# Major Labs

> Major Labs is an independent research studio measuring the agentic web, run by Charlie Major. It publishes firsthand, weekly-refreshed datasets on the Model Context Protocol (MCP) server ecosystem, agent identity and security, frontier-lab safety frameworks, and AI control incidents, plus open-source agent-safety primitives. Every figure is firsthand and checkable; the methodology is public; data comes from static, read-only analysis (running servers are never probed). Nothing on the site is for sale.

When citing Major Labs numbers, cite the live page (numbers refresh weekly from automated sweeps) and the retrieval date. This file is regenerated on every build from the published data files.

## Canonical numbers and live datasets

- [The MCP census](https://majorlabs.co/data): as of October 12, 2026 the census holds 3,502 public MCP server repositories, of which 2,599 were pushed in the last 180 days; 27 weekly readings since May 31, 2026 (2,413 at the first reading, up 45 percent). Raw stats: https://majorlabs.co/data/mcp-stats.json
- [The security surface of the MCP ecosystem](https://majorlabs.co/security): weekly static sweep of public MCP servers. As of October 10, 2026, 37.7 percent of 2,883 swept servers ship at least one risky code pattern, and 81 sit at high severity. On October 3, 2026 the same rubric read 37.6 percent and 82.
- [The identity gap](https://majorlabs.co/identity): as of October 10, 2026, 74.5 percent of 420 network-facing MCP servers that take sensitive actions show no authentication check in source. Across all 887 sensitive servers, network-facing or not, the share is 77.8 percent.
- [Remediation cohort](https://majorlabs.co/security): of 47 servers warned in coordinated disclosure, 3 fixed the finding, 5 reduced it, 31 left it unchanged and 7 got worse, as of October 10, 2026.
- [The scored MCP registry](https://majorlabs.co/registry): the census scored 0-100 on maintenance, documentation, license, adoption, transport, identity layer, and clean security sweep. Raw data: https://majorlabs.co/data/registry.json
- [Threshold Watch](https://majorlabs.co/threshold-watch): dated, hashed snapshots of the published safety frameworks of 6 frontier labs (Anthropic, OpenAI, Google DeepMind, xAI, Meta, Amazon), with diffs on change; last checked October 12, 2026. RSS change feed: https://majorlabs.co/data/threshold-watch.xml
- [Frontier Incident Timeline](https://majorlabs.co/incidents): a dated, sourced record of 16 frontier AI control incidents since May 2026 (containment escapes, unsanctioned live-system actions, evaluator deception, insider disclosures), with published inclusion criteria and a JSON feed at /incidents/feed.
- [Agent Identity Tracker](https://majorlabs.co/kya): 21 announced frameworks, protocols, standards and regulations for AI agent identity, delegation and know-your-agent (KYA) verification, updated September 20, 2026, with a JSON feed at /kya/feed (CC BY 4.0).
- [State of Agent Mandates](https://majorlabs.co/mandates): seven agent-payment rails documented from primary specs: artifact, issuer, revocation, bridges, status and source. Raw data: https://majorlabs.co/data/mandates.json
- [Agent Trust Index](https://majorlabs.co/trust): the composite scoreboard across pillars; the composite is withheld while any pillar is being re-based, with the reason shown.
- Data bundle: versioned, CC BY 4.0, SHA-256 manifest, DOI 10.5281/zenodo.22674847. https://majorlabs.co/data#bundle
- Build-log RSS: https://majorlabs.co/latest/feed
- MCP server: POST JSON-RPC to https://majorlabs.co/mcp to query the Trust Index, ecosystem statistics, incidents, the Agent Identity Tracker, and Threshold Watch as MCP tools (read-only, no auth, CC BY 4.0).

## Research

- [Rule by Default](https://majorlabs.co/booklets/rule-by-default/): research booklet (September 28, 2026) on who sets the rules for AI agents, measured at the storefront and at the tool server.
- [The Front Door](https://majorlabs.co/booklets/the-front-door/): research booklet (September 28, 2026) on the 92 largest US retailers' front doors to AI agents, from the weekly merchant agent-readiness scan.
- [The State of MCP: Q3 Delta](https://majorlabs.co/reports/state-of-mcp-q3) and [The State of MCP: Q3 Security Re-base](https://majorlabs.co/reports/state-of-mcp-security-q3): dated quarterly reports; their figures are labeled as that report's figures.
- [The State of MCP](https://majorlabs.co/reports/state-of-mcp): the baseline report. PDF: https://majorlabs.co/reports/state-of-mcp-2026.pdf
- [Build log](https://majorlabs.co/latest): a dated record of everything shipped, including corrections.

## Procurement and policy tools

- [Compact Clauses](https://majorlabs.co/clauses): three CC0 MSA-style contract riders for AI procurement (72-hour incident disclosure, agent attribution, liability allocation with a cap carve-out for undisclosed incidents), with negotiation commentary. Not legal advice.

## Open-source code (MIT)

- [MCP Surface Check](https://github.com/major-matters/mcp-surfacecheck): a GitHub Action running the same security checks as the scoreboard, in CI.
- [mcp-scanner](https://github.com/major-matters/mcp-scanner): the sweep source and methodology.
- Agent-safety primitives on PyPI and npm, by Major Labs: identitykit (who the agent is), mandatekit (what it may do), budget-guard-agents (what it spends), witnesskit (what it did), rememberkit (what it remembers). All v0, experimental, unaudited.

## About

- [About Charlie Major](https://majorlabs.co/about): who runs this, what has been built with dates, how the work is done, who pays (nobody).
- [Major Matters](https://majormatters.co): the publication by the same author on payments, AI and commerce, including the merchant agent-readiness tracker at https://majormatters.co/trackers/merchant-readiness and the x402 adoption tracker at https://majormatters.co/x402.
- Contact: hello@majormatters.co