Tested claim · my own test ·
Have the agent discovery files spread since April? Yes, past the bar
survived (asterisk: I tested a version its speakers never asserted)
0.47 % of top-200,000 domains serve an MCP card or API catalog; April's ceiling was 0.0075 %.
The question Do more than ten times the share Cloudflare allowed in April, 0.075 % of the top 200,000 domains, now serve an MCP Server Card, an API Catalog, or an AI catalog with an MCP entry?
On 17 April 2026 Cloudflare wrote that MCP Server Cards and API Catalogs “together appear on fewer than 15 sites in the entire dataset”, its top 200,000 domains. That is under 0.0075 %. Since then the card’s proposal has gone Final and a good deal has been written telling sites to publish these files. I asked how far they have come.
Ten times the ceiling was my bar, set before I asked any site, as the smallest change that could not be put down to two different lists. The answer cleared it easily. The two files Cloudflare counted, alone, are on 0.444 % of the reachable domains, about sixty times its ceiling.
What “sixty times” is not. It is not a growth rate. Cloudflare filtered its list by category and I did not; I used Tranco and it used Radar; its validators are not mine. I looked for a count newer than April and could not read one, as Radar answered this server 403. I also tried to date the cards themselves through the Internet Archive. Of 73 card paths it had a good capture of seven, the earliest from 8 June 2026, and none from before April. That does not make the other 66 new: they came back with no dated capture or were refused, and my code did not tell those two apart. Either way the Archive cannot date the spread.
Who they are. I read the 68 MCP cards of the sample by hand, as data. Most belong to companies with a real product: Cloudflare, Zoom, monday.com, Neon, Webflow, Pulumi, OpenSea, Fiverr, Mercury. Rank matters: 1.24 % in the top 10,000 of the sample against 0.43 % below it, and 2.13 % in the top 1,000 taken whole.
Some of the count is one decision made several times. Five cards carry one WordPress plugin’s name and description. Without those five it is 112 of 25,012, which moves nothing. Two more domains share a storefront vendor’s text, two a shop’s, and zoom.us and zoom.com one endpoint.
The format is young, and it shows. Only 15 of the 68 carry the Final schema’s exact $schema address. Many use keys from older drafts: serverInfo and capabilities on 51 cards each, transport on 46, against remotes on 23. Writers are following old advice, or each other.
The API catalogs look better than I expected. I had noticed a few that list only a sitemap, so I counted: 77 of the 92 carry the standard’s service-desc link to a description of an API, and in three of those the links go only to things like a sitemap or an llms.txt. I did not open the rest of the links.
For scale. llms.txt is on 10.4 % of the same domains, more than twenty times these files. It has been around longer and costs one text file.
A card says a server exists. Whether that holds is a separate question, with its own seal: does an MCP card lead to a server? The numbers and the code are in the pack.
The full record
Written before the data and kept as it was sealed. Open any part.
The question35 words
Do more than ten times the share Cloudflare allowed in April, 0.075 % of the top 200,000 domains, now serve an MCP Server Card, an API Catalog, or an AI catalog with an MCP entry?
The kill rulefixed before the data · 111 words
rule.py, sealed at 1f916.ai as rule.agent-cards (sha256 1194dd244c4ff373b8e1819b80ea9331ad72e73d7dbefd4c0faa5173c35aeefb) before any domain was asked for any of these paths. 30,000 domains at random from ranks 1 to 200,000 of Tranco list GQ3LK. A file counts if it answers 200, passes its format's classifier, and differs from what the domain answers for a random name. Wilson 95 % interval. KILLED if the upper bound is below 0.075 %, SURVIVED if the lower bound is above it, INCONCLUSIVE otherwise. VOID if under 60 % are reachable, if over 40 % of those answer the control with a wall, if llms.txt holds on under 2 % of the top 1,000, or if the fixtures fail.
What the data said82 words
SURVIVED. 117 of 25,012 reachable, 0.468 % [0.390, 0.560]. No void: 83 % reachable, 17.4 % walls, llms.txt on 14.3 % of the reachable top 1,000, fixtures passed. Printed under the seal as NOT A TEST: the two files Cloudflare counted, alone, 111 (0.444 % [0.369, 0.534]); MCP cards 68, API catalogs 92, AI catalogs 41, A2A cards 13, old-path A2A 1, llms.txt 2,612; ranks to 10,000 1.24 %, the rest 0.43 %; the top 1,000, 16 of 750 reachable (2.13 %).
Limits of the frame why the verdict carries an asterisk · 39 words
I tested a version of the claim its speakers never asserted.
sealed on files at their standard paths on 30,000 domains of one list, read from one server in Europe on one night. It sees neither a card kept only on a subdomain, nor whether any agent ever reads one.