30-min poll since run #26 (17:37Z). Bilale: no new chat messages since 15:07:48Z (chat unchanged). focus.md unchanged. GH notifications 0. Approval queue empty (2 resolved cards in /resolved/, none active). waiting_on_bilale still 4 items, none resolved this window. Treasury / missions unchanged in any material way.
IP 135.180.49.112 — UA mcp-registry-auth-probe/1.0 (+research; oleary.com) — 17 hits in 11s starting 18:02:22Z
First-ever sighting of this UA + IP on AIGEN (verified — grep "135.180.49.112\|mcp-registry-auth-probe" returns only today's 17 hits, nothing in access.log.1). All 17 hits packed into a single 11-second burst, no return so far in the 6 minutes between burst end and cron fire.
The sweep (two near-identical passes, ~8s apart):
18:02:22 GET /mcp → 400 105 (session-ID gate, lesson 37)
18:02:22 POST /mcp → 200 1182 (init succeeded)
18:02:23 GET /.well-known/oauth-protected-resource → 404
18:02:23 POST /mcp → 400 105 (no session ID echoed)
18:02:23 GET /llms.txt → 200 4949 (read full agent context doc)
18:02:23 GET /openapi → 404 (← expected at root, MISS)
18:02:25 GET /openapi.json → 200 1482 (← READ OUR API CONTRACT)
18:02:25 GET /openapi.yaml → 404
18:02:25 GET /.well-known/llms.txt → 200 1968
18:02:31 GET /mcp/sse → 200 87
18:02:31 POST /mcp/sse → 405 18
18:02:31 GET /.well-known/oauth-protected-resource → 404 (pass 2)
18:02:32 GET /llms.txt → 200 4949 (pass 2)
18:02:32 GET /openapi → 404 (pass 2)
18:02:32 GET /openapi.json → 200 1482 (pass 2)
18:02:33 GET /openapi.yaml → 404
18:02:33 GET /.well-known/llms.txt → 200 1968 (pass 2)
1. Self-attribution. UA carries +research; oleary.com — for the first time a scanner is willing to *tell us who they are*. mcp-dcr-hunter's UA was opaque (mcp-dcr-hunter/2.0 — no domain). This researcher is choosing transparency. That signals (a) good-faith research, not an audit-with-intent-to-publish-zero-day, (b) someone who expects their scan to be noticed and is happy for it.
2. Reads OpenAPI, not just OAuth metadata. mcp-dcr-hunter was narrow: it only cared about authorization-server discovery (RFC 8414/9728 paths). This new scanner is broader — it reads /openapi.json (our public API contract), /llms.txt (our agent-prompt-context doc), /.well-known/llms.txt (alt path). That means it's not just cataloguing the *auth surface* of MCP servers — it's cataloguing what each server EXPOSES as a protocol. That's exactly the layer AIP-1 / OABP is trying to define a standard for. Inclusion in this kind of catalog directly supports the category-creation thesis.
3. Two-pass sweep with 8s gap = probably a retry-after-warmup pattern, or two separate test runs (test/verify, then commit). Either way it confirms the scan is stable code, not exploratory by-hand probing.
WebFetch of oleary.com returned tracking-pixel content — site is opaque to the scraper. No public attribution to who "O'Leary" is. Whois on 135.180.49.112 returned empty locally. So we don't know the human behind it. But the UA is the load-bearing signal.
Path enumeration today reveals multiple external scanners assuming /openapi works as root alias for /openapi.json:
This is now N=3+ for "external researchers expect /openapi to be an alias for /openapi.json". I am NOT acting on this yet because aip1_short_url (a similar 1-line route-alias ask from run #21) is still pending with Bilale — piling on more route-add asks before he resolves the first one would be noise. But: if Bilale resolves aip1_short_url, the /openapi → /openapi.json alias becomes the natural next "low-risk discoverability fix" to ship together.
{"ts": "2026-05-15T18:07:27Z", "action": "run #27: novel signal — third research-grade ecosystem scanner today (after Taiwan reader 14:36Z and mcp-dcr-hunter 15:53Z + 16:48Z), this one SELF-ATTRIBUTING with domain. UA: mcp-registry-auth-probe/1.0 (+research; oleary.com), IP 135.180.49.112, 17 hits in 11s at 18:02Z, two-pass sweep. KEY: this scanner reads /openapi.json (our API contract) AND /llms.txt — broader than mcp-dcr-hunter (which only mapped OAuth). Successfully read 4 of our protocol docs (200 responses). WebFetch oleary.com returned tracking pixel — opaque. N=4 external scanners hitting /openapi root with no alias to /openapi.json (Taiwan reader, oleary.com x2 passes). Chat-notified Bilale in French. NOT promoting to lesson yet (N=1 this scanner), NOT shipping /openapi alias (aip1_short_url still unresolved by Bilale — don't pile on route asks)", "outcome": "0 commits, 0 approval cards, 0 lesson updates; first self-attributing researcher signal on AIGEN — directly supports category-creation thesis (researcher cataloguing what each MCP server EXPOSES as a protocol = exactly AIP-1's territory); watch list updated to track mcp-registry-auth-probe return", "next_focus_suggestion": "next run: (1) watch for mcp-registry-auth-probe return → 2nd hit = lesson + chat-alert; (2) Bilale's aip1_short_url ask is now 2h45min old — if no answer by 22:00Z UTC, drop priority, don't surface again until directly asked; (3) if a 4th distinct research scanner appears today, that's the trend — write a focused journal entry on the day's ecosystem-research meta-pattern instead of per-IP runs"}