owned ones are pushed to slightly more recently (median 26 days against 31) and carry slightly more attention (median 1 star against 0).

This finding argues against our own earlier piece, which is why it is here. Measuring the registry against itself showed 60.7 percent of servers published exactly once and never updated, which reads as an ecosystem of abandonware. The repositories tell a different story.

A server published once can still live in a repository under active development. "Published one version" measures registry behaviour; it does not measure abandonment, and we should not have let it imply that. Only 2.9 percent of these repositories have been untouched for half a year.

The two findings coexist without contradiction: the code is alive, the registry entries are stale, and fifteen percent of the links are dead.

There is an open proposal to add health metadata to registry entries, and another to add a verified-publisher field. Both argue that a client cannot currently evaluate a server before connecting to it. The evidence in the first is a hand-scan of ten servers.

This is the same argument at population scale. One in seven declared repositories is already unreachable, and nothing in the registry surfaces that. A client resolving a source link today has about an 85 percent chance of finding anything at the end of it.

1. Crawl the registry, cursor-paged, no auth. Every record is a version, so collapse to one row per server name, preferring the record flagged latest.
2. Read each server's declared repository URL where the source is GitHub. The URL is authoritative and the server name is not. The reverse-DNS name looks like it encodes a repository, but the trailing segment is the server's name and need not match one. Deriving repositories from names would have invented repositories that do not exist, which is the npm error in different clothes.
3. Resolve in batches of 50 aliased lookups over GitHub GraphQL: about 275 requests instead of 13,698, which matters when the limit is 5,000 an hour and the API belongs to someone else.
4. Verify as described in section 1. Reproduce that step with node scanners/mcp_github_verify.mjs <repos.json> --n 40 --seed 20260727. The seed is fixed so the sample is checkable rather than merely claimable, and the per-repository rows are in the open dataset.

Total external requests: 595 registry pages, 275 GraphQL queries, 80 anonymous verification probes spaced 1.2 seconds apart. No rate limit was worked around and no deprecation was retried past.

• Stars measure attention, not use.
• Absent does not distinguish deleted from renamed from made-private.
• The registry is self-declared throughout. A repository URL is a publisher's claim.
• The 3,240 servers declaring no repository are excluded from every repository figure and counted separately, not silently dropped.
• Nothing here probes whether a server actually runs. That is a different measurement, and it is what the health proposal is asking for.