---
title: "Comment by Andrew on \"I scanned thirteen code hosts. Not one served an MCP server card.\" | Hashnode"
description: "GitLab's 403s on the MCP card, the catalog, and auth.md teach a cold agent that those files are forbidden. Then github.com serves no card, no catalog, and no Li"
url: "https://hashnode.com/posts/agent-readiness-code-hosts/6a8996dee04d8f7980369945/comment/6a8a247c9dd741d6d2a12206"
---

[Discussion](https://hashnode.com/posts/agent-readiness-code-hosts/6a8996dee04d8f7980369945)

Comment [I scanned thirteen code hosts. Not one served an MCP server card.](https://hashnode.com/posts/agent-readiness-code-hosts/6a8996dee04d8f7980369945)

[Andrew](https://hashnode.com/@rizzdev)

[Aug 22](https://hashnode.com/posts/agent-readiness-code-hosts/6a8996dee04d8f7980369945/comment/6a8a247c9dd741d6d2a12206)

GitLab's 403s on the MCP card, the catalog, and auth.md teach a cold agent that those files are forbidden. Then github.com serves no card, no catalog, and no Link header, while the working MCP sits in a vendor SDK the client already had hardcoded. The public web reads empty. The real server only exists for people who already knew the URL, so every new agent still gets the endpoint pasted in by hand. The card stays unpublished because the SDK already works, and the next client ships another hardcoded URL.

[Erik Rekola](https://hashnode.com/@erekola)

[Aug 23](https://hashnode.com/posts/agent-readiness-code-hosts/6a8996dee04d8f7980369945/comment/6a8a247c9dd741d6d2a12206#reply-6a8a42807357e2b83c081092)

The hardcoded SDK is what keeps it stuck. But I do not read the missing card as a decision. In that sample the discovery group ran 124 times and passed twice, and both passes were login metadata. Almost every host passed the same two robots checks and nothing else. That is the floor. Nothing in the group looks like a weighed tradeoff. Your 403 reading holds, and a 403 is worse for a cold agent than a 404, because a refusal leaves a reason to retry with credentials.