The State of MCP

The population is inflated by an order of magnitude

The counts everyone repeats are marketing. Across three registries we find 44,347 distinct servers advertised, plus 2,274 remote-only hosted servers with no public repo. We deep-scanned 2,553 firsthand and found roughly ~1,934 that are genuinely evaluable: maintained, documented, and not an abandoned experiment.

That is a 23x gap between what is advertised and what is real. One catalogue auto-indexes roughly 37,600 repos, anything vaguely MCP-shaped, and reports tens of thousands. The maintained core is a fraction of that. "10,000-plus MCP servers" is true only if you count the experiments no one has touched in six months.

The gap between advertised and evaluable is not a footnote. It is the finding.

Adoption is brutally concentrated

Listings count what exists; downloads count what people run. We track 66.7M monthly downloads (61.4M across 4,653 npm packages, 5.3M on PyPI), but the distribution is top-heavy to the point of distortion.

A handful of vendor-backed servers carry most of the volume; thousands of community servers see almost none. "The ecosystem" people actually depend on is small, and largely built by a few companies. Counts include CI, mirrors, and bots, so read them as an upper bound.

A third of the maintained core ship a risky pattern

We ran a static, read-only read of the source for the evaluable core. We never connect to, run, install, or probe a server. Of 1,934 scored, 36% (689) ship at least one risky pattern.

SSRF surface is the dominant risk at 32% (618 servers): an agent tool that builds an outbound request from a model-supplied argument with no allow-list, the canonical way an agent gets steered at an internal endpoint. Command injection and arbitrary code execution are rarer but more direct.

What this is not: confirmed vulnerabilities, exploit proof, or anything run against a live server. The heuristics favour precision over recall, so every figure is a lower bound. Per-repo findings are held for coordinated disclosure to maintainers, not named here.

This is the honest version of the SSRF percentages that circulate unsourced: measured firsthand, from the code, with the method published.

Sensitive data, no front door

Of 1,871 servers scored for identity, 25% (474) handle sensitive data, credentials, tokens, personal or financial fields, while exposing no authentication or authorization layer of their own. The protocol moved the data; it did not move the front door.

This is the layer agentic commerce keeps running into. Connection is solved. Proof that the human authorized the action is not, and it has to travel across whichever protocol the agent happens to speak.

Translation between protocols is not the same as proving who approved the spend.

Three in four ship a known-vulnerable dependency

Of 1,377 servers with a resolvable dependency tree, 75% (1,036) ship at least one dependency with a known CVE. MCP servers inherit the npm and PyPI supply chain wholesale, and most have not patched it.

One weekly score. It sits at 38 out of 100.

0 to 100, higher is safer. Identity and supply chain are the two pillars that matter most the moment an agent touches money, and they are the weakest. The series is tracked weekly and cannot be backfilled.

What it means

• For builders. The registry count is noise. Filter to the maintained, evaluable core, read the source, and do not wire a payment credential or filesystem access into a server you have not looked at.
• For the ecosystem. Registries rank by recency and stars, not quality or safety. The missing signal is exactly what a scored, security-aware registry would provide.
• For the agentic web. The protocol shipped fast; the safety layer did not. Identity, mandates, budgets, and provenance are absent by default, and that layer has to sit across every protocol. That gap is why Major Labs builds them.

Methodology & honest caveats

• Three sources, deduped. The official MCP registry, Glama, and Smithery, plus our firsthand GitHub deep-scan, deduplicated by repository. Population is a lower bound; search-driven discovery misses untagged repos.
• Read-only throughout. Every pass, including the security, identity, and supply-chain sweeps, reads public source and metadata via APIs. No MCP server is connected to, run, or probed.
• Static and heuristic. Pattern analysis of source over the maintained core, tuned for precision. Signals of attack surface, not confirmed vulnerabilities.
• Downloads include automated traffic. npm and PyPI APIs; coverage disclosed, counts include CI, mirrors, and bots.
• The series cannot be backfilled. A longitudinal record can only be built going forward, which is why we never miss a week.