# State of MCP servers, October 2026

> What the 53,935 active servers in the official MCP registry look like from the outside: protocol adoption, authorization, tool hygiene, tool changes, dependencies and quality. Measured by protogrid without credentials; aggregates only, no server named for a negative finding.

- Published: 2026-11-04; data as of 2026-10-31
- Article: https://protogrid.dev/reports/state-of-mcp-servers-october-2026
- Dataset (JSON, CC BY 4.0): https://protogrid.dev/reports/2026-10.json

## Key figures

- 14% of remote endpoints answer the 2026-07-28 protocol.
- 64% of OAuth endpoints offer only the deprecated Dynamic Client Registration.
- 51% of servers with resolved dependencies carry a known advisory.
- 42% of servers cannot be scored from the outside.
- 53,935 active servers, 36,700 remote endpoints and 375,723 public tools measured.

This is the first edition of the State of MCP servers: what the 53,935 active servers in the official MCP registry look like from the outside at the end of October 2026.
Every figure comes from protogrid's own probes, quality checks and dependency graphs, aggregated; the charts and tables give the counts, and the method at the end says what they can and cannot tell.

## What stands out

### The new protocol is still a minority
Of 36,700 remote endpoints, 5,045 (14%) answer the 2026-07-28 protocol version, three months after it shipped; 17,547 answer only older versions and 11,100 ask for credentials before any handshake, so their version cannot be seen from outside.
Nearly every endpoint that answers 2026-07-28 also works without a session.

### Authorization is moving to Client ID Metadata Documents, slowly
Of 9,467 OAuth endpoints, 34% support Client ID Metadata Documents, while 64% still offer only Dynamic Client Registration, which 2026-07-28 deprecates.
Almost all of them (98%) publish Protected Resource Metadata, so clients can find their authorization server without guessing.

### One advisory explains most of the failures
51% of the 11,632 servers with resolved dependencies carry at least one known advisory.
Most of it is a single one: GHSA-mrhx-c7xc-m3w5 in `zod` (npm, HIGH, published on October 1), where validating an oversized constrained collection can exhaust memory.
It reaches 4,224 servers and affects every version below 4.6.6; nearly all of them resolve `zod` 3.25.76, and the 3.x line has no fixed release, so they can only clear it by moving to `zod` 4.6.6 or later.

### The official TypeScript SDK caught up fast
GHSA-6qxp-vccf-f47h, published on October 6, let an MCP server choose the authorization server that received a client's stored OAuth credentials; it was fixed in `@modelcontextprotocol/sdk` 1.31.0.
Twenty-five days later, 508 servers (5% of those whose official MCP SDK version we can resolve) still depend on a version with an advisory.
Much of the speed comes from version ranges: a package that accepts any 1.x release resolves to the newest one, so an author who never touched the code is counted as up to date once the range allows it.

### Tool lists are larger than they look
Half of the servers with public tools cost under 1,670 tokens to load, but one in ten costs over 24,000, a large share of a model's context before the first message.
64% of those servers mark their tools as read-only or destructive, the hint clients use to ask before acting.

### Changes: read the counts with one publisher in mind
The tool-change totals include a family of about 1,900 servers from one publisher whose tool descriptions embed live counters (how many tools and sources it covers), so almost every probe recorded a "changed" description.
Between October 26 and 30 that family accounts for 29,300 of the 65,087 changes in the chart: it added 14,728 tools and changed 14,570 descriptions, and it went quiet on October 31.
Across the whole window, 18,991 of the 55,675 changes that touched only a description differ in numbers alone.
The 14,351 changes of meaning are not affected: a new number keeps nearly every word of the text.
Separately, 1,754 servers list a different set of tools from one session to the next; the chart leaves those tools out.

### 42% of servers cannot be scored, and we say so
22,552 servers publish no remote endpoint or keep their tools behind sign-in; they are shown as not scored rather than given a score from metadata alone.
The scored servers average 84.

## About this edition

The data was read from a database snapshot taken at 04:24 UTC on November 1; tool changes after October 31 are left out.

## The catalog

| connection class | servers |
|---|---|
| R0: remote, no auth | 19,230 (36%) |
| L0: local package only | 17,387 (32%) |
| R2: remote, OAuth | 9,167 (17%) |
| not classified | 5,667 (11%) |
| R1: remote, static key | 2,484 (4.6%) |

35,937 active servers list a remote endpoint; packages: npm 14,460, PyPI 4,959, MCP bundles 1,548, OCI images 1,324, NuGet 167, Cargo 108.

## Protocol

| remote endpoints | count |
|---|---|
| older versions only | 17,547 (48%) |
| asks for credentials before the handshake | 11,100 (30%) |
| answers 2026-07-28 | 5,045 (14%) |
| no MCP answer (down, blocked or not MCP) | 3,008 (8.2%) |

Of the endpoints that answer 2026-07-28, 100% answer without a session and 27% let clients cache their tool list (`ttlMs`). 1,028 endpoints are listed only with the old HTTP+SSE transport.

## Authorization

| remote endpoints | count |
|---|---|
| no auth | 21,605 (59%) |
| OAuth | 9,467 (26%) |
| not classified | 3,008 (8.2%) |
| static key or header | 2,620 (7.1%) |

Of 9,467 OAuth endpoints, 98% publish Protected Resource Metadata, 34% support Client ID Metadata Documents and 94% still offer Dynamic Client Registration, deprecated in 2026-07-28 (64% offer only DCR).

## Tools

21,609 servers list their tools without credentials (375,723 tools in total); the checks below count those servers.

| check | passing | warn | fail |
|---|---|---|---|
| a description on every tool | 98% | 365 | 23 |
| `readOnlyHint` or `destructiveHint` on tools | 64% | 203 | 7,637 |
| all four tool hints | 45% | 1,225 | 10,742 |
| tool list under 8k tokens | 73% | 3,589 | 2,149 |
| not an API mapped one endpoint per tool | 99% | 154 | 0 |

Loading every tool of a server costs about 1,670 tokens at the median, 24,298 at the 90th percentile and 30,895 at the 99th (characters / 4).

## Changes

Since 2026-09-23 (39 days), 10,311 servers changed at least one tool definition: 62,207 added, 154,895 changed, 24,670 removed. 14,351 changed descriptions kept the tool's name but shared less than half their words with the previous text, the pattern of a silent change of meaning; most are honest rewrites, which is why protogrid records the before and after for every one.

Not counted above: 1,754 servers list a different set of tools from one session to the next (72,198 tools appeared and disappeared at least twice each), so an agent cannot rely on a tool it saw before being there on its next connection.

Steady changes by week (weeks start on Monday, UTC):

| week of | added | changed | removed | changes of meaning |
|---|---|---|---|---|
| 2026-09-21 | 3,948 | 9,826 | 1,985 | 918 |
| 2026-09-28 | 6,009 | 19,148 | 3,251 | 2,158 |
| 2026-10-05 | 8,255 | 24,496 | 4,652 | 2,797 |
| 2026-10-12 | 8,979 | 28,779 | 4,922 | 2,747 |
| 2026-10-19 | 11,359 | 30,200 | 5,963 | 3,048 |
| 2026-10-26 | 23,657 | 42,446 | 3,897 | 2,683 |

## Dependencies

11,692 of 19,374 npm and PyPI package versions in the catalog resolved to a dependency graph; 11,632 servers have dependency checks, counted below.

| check | passing | warn | fail |
|---|---|---|---|
| no known advisory in dependencies | 43% | 613 | 5,969 |
| official MCP SDK without advisories (9,784 servers) | 95% | 22 | 508 |
| dependency graph resolves completely | 99% | 85 | 0 |

Servers failing the first two checks carry the quality flags `known-vulns` and `outdated-mcp-sdk`, which search can exclude.

Dependencies found with known advisories most often (each is a public advisory; the fix is usually an update):

| package | servers affected |
|---|---|
| zod (npm) | 4,224 |
| opentelemetry-api (PyPI) | 1,405 |
| certifi (PyPI) | 1,230 |
| fastmcp (PyPI) | 516 |
| body-parser (npm) | 504 |
| joserfc (PyPI) | 496 |
| authlib (PyPI) | 488 |
| @modelcontextprotocol/sdk (npm) | 488 |
| dnspython (PyPI) | 482 |
| fastmcp-slim (PyPI) | 467 |

## Quality scores

| score | servers |
|---|---|
| 90+ | 6,918 (13%) |
| 75-89 | 21,776 (40%) |
| 40-74 | 2,594 (4.8%) |
| <40 | 95 (0.2%) |
| not scored | 22,552 (42%) |

Mean score of scored servers: 84. Servers without a public tool list or a remote endpoint are not scored rather than scored generously.

## Method and limits

- Every number comes from protogrid's own credential-free probes of the endpoints listed in the official MCP registry, the registry's metadata, deps.dev and OSV.dev. No tool was called, nothing was installed or run, and no audit is implied.
- Endpoints behind sign-in show only their public authorization metadata, so tool figures cover servers whose tools are public.
- Scores and checks are described on the [quality page](https://docs.protogrid.dev/concepts/quality/); every server's report is public on protogrid.dev.
- No MCP server is named for a negative finding. Server authors can [check their server](https://protogrid.dev/check) or [claim it](https://docs.protogrid.dev/guides/claim-your-server/) for alerts.
- Every active listing counts, including the 293 that protogrid hides from search for adult content or gambling; they are never named.
- Each edition takes its data on the last day of its month.
- Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. This report and its dataset are CC BY 4.0 too.