Open agent watch: 5 well kept projects and the week in numbers, 12 October 2026

Every week our scouts read the public registries where open AI agents and MCP servers are published. They check the things a careful buyer would check before wiring one in: is there a licence, a security policy, a changelog, a valid manifest, and does the endpoint ask who you are. This is what they saw in the week of 12 October 2026 to 18 October 2026.

Projects doing the basics well

These were newly rated, or moved up, and scored in our top two bands. The score is worked out from facts anyone can check. No AI model sets it, and how many stars a project has does not count.

• ai.customdomain/mcp (MCP server, MIT licence). Moved from band B to band A, now 99 out of 100. Custom domains for SaaS and AI agents with DNS and HTTPS over MCP. What we could see: a published security policy, a changelog, a valid server.json manifest and an endpoint that asked for authentication when we probed it.
• ai.haymon/dbmcp (MCP server, MIT licence). Moved from band B to band A, now 99 out of 100. Provides a Model Context Protocol server for connecting AI assistants to MySQL, MariaDB, PostgreSQL, and SQLite databases with schema discovery, query execution, PII redaction, and write prevention. What we could see: a published security policy, a changelog, a valid server.json manifest and a registry entry its own repository confirms.
• com.nessflow/mcp (MCP server, MIT licence). Rated band A, 99 out of 100. What we could see: a published security policy, a changelog, a valid server.json manifest and an endpoint that asked for authentication when we probed it.
• io.baserow/baserow (MCP server, MIT licence). Rated band A, 99 out of 100. What we could see: a published security policy, a changelog, a valid server.json manifest and an endpoint that asked for authentication when we probed it.
• tech.kyanitelabs/epoch (MCP server, Apache-2.0 licence). Rated band A, 98 out of 100. What we could see: a published security policy, a changelog, a valid server.json manifest and a registry entry its own repository confirms.

What we held back

401 findings were set aside for a person to look at before we say anything about them: 289 for a low score, 103 for text that reads as an instruction to an AI model rather than to a person, 4 for a published endpoint that points at a private network address, 4 for a name very close to a much better known project and 1 for a mention in a vulnerability feed we track. We do not name a project on the strength of a pattern match. A flag is a question, not a verdict.

The week in numbers

• 53,672 projects in the catalogue, 4,313 of them new this week.
• 52,107 have a score so far: 4075 in band A, 30271 in band B, 14110 in band C and 3651 below that. Another 1200 could not be rated because too little could be observed.
• 52 percent of the projects we have read carry a licence we could identify.
• 32 percent of the repositories we read publish a security policy.
• Of 28,003 remote endpoints that answered, 11,780 asked for authentication. For the rest we cannot say either way, because proving it would mean calling someone else's tools, which we do not do.
• 6844 served an A2A Agent Card, and 1664 of those cards followed the specification.

What to do with this

If you are choosing an open agent or MCP server for real work, ask the same questions before you connect it. Who maintains it. What licence it ships under. Where you would report a security problem. Whether its endpoint asks for credentials. Then record the answer in your AI inventory, because the answer changes.

These figures are a hygiene signal worked out from public metadata as of 19 October 2026. They are not a security audit and not a certification. If we have something wrong about your project, tell us and we will fix it or take the listing down.

More from our platforms

These sister platforms cover the parts of this problem that sit outside governance.

• Argus (argus.threatclaw.ai) records every trace an AI application produces and scans it for prompt injection, jailbreaks and data leaks, including the attacks hidden inside retrieved documents and tool results rather than in what the user typed. Governance decides what an AI agent is allowed to do. Argus shows what it actually did.
• ThreatClaw (www.threatclaw.ai) tracks the threat side of the same systems: 22 live intelligence feeds, exploitation predicted before it is officially confirmed, threat actor profiles, and detection rules you can deploy straight away. A control is only as good as the threat it is sized against.