---
title: "Discussion on \"I scanned thirteen code hosts. Not one served an MCP server card.\" | Hashnode"
description: "Discussion on \"I scanned thirteen code hosts. Not one served an MCP server card.\". Fourteen code-host surfaces were scanned on one day. The findings concern public discovery paths, not the full capabilities of each hosting service."
url: "https://hashnode.com/posts/agent-readiness-code-hosts/6a8996dee04d8f7980369945"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [I scanned thirteen code hosts. Not one served an MCP server card.](https://turva.dev/blog/agent-readiness-code-hosts?utm_source=hashnode&utm_medium=feed)

Fourteen code-host surfaces were scanned on one day. The findings concern public discovery paths, not the full capabilities of each hosting service.

Aug 22 · 9 min read · turva.dev  
Updated Nov 5  
Read the article

-   [#ai](https://hashnode.com/tag/ai)
-   [#agents](https://hashnode.com/tag/agents)
-   [#git](https://hashnode.com/tag/git)
-   [#webdev](https://hashnode.com/tag/webdev)

## Written by

[Erik Rekola](https://hashnode.com/@erekola)

@erekola · Finland, Tampere

  
[View profile](https://hashnode.com/@erekola)

I check what AI assistants can read about a product, and where a website and its API disagree.

turva is my one-person business in Tampere, Finland. I run agent-readiness audits for websites and APIs. Here I write up what I measure and build along the way. I publish every article on my site first. The copies here link back to it.

## Responses 2

Markdown supported · ⌘↵ to post

[Andrew](https://hashnode.com/@rizzdev)

[Aug 22](https://hashnode.com/posts/agent-readiness-code-hosts/6a8996dee04d8f7980369945/comment/6a8a247c9dd741d6d2a12206)

GitLab's 403s on the MCP card, the catalog, and auth.md teach a cold agent that those files are forbidden. Then github.com serves no card, no catalog, and no Link header, while the working MCP sits in a vendor SDK the client already had hardcoded. The public web reads empty. The real server only exists for people who already knew the URL, so every new agent still gets the endpoint pasted in by hand. The card stays unpublished because the SDK already works, and the next client ships another hardcoded URL.

[Erik Rekola](https://hashnode.com/@erekola)

[Aug 23](https://hashnode.com/posts/agent-readiness-code-hosts/6a8996dee04d8f7980369945/comment/6a8a247c9dd741d6d2a12206#reply-6a8a42807357e2b83c081092)

The hardcoded SDK is what keeps it stuck. But I do not read the missing card as a decision. In that sample the discovery group ran 124 times and passed twice, and both passes were login metadata. Almost every host passed the same two robots checks and nothing else. That is the floor. Nothing in the group looks like a weighed tradeoff. Your 403 reading holds, and a 403 is worse for a cold agent than a 404, because a refusal leaves a reason to retry with credentials.