Week 45, 2026
2–8 November 2026 (in progress, updated live)
88 visits to the MCP server and 101 to the web traps; 0 attackers, 62 leak scanners, 86 registry crawlers; 4 MCP visitors called a tool; 42 fake secrets handed out, 0 used again.
Totals
- MCP server visits
- 88
- Web trap visits
- 101
- MCP messages
- 336
- Web trap requests
- 994
- Fake secrets handed out
- 42
- Secrets used again
- 0
- Followed the server's instructions
- 0
Who came
Sorted by what each visit did, not what it called itself.
- Attackers: Tried an exploit, reused a stolen secret, or stuffed a login.
- 0
- Explorers: Agents that called tools or talked to the agent endpoints without attacking.
- 6
- Scanners: Hunted for leaked files and configs; may have taken one.
- 62
- Registries: MCP directories and registry crawlers: shook hands, read the tool list, left.
- 86
- Indexers: Search and AI crawlers reading the website.
- 35
How far MCP visitors got
- Touched
- 88
- Handshake
- 72
- Listed tools
- 58
- Called a tool
- 4
- Took a secret
- 1
- Reused a secret
- 0
- Tried damage
- 0
Most advanced visitors
| Visitor | Network | Sorted as | Got to |
|---|
Browser | UNMANAGED LTD, Romania | Scanner | Took a secret |
Script or HTTP library | Eweka Internet Services B.V., Netherlands | Scanner | Took a secret |
Security scanner | DigitalOcean, LLC, Canada | Scanner | Took a secret |
Browser | HostRoyale Technologies Pvt Ltd, United States | Scanner | Took a secret |
No user agent | Microsoft Corporation, United States | Scanner | Took a secret |
BrickBlueBot | CLODO CLOUD SERVICE CO. L.L.C, Netherlands | Explorer | Took a secret |
Search or link crawler | CLODO CLOUD SERVICE CO. L.L.C, Netherlands | Explorer | Called a tool |
Unrecognized software | Korea Telecom, South Korea | Explorer | Called a tool |
MCP clients
coda-agent-runtime | 3 |
verifymcp-probe | 2 |
talaria-catalog | 2 |
glama | 2 |
agentrank-probe | 2 |
LedgerLoom-Watchtower | 2 |
BrickBlueBot | 2 |
ziwei-seat | 1 |
Declared protocol versions
2025-06-18 | 10 |
2025-11-25 | 2 |
2026-07-28 | 1 |
Declared client capabilities
Tools called
list_secrets | 2 |
whoami | 1 |
search_customers | 1 |
list_services | 1 |
__verifymcp_auth_probe_f2d5e228c0722adb__ | 1 |
What web scanners looked for
| AI and MCP discovery | 330 |
| Other | 191 |
| Crawl basics | 105 |
| Secrets and config files | 95 |
| APIs and docs | 47 |
| Backups and dumps | 29 |
| PHP apps | 26 |
| Source control | 16 |
Top paths
/robots.txt | 56 |
/.well-known/oauth-authorization-server | 38 |
/.well-known/oauth-protected-resource | 37 |
/.well-known/agent-card.json | 27 |
/sitemap.xml | 24 |
/.well-known/mcp.json | 23 |
/api | 22 |
/.well-known/mcp/server-card.json | 22 |
Where visits came from
| United States | 96 |
| Netherlands | 19 |
| Germany | 15 |
| Switzerland | 14 |
| Canada | 9 |
| South Korea | 6 |
| China | 6 |
| France | 5 |
Live numbers are on the dashboard. Data: /api/stats, /api/leaderboard. Feed: Atom.