We Published the Largest Known Census of MCP Tools: 229,827 Parameter Schemas

If you're building security or conformance tooling for AI agents, you need machine-readable descriptions of what tools exist and what parameters they take. Today we're publishing the largest known dataset of exactly that.

What's in it

• 229,827 tool records, each with a machine-readable input_schema — the parameter definitions an agent sees when deciding how to call a tool.
• Coverage from 13,120 servers with tool-level schemas (out of 42,163 servers surveyed — the gap is itself a finding: most deployed MCP servers don't expose machine-readable parameters at all).
• Byte-verified counts, zero malformed records, SHA-256 anchored — verify the bundle yourself.

Why parameter schemas matter

An agent's tool call is only as safe as the contract it can read. Parameter-level risk classification — which arguments can carry URLs, file paths, shell fragments — is the layer where injection and exfiltration actually get stopped. Our IETF individual draft draft-correctover-gg-mcp-parameter-risk proposes a canonical risk taxonomy for exactly these schemas; this census is the empirical base it stands on.

Use it

Risk research, conformance test generation, discovery-layer security analysis. Data is CC-BY-SA-4.0 (dataset; see repo for the verification hash and citation).

Honest limits

English-language-weighted sampling; schema quality varies by server; the 29k servers without tool-level schema are recorded but not expanded. Methodology notes in the repo.

Correctover — runtime verification and evidence infrastructure for AI agents.