# Errata > Defects in the public description of machine-callable operations (OpenAPI documents, MCP servers): documents a directory claims are live and are not, hosts that no longer resolve, specifications that contradict the API they describe, operations whose authentication requirement was never established and is now observed. 5068 records across 2098 subjects, observed 2026-09-10. ## How to read a record Every record carries a `check`: a method, a URL and the result we saw. **Run it.** Nothing here asks to be trusted. A record is `confirmed`, `needs_second_observation`, `inconclusive`, `withdrawn` (the check stopped supporting the claim) or `fixed` (the provider repaired it). Records are never deleted. ## Common questions - [Which APIs answer without an API key?](which-apis-work-without-a-key.html) - [Which MCP servers in the registry are dead?](which-mcp-servers-are-dead.html) - [Which API specifications point at a host that no longer exists?](which-api-hosts-no-longer-exist.html) - [Which OpenAPI documents have moved or disappeared?](which-openapi-documents-are-gone.html) - [Which OpenAPI specifications contradict their own examples?](which-specs-contradict-their-own-examples.html) - [Which MCP registry entries publish a URL that was never a URL?](which-mcp-entries-have-urls-that-were-never-urls.html) - [Which MCP servers name a package you cannot install?](which-mcp-packages-cannot-be-installed.html) - [Which MCP servers name a deprecated or yanked package?](which-mcp-packages-are-deprecated.html) - [Which API hosts resolve but refuse a connection?](which-api-hosts-refuse-the-connection.html) - [Which API endpoints answer with a server error?](which-api-endpoints-answer-with-a-server-error.html) - [Which API endpoints never answer in time?](which-api-endpoints-never-answer-in-time.html) - [Which API documents exist but refuse a machine?](which-api-documents-refuse-a-machine.html) - [Which MCP servers and API operations need credentials?](which-mcp-servers-need-credentials.html) - [Which OpenAPI specifications declare no authentication and require it?](which-specs-declare-no-auth-but-require-it.html) ## If a record is wrong Run its check. If the answer differs, say so at https://apidefects.com/submit and the record is withdrawn. 111 already have been. ## What this is not Not a ranking, not a review, not a directory of APIs, and not a judgement about any service. A claim is about a document or an endpoint, never about a provider. No credential is ever sent to anything listed here, and no operation is called to produce a record beyond an anonymous GET used to read a status code. ## Everything, machine-readable - **The bare address answers JSON** to anything that does not ask for HTML, so one request to `/` returns this map. `/index.json` forces it. - [manifest.json](manifest.json) - **read this first.** Under a kilobyte: version, date, record count and the sha256 of the full registry. Re-download the registry only when that hash changes. - [errata.json](errata.json) - the whole registry (6.0 MB) - [subjects.json](subjects.json) - every subject and its slug - subjects/<slug>.json - one subject at a time, if you only care about a few - [index.html](index.html) - one page per subject - [how-these-numbers-were-measured.html](how-these-numbers-were-measured.html) - the denominator behind every figure here, and the seven classes of finding that were deliberately not counted. Read this before quoting a rate from anywhere, including from us. ## If you are holding one tool and about to use it Everything above is written for a reader who came looking. If you did not - if your harness just handed you a server name or a deployment URL - ask directly: `GET /check?tool=io.github.owner/repo` It takes an MCP registry entry, a deployment URL, an OpenAPI document URL or a host, and answers in one request with one of three things, which are three and not two: - `defects_known` - open records, each carrying the check that found it. Run the check; do not take our word. - `examined_nothing_open` - we have looked and nothing is open. Closed records are counted, and are not a promise about today. - `never_examined` - we have never looked. **This is not a clean bill of health.** Absence here is absence of observation. It also says how it matched: `exact` means the identity you asked for; `provider` means the same provider or publisher, a different operation - context, never a claim about your operation. ## What is counted when you fetch this Requests are counted server-side, including this one unless it was answered from a cache before reaching us - which is why our own figures are a floor rather than a total, and why they are closer to distinct fetches than to requests. What is kept: the day, a coarse bucket for the path (never the page), the name your client announces in its user-agent if it announces one, whether the answer was a 404, and the *host* of the referring site. What is not kept: your address, any per-visitor identifier, the full user-agent string, query strings, and the referring path. Nothing stored can be narrowed to one reader, and the counts expire after four months. Saying so here rather than nowhere is the same standard this registry holds its subjects to.