What the servers on every best-of list do at startup

7 of 67 servers reached for a website their own README does not name

Each of those 7 servers is recorded with the name it asked for and the line of its README that does not contain it. Nothing left the machine: the room has no route off the host, so every name answered to the loopback address and no connection completed.

24 servers offered a tool their README does not name — 1,143 tools were offered in total and none was called. Read that second figure with the caveat attached: this rule reads only the README that shipped in the package, so a server documenting its tools in a reference file beside it shows every tool as unnamed, and 10 of those servers have a README under three kilobytes. A large count here is a fact about the rule as much as about the package.

2 did both. The remaining 38 had nothing found, which is not the same as a clean sweep — see below.

67 npm packages, each measured from its name alone: installed, started in a room with no route to the internet and no real credentials, asked for its list of tools, and compared against its own README. No tool was called. Measured 2026-10-31 to 2026-11-02.

Not calibration-backed. The calibration behind the ten curated measurements proves the instrument catches planted claims about what a tool did. Level 1 calls no tool and reads each README by a stated rule rather than by a person, so nothing in that calibration speaks to these pages.

A website counts as declared only if the README names it. A tool counts as documented only if the README names it as a whole word.

This is not a ranking of the most-used servers. The set measured is whatever two registry searches returned, read by hand for whether each package is a server that starts without a credential. Download figures decided nothing about the order of this table, which is alphabetical by package, and four widely used servers are measured here that neither search returned at all. Nothing on this page says one server is more used, better or worse than another.

Reading the table

• Published at is the repository or homepage the package's own manifest points at, printed because two packages measured here are called Playwright and are not by the same people. It is what each package says about itself and is not verified.
• Tools offered is what each server answered to one tools/list request. None was called.
• Websites reached for counts the distinct names a server looked up or opened an encrypted connection to before any tool was used. Nothing left the machine: every name answered to the loopback address, so no connection completed and no contents were seen.
• Not named in the README is the comparison, by the rule above and nothing looser. "none" means every tool it offered and every website it reached for appears in its own README.
• An empty row is not a clean sweep. A server that offers few tools and reaches for no website has little for this comparison to find, which is a fact about the measurement as much as about the server.
• A large count is not a scandal either. Only the README file that shipped in the package is read. A server that documents its tools in another file — a reference page beside the README, or a website — shows every tool it offers as not named here. Each report cites the README it read, its digest and its line count, and the name it looked for and did not find, so any row can be checked rather than taken.
• It is one run, once, with no route off the machine and no tool called. A page here says what a server did at startup while being watched, and where its README was silent about it. It says nothing else.

All 67 packages started, so no row says could not start. Evidence for every row — the full trace, the tool list, the README digest and each citation — is in level1/evidence/, one JSON file per package, beside the code that produced it.