IsItStillUp — MCP status probe
==============================

You are reading this because you found our User-Agent in your logs. This page
says exactly who we are, exactly what we send, how often, and how to stop us.

Who we are
----------

IsItStillUp (https://www.isitstillup.com) runs a public status directory for
remote MCP servers at https://www.isitstillup.com/tools. It measures whether a
server answers, how fast, and whether its advertised tool surface has changed.
We are not affiliated with, and do not speak for, any server we measure.

Our User-Agent, exactly:

    IsItStillUpMonitor/1.0 (+https://www.isitstillup.com/probe.txt; opt-out: tools@isitstillup.com)

The robots.txt product token is:

    IsItStillUpMonitor

What we send
------------

One pair of ordinary MCP requests to the endpoint URL published for your
server, over HTTPS:

    POST <your endpoint>
    Content-Type: application/json
    Accept: application/json, text/event-stream

    {"jsonrpc":"2.0","id":1,"method":"initialize","params":{
      "protocolVersion":"2025-06-18","capabilities":{},
      "clientInfo":{"name":"isitstillup-probe","version":"1.0"}}}

and, only if that succeeds:

    POST <your endpoint>
    MCP-Protocol-Version: <the version your server negotiated>
    Mcp-Session-Id: <the id your server issued, if it issued one>

    {"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}

That is the whole probe. Specifically:

  - We never call a tool. `tools/call` is not sent, ever, without a written
    opt-in from the server's operator.
  - We never send credentials, and we do not attempt to authenticate. A 401
    answer is a fine answer; we record that your server is authentication-gated
    and move on.
  - We send no Origin header. Your server is entitled to reject a request that
    carries an invalid one, and we are not a browser.
  - We follow no redirects on the probe itself. A 3xx is recorded as a 3xx.
  - We read at most 256 KiB of the initialize response and 1 MiB of the tools
    list, and we stop reading a server-sent-events stream as soon as your
    answer has arrived rather than holding the connection open.
  - On an authentication-gated server we additionally fetch your RFC 9728
    protected-resource metadata document and the authorization server's
    discovery document — at most three small GETs, so that we can report that
    your OAuth metadata resolves.
  - We fetch /robots.txt before we probe, and again at least daily.

Cadence
-------

Once every 5 to 30 minutes per network, depending on the server's tier, from a
small number of fixed vantage points. Two requests per probe. That is under 600
requests per day per network in the busiest tier, and far fewer for most
servers. We do not crawl, we do not spider links, and we send no traffic to any
path other than the endpoint URL, /robots.txt, and the two well-known
authorization metadata paths listed above.

How to stop us — three channels, any one of them is enough
----------------------------------------------------------

1. E-mail tools@isitstillup.com from an address at the server's domain, or from
   any address that can plausibly speak for it. Say "stop probing <endpoint>".
   We stop, mark the entry as opted out, and stop publishing measurements for
   it. No argument, no form, no account required.

2. A DNS TXT record:

       _isitstillup.<your host>.  IN  TXT  "optout"

   Checked before every seeding run and daily thereafter. Use this if you do
   not control the host's robots.txt.

3. robots.txt, honoured per RFC 9309 with longest-match rules. A group naming
   our product token takes precedence over `*`:

       User-agent: IsItStillUpMonitor
       Disallow: /

   A path-level rule works too — disallow only the MCP endpoint if you would
   rather keep the rest of the host crawlable.

An opted-out server is never probed again and is listed only as having opted
out, with no score and no history.

Corrections and disputes
------------------------

If you believe a published measurement is wrong, every server page carries a
dispute link, and we will publish the correction alongside the original record.
Legal notices: legal@isitstillup.com. Privacy: privacy@isitstillup.com.