The agentic web, measured
An open, versioned read on the public MCP server ecosystem, triangulated across four sources and updated weekly. The headline counts everyone repeats are inflated; the useful signal is the gap between what registries advertise and what is actually maintained. Code and methodology are public so anyone can check us.
Latest scan: 2026-07-20 · 88 scan passes to date · the series cannot be backfilled.
From advertised to evaluable
Registries advertise an order of magnitude more servers than are genuinely usable. Glama alone auto-indexes 57,060 repos. Here is the drop from everything catalogued to the maintained, evaluable working set.
By source
| Source | Listed | With a repo | Remote-only |
|---|---|---|---|
| Our GitHub deep-scan | 2,802 | 2,802 | — |
| Glama | 57,060 | 57,060 | 0 |
| Official MCP registry | 17,766 | 14,611 | 3,155 |
| Smithery (reports 7,208; API exposes 716) | 716 | 0 | 716 |
Deduped union across all sources: 65,029 distinct repositories plus 3,871 remote-only / hosted servers with no public repo.
Adoption, not just listings
Listings count what exists. Downloads count what people actually run. We pull the monthly install totals for every npm and PyPI package the official registry references, the closest public signal to real usage.
| pypi | browser-use | 97M /mo |
| npm | @playwright/mcp | 24M /mo |
| npm | chrome-devtools-mcp | 11M /mo |
| npm | firebase-tools | 9.1M /mo |
| npm | @storybook/addon-mcp | 6.1M /mo |
| npm | @upstash/context7-mcp | 3.7M /mo |
| npm | snyk | 2.6M /mo |
| pypi | mcp-proxy-for-aws | 2.0M /mo |
Counts cover the packages we resolved download data for (not every package the registry lists) and include CI, mirrors, and bots, so treat them as an upper bound on human use. A handful of core packages dominate; the long tail barely registers, the same concentration the funnel shows.
Agents are already settling, on-chain
Beyond listings and installs: real money. We sampled a full day of the EIP-3009 gasless-settlement rail on Base USDC — the mechanism the x402 payment protocol rides — straight from the chain.
Scope-honest: AuthorizationUsed events capture every EIP-3009 gasless settlement on Base USDC, the rail x402 uses but not x402 alone, so read this as an upper bound on x402-specific volume. Sampled over a full day of chain on 2026-06-18, read-only via public JSON-RPC.
Security surface
A static read of the source for the 2,001 active, maintained servers, looking for security-relevant code patterns. This is read-only: we never connect to, run, or probe a server. These are signals of attack surface visible in the code, not confirmed vulnerabilities, and we publish population statistics only.
| ssrf surface | 32% | |
| code execution | 3.2% | |
| command injection | 2.2% | |
| unsafe deserialization | 0.5% | |
| hardcoded secret | 0.4% |
Heuristics tuned for precision over recall, so these are lower bounds. Per-repo findings are held for coordinated disclosure to maintainers, not published here. "High surface" means the code does risky things in risky ways and deserves a closer look, never that a server is compromised.
The full security scoreboard: tiers, trend, methodology, and the disclosure posture →
The identity gap: of the servers taking sensitive actions, how many check who is calling →
The subset we assess in depth
The series
Catalogued servers (orange) and the maintained subset (grey, dashed), captured weekly. It starts thin on purpose: a longitudinal record can't be reconstructed after the fact, so the value is in starting it and never missing a week.
Methodology & honest caveats
- Firsthand and open. Scanned via the open-source scanner (GitHub topic + org search). Read-only; no third-party servers are probed.
- Four sources, deduped. Beyond GitHub topic search we cross-reference the official MCP registry, Glama, and Smithery, then dedupe by repository. Glama auto-indexes broadly (low signal); the official registry is authoritative; Smithery's public API exposes only 500 of its reported 7,208.
- Population is a lower bound. Search-driven discovery misses untagged repos, so the true count is somewhat higher than what we catalogue.
- Transport is a heuristic. stdio / HTTP / both is inferred from README phrasing. A signal, not ground truth.
- No security scores yet. Vulnerability probing is a later sweep; we don't publish those numbers as fact until it runs.
Cite this
Major Labs (2026). State of MCP: an open dataset of the public MCP server ecosystem. majorlabs.co/data, accessed 2026-07-20.
Stable URL. A versioned DOI is planned.