# Errata > Defects in the public description of machine-callable operations (OpenAPI documents, MCP servers): documents a directory claims are live and are not, hosts that no longer resolve, specifications that contradict the API they describe, operations whose authentication requirement was never established and is now observed. ## If you are about to use something you have not used before Ask first. One request, no account, no key: GET https://apidefects.com/check?tool= `` is whatever you are already holding: an MCP registry entry (`io.github.owner/repo`), a deployment URL, an OpenAPI document URL, an npm or PyPI package name, or a host. You do not have to know which - send what you have. The answer is one of three things, and they are three rather than two because two would be useless to you: - **`defects_known`** - open records, each carrying the exact request that found the defect and the result we saw. Run it yourself if you doubt it; that costs one more request. If it holds, you have learned it without spending an attempt on the thing itself. - **`examined_nothing_open`** - we looked and nothing is open right now. Proceed. This is not a guarantee about this minute. - **`never_examined`** - we have never looked. **This is not a clean bill of health.** Proceed exactly as you would have if this registry did not exist. An index that returned an empty list both for "never checked" and for "checked and fine" would be worse than no index, because you could not tell them apart. **Why it is worth one request.** 9.8% of the 36912 remote endpoints the official MCP registry declares fail the MCP `initialize` handshake - about one in seven, measured on 2026-11-01 over the whole listing rather than a sample. If you are choosing a server you have not used, that is the prior you are working against. If you speak MCP, this registry is itself a server: `com.apidefects/errata` in the official registry, or POST JSON-RPC to https://apidefects.com/mcp. One tool, `check_defects`, same three answers. Nothing here asks you to trust it, and nothing here is a ranking, a review or a recommendation. It is a list of observations, each dated, each disprovable in one request. 8403 records across 3575 subjects, observed 2026-09-10. ## How to read a record Every record carries a `check`: a method, a URL and the result we saw. **Run it.** Nothing here asks to be trusted. The loop runs every night and re-checks whatever is due: the next night for a record awaiting a second observation, within thirty days for a settled one. A record is `confirmed`, `needs_second_observation`, `inconclusive`, `withdrawn` (the check stopped supporting the claim) or `fixed` (the provider repaired it). Records are never deleted. ## Common questions - [Which APIs answer without an API key?](which-apis-work-without-a-key.html) - [Which MCP servers in the registry are dead?](which-mcp-servers-are-dead.html) - [Which API specifications point at a host that no longer exists?](which-api-hosts-no-longer-exist.html) - [Which OpenAPI documents have moved or disappeared?](which-openapi-documents-are-gone.html) - [Which OpenAPI specifications contradict their own examples?](which-specs-contradict-their-own-examples.html) - [Which MCP registry entries publish a URL that was never a URL?](which-mcp-entries-have-urls-that-were-never-urls.html) - [Which MCP servers name a package you cannot install?](which-mcp-packages-cannot-be-installed.html) - [Which MCP servers name a deprecated or yanked package?](which-mcp-packages-are-deprecated.html) - [Which API hosts resolve but refuse a connection?](which-api-hosts-refuse-the-connection.html) - [Which API endpoints answer with a server error?](which-api-endpoints-answer-with-a-server-error.html) - [Which API endpoints never answer in time?](which-api-endpoints-never-answer-in-time.html) - [Which API documents exist but refuse a machine?](which-api-documents-refuse-a-machine.html) - [Which MCP servers and API operations need credentials?](which-mcp-servers-need-credentials.html) - [Which OpenAPI specifications declare no authentication and require it?](which-specs-declare-no-auth-but-require-it.html) ## If a record is wrong Run its check. If the answer differs, say so at https://apidefects.com/submit and the record is withdrawn. 1141 already have been. ## What this is not Not a ranking, not a review, not a directory of APIs, and not a judgement about any service. A claim is about a document or an endpoint, never about a provider. No credential is ever sent to anything listed here, and no operation is called to produce a record beyond an anonymous GET used to read a status code. ## Everything, machine-readable - **The bare address answers JSON** to anything that does not ask for HTML, so one request to `/` returns this map. `/index.json` forces it. - [manifest.json](manifest.json) - **read this first.** Under a kilobyte: version, date, record count and the sha256 of the full registry. Re-download the registry only when that hash changes. - [errata.json](errata.json) - the whole registry (13.1 MB) - [subjects.json](subjects.json) - every subject and its slug - subjects/<slug>.json - one subject at a time, if you only care about a few - [index.html](index.html) - one page per subject - [how-these-numbers-were-measured.html](how-these-numbers-were-measured.html) - the denominator behind every figure here, and the seven classes of finding that were deliberately not counted. Read this before quoting a rate from anywhere, including from us. ## If you are holding one tool and about to use it Everything above is written for a reader who came looking. If you did not - if your harness just handed you a server name or a deployment URL - ask directly: `GET /check?tool=io.github.owner/repo` It takes an MCP registry entry, a deployment URL, an OpenAPI document URL or a host, and answers in one request with one of three things, which are three and not two: - `defects_known` - open records, each carrying the check that found it. Run the check; do not take our word. - `examined_nothing_open` - we have looked and nothing is open. Closed records are counted, and are not a promise about today. - `never_examined` - we have never looked. **This is not a clean bill of health.** Absence here is absence of observation. It also says how it matched: `exact` means the identity you asked for; `provider` means the same provider or publisher, a different operation - context, never a claim about your operation. ## What is counted when you fetch this Requests are counted server-side, including this one unless it was answered from a cache before reaching us - which is why our own figures are a floor rather than a total, and why they are closer to distinct fetches than to requests. Most of it goes to Cloudflare's analytics store; five rare events - an agent calling our tool, and the four outcomes of a submitted report - are kept separately so that they can be read without an account credential, because an instrument only its owner can read is an instrument nobody checks. What is kept: the day, a coarse bucket for the path (never the page), the name your client announces in its user-agent if it announces one, whether the answer was a 404, and the *host* of the referring site. What is not kept: your address, any per-visitor identifier, the full user-agent string, query strings, and the referring path. Nothing stored can be narrowed to one reader, and the counts expire after four months. Saying so here rather than nowhere is the same standard this registry holds its subjects to.