The agentic web, measured
An open, versioned read on the public MCP server ecosystem, triangulated across four sources and updated weekly. The headline counts everyone repeats are inflated; the useful signal is the gap between what registries advertise and what is actually maintained. Code and methodology are public so anyone can check us.
Latest scan: 2026-10-19 · 187 scan passes to date · the series cannot be backfilled.
From advertised to evaluable
Registries advertise an order of magnitude more servers than are genuinely usable. Glama alone auto-indexes 74,277 repos. Here is the drop from everything catalogued to the maintained, evaluable working set.
By source
| Source | Listed | With a repo | Remote-only |
|---|---|---|---|
| Our GitHub deep-scan | 3,700 | 3,700 | n/a |
| Glama | 74,277 | 74,277 | 0 |
| Official MCP registry | 46,303 | 32,068 | 14,235 |
| Smithery (reports 20,782; API exposes 830) | 830 | 0 | 830 |
Deduped union across all sources: 89,619 distinct repositories plus 15,065 remote-only / hosted servers with no public repo.
Adoption, not just listings
Listings count what exists. Downloads count what people actually run. We pull the monthly install totals for every npm and PyPI package the official registry references, the closest public signal to real usage.
| npm | @playwright/mcp | 28M /mo |
| npm | firebase-tools | 9.8M /mo |
| pypi | browser-use | 8.1M /mo |
| npm | chrome-devtools-mcp | 7.8M /mo |
| npm | @storybook/addon-mcp | 7.3M /mo |
| npm | @upstash/context7-mcp | 3.7M /mo |
| npm | snyk | 2.8M /mo |
| pypi | mcp-proxy-for-aws | 1.3M /mo |
Counts cover the packages we resolved download data for (not every package the registry lists) and include CI, mirrors, and bots, so treat them as an upper bound on human use. A handful of core packages dominate; the long tail barely registers, the same concentration the funnel shows.
Agents are already settling, on-chain
Beyond listings and installs: real money. We sampled a full day of the EIP-3009 gasless-settlement rail on Base USDC (the mechanism the x402 payment protocol rides), straight from the chain.
Scope-honest: AuthorizationUsed events capture every EIP-3009 gasless settlement on Base USDC, the rail x402 uses but not x402 alone, so read this as an upper bound on x402-specific volume. Sampled over a full day of chain on 2026-10-17, read-only via public JSON-RPC.
Security surface
A static read of the source for the 2,998 active, maintained servers, looking for security-relevant code patterns. This is read-only: we never connect to, run, or probe a server. These are signals of attack surface visible in the code, not confirmed vulnerabilities, and we publish population statistics only.
| ssrf surface | 34% | |
| code execution | 3.7% | |
| command injection | 1.8% | |
| unsafe deserialization | 0.5% | |
| hardcoded secret | 0.4% |
Heuristics tuned for precision over recall, so these are lower bounds. Per-repo findings are held for coordinated disclosure to maintainers, not published here. "High surface" means the code does risky things in risky ways and deserves a closer look, never that a server is compromised.
The full security scoreboard: tiers, trend, methodology, and the disclosure posture →
The identity gap: of the servers taking sensitive actions, how many check who is calling →
The subset we assess in depth
The series
Catalogued servers (orange) and the maintained subset (grey, dashed), captured weekly. It starts thin on purpose: a longitudinal record can't be reconstructed after the fact, so the value is in starting it and never missing a week.
Methodology & honest caveats
- Firsthand and open. Scanned via the open-source scanner (GitHub topic + org search). Read-only; no third-party servers are probed.
- Four sources, deduped. Beyond GitHub topic search we cross-reference the official MCP registry, Glama, and Smithery, then dedupe by repository. Glama auto-indexes broadly (low signal); the official registry is authoritative; Smithery's public API exposes only 500 of its reported 20,782.
- Population is a lower bound. Search-driven discovery misses untagged repos, so the true count is somewhat higher than what we catalogue.
- Transport is a heuristic. stdio / HTTP / both is inferred from README phrasing. A signal, not ground truth.
- Security is published as aggregates only. Static-analysis sweeps produce per-repo findings that go to maintainers via coordinated disclosure; the dataset carries tier counts, histograms, and prevalence, never a repo-to-score mapping.
Release calendar
Every series here publishes on a fixed cadence, so you know when the next number lands before it does.
- Weekly, Saturdays: the full ecosystem sweep refreshes the Agent Trust Index, security, identity, and supply-chain series, and the MCP census aggregates.
- Continuous: Threshold Watch archives a new snapshot whenever a lab's safety framework changes (RSS above); the Frontier Incident Timeline and Agent Identity Tracker update as qualifying events occur.
- Quarterly, first Monday: the State of MCP, State of AEO, and State of Agent Memory reports. Next release: January 4, 2027.
Download & cite
Versioned bundle v2026-Q3
Frozen, checksummed, citable. SHA-256 for every file in the manifest.
- Server population (CSV)
- Weekly longitudinal series (CSV)
- Security distributions (JSON)
- Identity-gap distributions (JSON)
- Supply-chain distributions (JSON)
- Discovery provenance (CSV)
- Data dictionary · Manifest + checksums
Live (unversioned) feeds: summary stats · time series
Cite this dataset
Major, C. / Major Labs (2026). State of MCP: an open dataset of the public MCP server ecosystem, v2026-Q3. majorlabs.co/data. DOI: 10.5281/zenodo.22674847.
@misc{majorlabs_state_of_mcp_2026,
author = {Major, Charlie},
title = {State of MCP: an open dataset of the
public MCP server ecosystem},
year = {2026},
version = {v2026-Q3},
publisher = {Major Labs},
url = {https://majorlabs.co/data},
doi = {10.5281/zenodo.22674847}
}Data: CC BY 4.0 · Code: MIT (mcp-scanner). The weekly series began June 2026 and cannot be backfilled; per-repo findings are never published (coordinated disclosure only).