{
  "schema": "marketnow-auth-gate/1.0",
  "generated_at": "2026-09-18T07:21:14.524Z",
  "description": "Auth-gate distribution of remote MCP endpoints, measured live with receipts (HTTP 200 without a served tools array is NOT counted as open — the lesson from X190 v0.9.0). Aggregate-first: endpoints are SHA-256-hashed, raw URLs are never published.",
  "scope": {
    "population": "official-registry entries in the MarketNow catalog",
    "catalog_entries": 9076,
    "entries_with_remotes": 6165,
    "unique_endpoints_probed": 6249,
    "protocol_types": {
      "streamable-http": 5649,
      "sse": 516
    }
  },
  "headline": {
    "open_pct": 28.1,
    "open_count": 1755,
    "definition": "initialize OK AND tools/list serves a tools array, without any token",
    "auth_gated_pct": 30.2,
    "rfc9728_valid_pct": 32.5,
    "gated_but_discoverable_count": 1290
  },
  "distribution": {
    "OPEN": {
      "count": 1755,
      "pct": 28.1
    },
    "LATE_GATE": {
      "count": 22,
      "pct": 0.4
    },
    "HARD_GATE": {
      "count": 1865,
      "pct": 29.8
    },
    "RESPONDS_NOT_SERVING": {
      "count": 703,
      "pct": 11.2
    },
    "INVALID": {
      "count": 511,
      "pct": 8.2
    },
    "PROTOCOL_MISMATCH": {
      "count": 494,
      "pct": 7.9
    },
    "SERVER_ERROR": {
      "count": 74,
      "pct": 1.2
    },
    "CLIENT_ERROR": {
      "count": 170,
      "pct": 2.7
    },
    "UNREACHABLE": {
      "count": 655,
      "pct": 10.5
    }
  },
  "rfc9728": {
    "method": "GET {origin}/.well-known/oauth-protected-resource (RFC 9728)",
    "http200": 2264,
    "valid_manifests": 2034,
    "valid_pct": 32.5,
    "valid_on_open_endpoints": 266,
    "gated_but_discoverable": 1290
  },
  "comparison": {
    "x190_v091": {
      "sample": 100,
      "open_pct": 45,
      "rfc9728_functional_pct": 40,
      "broken_challenge_pct": 9,
      "source": "unempyd/X190 public measurement 2026-09-11"
    },
    "marketnow_this_scan": {
      "sample": 6249,
      "open_pct": 28.1,
      "rfc9728_valid_pct": 32.5
    }
  },
  "methodology": {
    "probe": "Node fetch, single-shot (no retries), JSON-RPC 2.0 initialize (protocolVersion 2025-06-18) → notifications/initialized → tools/list; session header mcp-session-id forwarded when issued; SSE bodies read first-chunk-then-cancel",
    "timeouts_ms": {
      "initialize": 12000,
      "tools_list": 12000,
      "rfc9728": 6000
    },
    "concurrency": 16,
    "user_agent": "MarketNow-Sentinel-AuthStateProbe/1.0 (+https://marketnow.site)",
    "privacy": "endpoint_hash = sha256(url)[0:16]; host_hash = sha256(host)[0:12]; raw URLs never stored in published artifacts",
    "states": {
      "OPEN": "initialize OK and tools/list serves a tools array without token",
      "LATE_GATE": "initialize OK, tools/list returns 401/403",
      "HARD_GATE": "initialize returns 401/403",
      "RESPONDS_NOT_SERVING": "endpoint speaks JSON-RPC at HTTP 200 but never serves tools (200 ≠ served)",
      "INVALID": "HTTP 200 but body is not valid JSON-RPC (login pages, HTML, CDNs)",
      "PROTOCOL_MISMATCH": "POST initialize → 404/405 (SSE-only endpoints or dead paths)",
      "SERVER_ERROR": "5xx at initialize",
      "CLIENT_ERROR": "other 4xx at initialize",
      "UNREACHABLE": "DNS/TLS/connection/timeout failure"
    },
    "limitations": [
      "single-shot: transient outages classify an endpoint as UNREACHABLE/SERVER_ERROR",
      "SSE-typed endpoints are probed via streamable-HTTP POST; those that only accept GET-SSE fall into PROTOCOL_MISMATCH",
      "auth challenges that redirect to IdP HTML pages classify as INVALID, not gated"
    ],
    "rescan_policy": "monthly re-scan planned; drift history retained (MarketNow moat)"
  },
  "tools_served_stats": {
    "n": 1755,
    "min": 1,
    "p50": 5,
    "p90": 20,
    "max": 94,
    "mean": 9
  }
}