MCP tool definitions and how they change
HISTOR reads the tool list of every remote MCP server in the official MCP registry once a day, and runs every new version of npm and PyPI MCP packages in a sandbox. Once a week the whole record is published here as files: what each server advertised, and every change, field by field. Free under CC BY 4.0.
Latest snapshot: 2026-11-09
| File | Rows | Size | What |
|---|---|---|---|
servers.jsonl.gz | 103,271 | 22.8 MB | One row per listed server: endpoint, transport, status, tool count, the digest of its current tool list. |
toolsets.jsonl.gz | 112,557 | 1,586.1 MB | Every tool list a server served (name, description and schemas, as served), current ones and every one a change replaced. |
changes.jsonl.gz | 73,198 | 76.4 MB | Every recorded change: tools added, removed and modified, field by field, with the signed label. |
scans.jsonl.gz | 26,235 | 1.8 MB | WARDEN pattern matches per tool list (rules in pattern-set.json). Leads to read, not verdicts. |
classifications.jsonl.gz | 4,194 | 233 kB | Advisory LLM readings of tool lists. Not reproducible, so never in the signed log. |
tool_extras.jsonl.gz | 147,528 | 61.2 MB | What each tool carried beyond those: annotations (readOnlyHint, destructiveHint…), _meta, title, icons. Since 2026-10-22. |
extras_changes.jsonl.gz | 180,931 | 19.2 MB | Every change to those members, annotation by annotation, with the tools that dropped readOnlyHint. |
package_observations.jsonl.gz | 227,788 | 18.8 MB | Every run of an npm/PyPI package with the version it ran and the list it served. Versions since 2026-10-26. |
manifest.json | Counts and SHA-256 of every file, signed by the log's key, with the tree head of the snapshot. | ||
README.md | The dataset card: fields, loading, citation, what the data does not say. |
New here? Start with servers.jsonl.gz (one row per listed server) and changes.jsonl.gz
(one row per recorded change, field by field); toolsets.jsonl.gz is the large one — every distinct tool list in full.
Sizes are in the table.
The same files: Hugging Face (one tag per snapshot) · Zenodo (a DOI per archived snapshot; the record names its date, and latest/ here may be newer) · latest/ always points at the newest snapshot.
Load it
from datasets import load_dataset # Hugging Face, typed changes configuration
changes = load_dataset("alexar76/histor-mcp-tool-definitions", name="changes", split="train")
-- DuckDB: the servers whose tool lists changed most often SELECT s.name, count(*) AS changes FROM 'https://histor.modelmarket.dev/datasets/latest/changes.jsonl.gz' c JOIN 'https://histor.modelmarket.dev/datasets/latest/servers.jsonl.gz' s ON s.id = c.serverId GROUP BY s.name ORDER BY changes DESC LIMIT 20;
import pandas as pd
servers = pd.read_json("https://histor.modelmarket.dev/datasets/latest/servers.jsonl.gz", lines=True)
Cite
Artamokhov, A. (2026). HISTOR snapshot 2026-11-02: MCP tool definitions and how they change [Data set]. Zenodo. https://doi.org/10.5281/zenodo.23884408
The latest snapshot, 2026-11-09, is not on Zenodo yet; the citation above is the newest one that is. To cite 2026-11-09 itself, give its signed manifest: https://histor.modelmarket.dev/datasets/2026-11-09/manifest.json.
Cite the snapshot you counted on: the same query gives other numbers on another snapshot. doi:10.5281/zenodo.23512759 stands for all of them and always opens the newest.
Check it
manifest.json lists the SHA-256 of every file and is signed (Ed25519) by the log's key
did:key:z6Mkw1CVxsPj9utYp7VXWEbuuGM9Ev47itwKu1UfKd5ByxR9, with the signed tree head the snapshot was taken under. Any label in it can be
proven against the live log: https://histor.modelmarket.dev. Code: https://github.com/alexar76/histor.
All snapshots
- 2026-11-09 · 96,101 servers · 73,198 changes
- 2026-11-02 · 90,863 servers · 53,159 changes · doi:10.5281/zenodo.23884408
- 2026-10-26 · 85,913 servers · 31,660 changes · doi:10.5281/zenodo.23884119
- 2026-10-25 · 85,437 servers · 30,151 changes · doi:10.5281/zenodo.23881379
- 2026-10-20 · 81,879 servers · 23,821 changes · doi:10.5281/zenodo.23512760
What it does not say
- A tool list is what a server showed an anonymous client on that day; servers that need a key show less or nothing.
- A change is a change in the definitions, not a judgement. Most are ordinary releases.
- Pattern matches and classifier flags are text worth reading, not proof that a server is malicious.
- A server operator who wants out of future snapshots can open an issue on https://github.com/alexar76/histor.