# State of MCP — open dataset (v2026-Q3)

Longitudinal, firsthand measurement of the public MCP (Model Context Protocol)
server ecosystem by Major Labs (majorlabs.co). Weekly scans since June 2026;
the series cannot be backfilled.

License: CC BY 4.0 (data), MIT (scanner code: github.com/major-matters/mcp-scanner).
Cite as: Major Matters Research Ltd / Major Labs (2026). "State of MCP: an open
dataset of the public MCP server ecosystem", v2026-Q3. majorlabs.co/data. DOI: pending.

## Files

- mcp-servers.csv — one row per catalogued repository: public GitHub metadata
  (name, stars, license, dates, topics, discovery sources) plus derived signals
  (transport classification, manifest-presence flags). No file contents or
  README bodies are included; short strings are email-redacted.
- discovery-runs.csv — provenance: every discovery query, source, and result
  count, timestamped.
- aggregate-history.csv — the weekly longitudinal series: catalogued and
  maintained population, risky-pattern share, high-surface count, identity gap.
- security-distribution.json — aggregate security-sweep distributions: tier
  counts, score histogram, per-category prevalence.
- identity-distribution.json — aggregate identity-gap distributions.
- supplychain-distribution.json — aggregate dependency/vulnerability
  distributions (method re-based Q3 2026).
- MANIFEST.json — version, generation date, row counts, SHA-256 checksums.

## What is deliberately absent

Per-repository security, identity, or supply-chain findings and scores.
Those go to maintainers through coordinated disclosure (45-day grace,
private-first) and are only ever published as the aggregates above.
See majorlabs.co/security for the posture.

## Method in one paragraph

Discovery unions four sources (GitHub topic/org search, the official MCP
registry, Glama, Smithery), deduped by repository. Analysis is read-only
static inspection of public source; no server is ever run or probed.
Security/identity heuristics are tuned for precision over recall, so
prevalence figures are lower bounds. Full methodology: majorlabs.co/data
and the scanner source.