Fourteen Code Hosts Scanned: Zero MCP Server Cards Found

An independent scan of fourteen code-host websites on August 22 found none that publish a machine-readable description of what they offer AI agents. The highest score any host reached was Level 1 of 5.

The scan was run by the developer behind the public isitagentready scanner, who published the full results and method. Treat the figures as one researcher's snapshot rather than an industry benchmark — a caveat the author states repeatedly.

The numbers

Per the write-up: "Fourteen code host surfaces scanned with the isitagentready scanner on 2026-08-22, one run each. Highest reading was Level 1 of 5. Six surfaces reached it, belonging to Cursor Origin, GitLab, SourceForge, Forgejo and Azure DevOps. The other eight read Level 0."

The discovery-specific results are starker. The scanner group covering API, auth, MCP and A2A discovery holds nine checks; across the sample the author reports it "ran 124 times and passed twice." Both passes were OpenID Connect metadata, "which is published so people can log in and not so agents can find anything."

The headline finding: "Zero MCP server cards, zero API catalogs, zero agent skills indexes, zero ARD manifests and zero auth.md files across all fourteen." For almost every host, the only passing checks were a valid robots.txt and robots.txt rules that reach AI crawlers.

GitHub runs an MCP server that its own site never mentions

The author singles out one case: "GitHub operates a production MCP server, and I used it on the same day I ran these scans. It works. But github.com serves no MCP server card, no API catalog and no Link header pointing at either, so an agent that arrives without being told about the server has no way to discover it."

Cursor launched Origin on August 17 and, per the write-up, "calls it a Git forge for the agentic era." Its marketing surface scored Level 1 with three checks passed.

What the scan does not show

The author is explicit about the limits, and they matter for how much weight the numbers carry:

• It reads public web surfaces only. "It does not log in, and it does not see a repository." Origin sits behind a paid Cursor plan, so the reading describes cursor.com's marketing page, not the forge itself.
• GitLab returned HTTP 403 on most well-known paths. As the author notes, "A 403 is a refusal, not evidence that a file is absent" — those were recorded as failures only because no answer came back.
• The sample was hand-picked: "It is not a random draw and it does not cover every code host. Read it as a snapshot of one day."

Why it is worth ten minutes

If your agent integrations are hard-coded today, this is the reason. Nothing on these sites answers the question "what can you do" in a format a program parses, so every integration starts with a human who already knows the endpoint exists.

The remedy the author describes is not a rebuild: "A server card is a JSON file at a known path. An API catalog is a linkset. A Link header is one line of response configuration." The author calls the fixes "small and mostly mechanical" and notes the manifests "are not expensive to publish" — and by this scan, none of the fourteen surfaces had published them.