State of MCP servers, October 2026

This is the first edition of the State of MCP servers: what the 53,935 active servers in the official MCP registry look like from the outside at the end of October 2026. Every figure comes from protogrid's own probes, quality checks and dependency graphs, aggregated; the charts and tables give the counts, and the method at the end says what they can and cannot tell.

What stands out

The new protocol is still a minority

Of 36,700 remote endpoints, 5,045 (14%) answer the 2026-07-28 protocol version, three months after it shipped; 17,547 answer only older versions and 11,100 ask for credentials before any handshake, so their version cannot be seen from outside. Nearly every endpoint that answers 2026-07-28 also works without a session.

Authorization is moving to Client ID Metadata Documents, slowly

Of 9,467 OAuth endpoints, 34% support Client ID Metadata Documents, while 64% still offer only Dynamic Client Registration, which 2026-07-28 deprecates. Almost all of them (98%) publish Protected Resource Metadata, so clients can find their authorization server without guessing.

One advisory explains most of the failures

51% of the 11,632 servers with resolved dependencies carry at least one known advisory. Most of it is a single one: GHSA-mrhx-c7xc-m3w5 in zod (npm, HIGH, published on October 1), where validating an oversized constrained collection can exhaust memory. It reaches 4,224 servers and affects every version below 4.6.6; nearly all of them resolve zod 3.25.76, and the 3.x line has no fixed release, so they can only clear it by moving to zod 4.6.6 or later.

The official TypeScript SDK caught up fast

GHSA-6qxp-vccf-f47h, published on October 6, let an MCP server choose the authorization server that received a client's stored OAuth credentials; it was fixed in @modelcontextprotocol/sdk 1.31.0. Twenty-five days later, 508 servers (5% of those whose official MCP SDK version we can resolve) still depend on a version with an advisory. Much of the speed comes from version ranges: a package that accepts any 1.x release resolves to the newest one, so an author who never touched the code is counted as up to date once the range allows it.

Tool lists are larger than they look

Half of the servers with public tools cost under 1,670 tokens to load, but one in ten costs over 24,000, a large share of a model's context before the first message. 64% of those servers mark their tools as read-only or destructive, the hint clients use to ask before acting.

Changes: read the counts with one publisher in mind

The tool-change totals include a family of about 1,900 servers from one publisher whose tool descriptions embed live counters (how many tools and sources it covers), so almost every probe recorded a "changed" description. Between October 26 and 30 that family accounts for 29,300 of the 65,087 changes in the chart: it added 14,728 tools and changed 14,570 descriptions, and it went quiet on October 31. Across the whole window, 18,991 of the 55,675 changes that touched only a description differ in numbers alone. The 14,351 changes of meaning are not affected: a new number keeps nearly every word of the text. Separately, 1,754 servers list a different set of tools from one session to the next; the chart leaves those tools out.

42% of servers cannot be scored, and we say so

22,552 servers publish no remote endpoint or keep their tools behind sign-in; they are shown as not scored rather than given a score from metadata alone. The scored servers average 84.

About this edition

The data was read from a database snapshot taken at 04:24 UTC on November 1; tool changes after October 31 are left out.

Method and limits

• Every number comes from protogrid's own credential-free probes of the endpoints listed in the official MCP registry, the registry's metadata, deps.dev and OSV.dev. No tool was called, nothing was installed or run, and no audit is implied.
• Endpoints behind sign-in show only their public authorization metadata, so tool figures cover servers whose tools are public.
• Scores and checks are described on the quality page; every server's report is public on protogrid.dev.
• No MCP server is named for a negative finding. Server authors can check their server or claim it for alerts.
• Every active listing counts, including the 293 that protogrid hides from search for adult content or gambling; they are never named.
• Each edition takes its data on the last day of its month.
• Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. This report and its dataset are CC BY 4.0 too.

Data and citation

Every figure on this page comes from one file of aggregates, free to reuse under CC BY 4.0 with credit to protogrid. The same report as Markdown, with every table, is written for language models and scripts.