THE MCP MAP
What can be measured from outside, and what cannot
Fifteen public MCP endpoints, scanned the same way on the same day. Eight could be measured. Seven answer 401 before the handshake, so nothing about them was judged — and no number is shown for them, because a score for a surface nobody was allowed to read is a guess with a decimal point.
15Endpoints scanned
8Measured
7Not evaluated
| Endpoint | Score | Checks | Tools | What it cost, or why not judged |
|---|---|---|---|---|
| Apifymcp.apify.com | not evaluated | — | — | 401 before the handshake (OAuth bearer) |
| Cloudflare docsdocs.mcp.cloudflare.com/mcp | 88/100 | 7/7 | 2 | tool naming, no server instructions |
| Context7mcp.context7.com/mcp | 88/100 | 7/7 | 2 | no search tool over the tool surface, tool naming |
| DeepWikimcp.deepwiki.com/mcp | 88/100 | 7/7 | 3 | no search tool, tool naming |
| Examcp.exa.ai/mcp | 88/100 | 7/7 | 2 | tool naming, no server instructions |
| Gecko (host root)oursmcp.geckovision.tech | 94/100 | 7/7 | 2 | no search tool at the root |
| Gecko (orquestra)oursmcp.geckovision.tech/orquestra/mcp | 94/100 | 7/7 | 16 | tool naming |
| Hugging Facehf.co/mcp | 88/100 | 7/7 | 4 | tool naming |
| Linearmcp.linear.app/mcp | not evaluated | — | — | 401 before the handshake |
| Notionmcp.notion.com/mcp | not evaluated | — | — | 401 before the handshake |
| PayBoxapi.paybox.sh/mcp | not evaluated | — | — | 401 before the handshake |
| Pegana oraclemcp.pegana.xyz | 76/100 | 7/7 | 10 | no search tool, tool naming, no server instructions |
| Sentrymcp.sentry.dev/mcp | not evaluated | — | — | 401 before the handshake |
| Stripemcp.stripe.com | not evaluated | — | — | 401 before the handshake |
| Vercelmcp.vercel.com | not evaluated | — | — | 401 before the handshake |
@geckovision/scan · 2026-09-01 · gecko-scan <url> --json --timeout 20000
One machine, one run per target. Re-runnable by anyone: the tool is public and the command is above.
How to read this
- Every score carries the number of checks actually evaluated. A score without its denominator is not a measurement.
- A host we could not read is listed as not evaluated, with the reason. It is never a zero.
- Ordered by name, never by score. Two of these surfaces are ours, and a ranking we publish and also win would be worth less than the data.
What the full report adds
- Every check, with the exact URL or payload it judged.
- The fix, per finding, in the order that moves the score most.
- Re-scans over time, so a change is visible as a change.
The scan is free. The email joins the Gecko waitlist, nothing else.
Built withDev3Pack acceleratorSuperteam Brasil communitySurfpool · mainnet-fork simulator