State of MCP, Q1 2027: the method, fixed before the data
The next State of MCP report is due January 4, 2027 and covers the fourth quarter of 2026. This page fixes, while the quarter is still running, what I will measure, over which population, which tables the report will contain and what I will say if nothing moves. It exists so the report cannot be shaped by its result. Published October 25, 2026.
1. What will be measured
Each measure below is defined the way the code implements it today, with its unit and the date its series begins in mcp-history.json. The definitions are frozen by this page; the governance charter says what happens when one has to change.
Rows in the repos table: every GitHub repository the five discovery queries have ever returned. Never pruned.
Active: last push within 180 days of the sweep date. Stale: every other tracked server. Stale share is stale over tracked.
GitHub archived flag set at the latest discovery pass.
README matches the HTTP transport pattern (SSE, streamable HTTP, an /mcp or /sse URL, a docker run with a published port), with or without a stdio match.
Of servers with a security score, the share with at least one hit from the ten checks: shell=True, os.system or os.popen, child_process.exec, exec with an interpolated string, eval or exec, new Function or vm, pickle or unsafe yaml.load, an outbound request to a non-literal URL, a hard-coded credential. At most 12 of the shallowest Python and JavaScript or TypeScript files; test, docs, examples, vendor and build paths, files over 200 KB and comment lines skipped.
Score is the sum of category weights (30, 20 or 15), each category counted once, capped at 100. High is above 30, Elevated above 0, Low is 0.
Of servers whose README signals HTTP transport and whose source matches a sensitive-action pattern (subprocess or child_process, file write or delete, an SQL INSERT, UPDATE, DELETE, DROP or ALTER, a mail or payment SDK), with hits under scripts, tools, benchmarks and .github ignored: the share with no authentication pattern anywhere in the same files (Authorization header, JWT verify or timing-safe compare, OAuth or OIDC wiring, MCP SDK auth helpers, an API-key check).
Of servers with at least one dependency parsed from package.json, pyproject.toml, requirements.txt, go.mod or Cargo.toml, the share with one or more runtime dependencies whose declared floor version carries an OSV.dev advisory. Dev and test dependencies do not count.
The 47 High-tier servers frozen in the disclosure index around June 10, 2026, re-scanned with the same security checks. Fixed means zero findings; reduced, unchanged and increased compare the finding count with the frozen one; unreachable means the repository could not be fetched.
2. Population and inclusion
Discovery is GitHub only: topic searches for mcp-server, model-context-protocol and modelcontextprotocol, every public repository in the modelcontextprotocol organization, and a name-or-description search for "mcp server" with forks excluded. GitHub returns at most 1,000 results per search, so the census is a lower bound. A server is one repository. Once discovered it stays in the census, so the tracked count never falls; active and stale are reported beside it for that reason.
The security and identity scans run each week over repositories that are not archived, not forks and pushed within 180 days. A repository that later goes stale keeps its last score, so the deep-scan denominators are every server ever scored, at its latest score. Listings from the official registry, Glama and Smithery, npm and PyPI download counts, and remote-only servers with no repository are collected but feed none of the measures above.
3. Evaluation matrix
Baseline: the last weekly snapshot dated on or before September 30, 2026 (today that is September 28). Endpoint: the last weekly snapshot dated on or before December 31, 2026. Change is endpoint over baseline, minus one. The report will contain these four tables and four figures, and nothing else that is presented as a result.
| Table | Rows | Columns |
|---|---|---|
| T1 Population | tracked, active, stale, remote-hosted, stale share | baseline, endpoint, change |
| T2 Deep-scan scorecard | risky-pattern share, High count, identity gap, servers scored, supply-chain exposure (marked re-based), composite (withheld) | baseline, endpoint, direction |
| T3 Remediation cohort | fixed, reduced, unchanged, increased, unreachable | first and last re-scan in the window |
| T4 Continuity with Q3 | the four figures the Q3 security report published as of September 5 (37.5 percent risky, 67 High, 78.6 percent sensitive with no auth on any transport, 2,408 scored) | Q3 value, endpoint value, as-of dates |
Figures: F1, servers tracked, one point per weekly snapshot in the window. F2, growth by slice (remote-hosted, active, all, stale). F3, severity tiers at the endpoint, each server once. F4, identity posture at the endpoint in four rows: no sensitive action, sensitive with no auth, auth only, sensitive with auth.
Direction words are fixed now. A share is flat when it moves less than 2.0 percentage points; a count is flat when it moves less than three percent. Otherwise it is worse or better, with more risk, a wider gap or more exposure counting as worse. The headline states the direction of the risky-pattern share and the identity gap, whichever way they go.
4. Scripts and commit
Every number comes from these files in the public repository at commit 7b01a148773b233cd6c9e98276fc2b3cd890d760, which is the commit that holds the analysis scripts; this page's own source was committed afterwards, and the hash below reproduces against the file as it stands at the head of the repository. The tables and figures are computed from site/public/data/mcp-history.json and mcp-stats.json by the formulas on this page; there is no further script.
5. Null and negative results
A flat quarter is a result and will be the headline if that is what the data says. A sweep in which more than five percent of fetches fail publishes nothing; that week is a gap in F1, never interpolated. If fewer than 10 of the 13 Saturdays in the window have a snapshot, the quarter is reported as under-sampled and no growth figure is given. If a pillar's scan date lags the population date by more than 21 days at the endpoint, that pillar is reported as carried forward, with both dates, and no change is claimed for it. A cohort that moves against the lab's thesis (more servers worse than fixed) gets the same prominence in T3 as the reverse.
6. Not preregistered, labeled exploratory
Supply-chain exposure. The series read 75.2 percent through August, 36.2 percent after the September 5 re-base, then 70.9 percent on September 26 and 82.2 percent on October 24, with no change to the scanner file in that time. I do not yet know why, so the pillar is reported as re-based from September 26, its change carries no direction word, and the composite Trust Index stays withheld. Whether the composite resumes is a decision for the Q2 2027 preregistration, not this report.
Also exploratory: registry listing counts, download counts, the on-chain commerce sample, the manifest-shape side table, and any cut by stars, language or transport. The funnel row "genuinely evaluable" is a hand-set estimate, not a measurement, and will not appear.
7. Amendments
Nothing in sections 1 to 4 changes after this page is published. If the quarter forces a change, it is written here as a dated amendment that says what changed and why, and the report cites it. Amendments to date: none.
8. Hash
SHA-256 of this page's source file, excluding the one line that holds the hash: 40ba2fc7a02ae3a806d9a39656bd74066486a7af26fd88e0b10797b3b9dfc016
Computed from the repository root with grep -v '^const SOURCE_SHA256 =' site/app/method/state-of-mcp-q1-2027/page.tsx | shasum -a 256. Anyone with the repository can recompute it; a different result means the page changed.
See also: governance, the Q3 population delta, the Q3 security re-base, build log.