# lastseen.dev > A dated register of software-component maintenance observations. For a GitHub > Action, npm package, MCP server, or Docker image we record when it was last seen > active and its dated state (alive / dormant / abandoned / archived / deleted). > These are observations, not predictions and not recommendations. ## What is covered - GitHub Actions: 33,431 observed of 37,272 enumerated (Marketplace + ecosyste.ms) - MCP servers: 28,824 (the full 2026 census) - npm packages: 532,037 observed (npm is an open registry — no fixed total) - Docker images: 26; image versions: 506 (endoflife.date release cycles — Docker Hub has no fixed total) Series began 2026-07-22; observed daily. An observation older than 180 days that we have not re-verified is reported as `unknown-stale` — never a made-up state. ## Which entities have a page - MCP servers: /entity/mcp/{owner}/{repo}/ only for a not-maintained state (deleted, abandoned, dormant, archived). - npm: /npm/{package} for top-adopted packages (top-by-dependents ranking) with at least 2 dated observations, in ANY state, alive included. - GitHub Actions: /actions/{owner}/{repo} for Actions with at least 5 stars and at least 2 dated observations, in ANY state, alive included. - npm: /entity/npm/{package} for not-maintained packages with at least 25 npm dependents. - GitHub Actions: /entity/actions/{owner}/{repo} for not-maintained Actions with at least 10 stars. - Docker: one register table at /entity/docker/ (no per-image pages). Everything else observed is reachable through the API below, not through a page. ## What is NOT covered (do not infer beyond this) - Absence of a page or a record means NOT-CHECKED or not listed, never "gone". - No registries beyond the four above (no PyPI, crates, Go modules, etc.). - We do not rank, recommend, or name alternatives — no advice about any named party. - An entity page URL (`/entity/...`, `/npm/...`, `/actions/...`) that is not in the sitemap does not exist. Do not construct or cite such a URL. No page does NOT mean no observation (an alive MCP server, for example, is observed but has no page): ask the API. ## How to cite an observation Cite the entity URL and its observed date, e.g. "owner/repo — abandoned, observed 2026-10-17 (lastseen.dev)". Dataset dumps carry a permanent Zenodo Concept DOI (always-latest, recommended for citation): lastseen.dev (2026). Nerq MCP-server repository mortality. Zenodo. https://doi.org/10.5281/zenodo.21869879 (CC-BY-4.0). ## Methodology https://lastseen.dev/#methodology (thresholds, interval-censoring, known gaps) ## API GET https://lastseen.dev/api/v1/entity/{owner}/{repo} — no key, 60 req/min POST https://lastseen.dev/api/v1/sbom — upload a CycloneDX/SPDX SBOM, get one dated result per component. Body parsed in memory, NEVER stored (zero PII). Max 4 MB. ### Copyable examples (real, filled-in — not placeholders) curl https://lastseen.dev/api/v1/entity/actions/checkout curl 'https://lastseen.dev/api/v1/entity/actions/checkout?as_of=2026-08-01' curl https://lastseen.dev/api/chain/head # npm is a single-token name, served via POST (no GET path): curl -X POST https://lastseen.dev/api/v1/manifest -H 'Content-Type: application/json' -d '{"components":[{"name":"typescript","kind":"npm"}]}' ### CLI — check a whole project at once (npm package: lastseen-cli, no install) npx lastseen-cli check # reads ./package.json, dated state per dep npx lastseen-cli check typescript left-pad # or specific npm packages npx lastseen-cli check --as-of 2026-08-01 typescript # point-in-time # npm i -g lastseen-cli installs the `lastseen` command. Zero deps, uses this same free API. ## Point-in-time (as_of) Every read endpoint accepts `?as_of=YYYY-MM-DD` and returns the observation's REAL date + source + a censoring status — never a nearest-value guess. A date before our coverage returns `not-observed-at-date`; a carried-forward value is `interval-censored`. ## Report — State of the Agent Economy, Q3 2026 (/reports/soae-q3-2026) Nearly 1 in 3 public MCP servers is already dead or no longer maintained, and 1 in 5 is fully dead — a census of 28,824 repositories, re-checked daily (not an estimate). 1,027 servers changed a tool's schema under a stable name. Only 2.2% have adopted the 2026-07-28 protocol; 98% speak an older generation. Of 3,510 servers observed dead, only 6 ever returned (~1 in 585) — death is very nearly permanent. Full report + CC-BY dataset: https://lastseen.dev/reports/soae-q3-2026/full Check your own stack: npx lastseen-cli check ## Incidents (/incidents) When an AI-agent security incident occurs, /incidents carries dated, verifiable register observations about the named entities — what we saw, when. Silence means no evidence, never no coverage. Populations are under continuous dated observation with declared per-population coverage-start dates; every claim maps to a dated row re-derivable via ?as_of=. ## Verify (temporal notary) Every dated observation is folded into a daily SHA-256 hash chain. The current head is at https://lastseen.dev/api/chain/head (JSON) and https://lastseen.dev/verify (recipe a machine or human can follow to re-derive it). The head is anchored in each Zenodo dataset version, so a past observation cannot be altered or backdated.