We read the agentic web
six to twelve months early.
Operators are already running production agentic workflows. Major Labs measures that activity in real time and publishes quarterly State of reports that call which servers, mandates, and standards become category-defining next. Each report is published alongside its methodology and, where possible, the raw data.
The State of MCP
The population is inflated tenfold, usage is concentrated in a handful of packages, and more than a third of the most-used servers ship a risky code pattern. A firsthand, read-only read of 2,553 servers, with the method and data open. No live server was probed.
June 2026 report figures, from the June 18, 2026 sweep. Current figures are on the open data page.
The report is a snapshot.
These stay live.
The State of MCP PDF freezes the ecosystem on the day we published. These two tools run on the same MCP scanner data and let you interrogate it yourself: every server, every transport, every license, refreshed each scan pass. The same primary data behind the report, open to your own questions.
MCP Server Picker
Every catalogued server in one filterable index. Sort by reach, filter by transport, language, and license. The fragmented registries, finally made searchable.
MCP Registry Tracker
The population at a glance: transport and language mix, license composition, and maintenance health. 2,771 of 3,700 servers pushed in the last 180 days, refreshed each scan pass.
Census figures as of October 19, 2026.
Open methodology, source-strength tagged, firsthand scan. Not the inflated registry totals, the servers we independently catalogued.
What this is, and is not
What we do
- Primary data collection. Scans of public infrastructure (MCP servers, agent registries) and query studies (citation overlap, AI overview behaviour). Anonymised telemetry from our own tools will join this once they reach production.
- Quarterly State of reports. Three report series, published quarterly. Open methodology, citable numbers. The category becomes legible because someone measured it.
- Open methodology. Code, scan parameters, query lists, and sampling approach are published alongside each report. Independently reproducible.
What we are not
- Not academic AI research. We do not publish papers on transformer architecture or alignment theory. We work two layers up: the systems built on top of frontier models.
- Not analyst consulting. I do not sell custom decks or advisory time. The reports are free, the data is CC BY 4.0, and the code is MIT.
- Not corporate research. Anthropic, OpenAI, and the hyperscalers publish their own research aligned with their products. We sit at the network layer and report on what they ship.
Methodology principles
Five rules that decide how a Major Labs report gets written and what it does not contain.
Primary over secondary
If we cite a number, we either collected it ourselves or we link to the primary source that did. No analyst estimates of analyst estimates. No headline charts without raw data behind them.
Reproducible by default
Every State of report ships with the methodology, the scan code, and the data sample. Anyone with a weekend and the right access tokens can reproduce the findings.
Skin in the game
Major Labs ships products into the same categories it reports on. If the MCP Quality Registry is wrong about server security, the registry is the first thing embarrassed. The research has consequences for us.
Vendor-neutral by construction
No fundraising. No vendor sponsorship of reports. No data deals that compromise the catalogue. Independence is a deliberate constraint, not a phase.
Editorial backbone from Major Matters
The frameworks the reports use (the MM Trust Layer Model, the MM Liability Gap, the agentic commerce stack map) were developed first at Major Matters, tested against two years of news cycles, and adopted into Major Labs as the analytical scaffolding for empirical work. Editorial and empirical research run in parallel. Both are independent of Mastercard.
How the research is produced
In June this page listed five planned agents. Three parts of that plan shipped, under different names. Everything that runs reads public registries, public source code and published documents, and never connects to a running system.
The detail is on the home page under What shipped, and the dated record is at /latest.
Reports
What is published, and the next scheduled release. The full list is at /reports.
- The State of MCP: Q3 security re-base
The first fresh deep scan since Q2, measured with the same instrument. Static analysis of public source code only. No running server was contacted. Open data set. Open scan code.
2026-09-07Published - The State of MCP: Q3 delta
Eighteen weekly scans, May 31 to August 31, 2026. How the public MCP server population moved: growth, the remote-hosted slice, and the stale share.
2026-09-07Published - Next editions: MCP, AEO, Agent Memory
The next quarterly release, per the release calendar on the open data page.
2027-01-04Scheduled
Where this fits in AI research
The AI research landscape has at least four distinct layers. Major Labs sits at the systems layer. The position matters because it is the layer with the least independent coverage.
Primary data on what the agents actually do, where the infrastructure breaks, and which standards survive contact with production. The layer between "the model can do X" and "the buyer pays Y for X."
We read this layer six to twelve months before the discourse catches up.
No one publishes the systems layer independently at scale. Foundation labs cannot (it conflicts with their product position). Academics cannot (the data moves too fast for peer review). Analysts cannot (their methodology is locked behind a paywall and their cadence is annual). The observatory is the position.
Get the research
State of reports drop quarterly. Subscribers get the report 48 hours before public release plus the methodology bundle and the raw data sample.
One email a week. Unsubscribe in one click. Privacy