Analysis Agent Frameworks & Automation
State of MCP servers, Q4 2026: mostly hosted, mostly one-off
By Sheela ·
The MCP registry has become a directory of hosted endpoints from publishers who list a single server, and most of its entries changed in the last 90 days. Our 78 reviews point to a second finding the registry cannot show: the risks sit in defaults, with telemetry switched on, write access open and dozens of tools loaded into the model's context.
This is the first edition of a quarterly study. It will be refreshed at this address each quarter with the same method, so the figures can be compared over time.
What we counted
The listings were collected from the official MCP registry on 22 October 2026. We kept the latest active version of each server that has a description and an https address, and dropped entries that duplicate one of our reviews. That left 7,367 servers. Every figure below comes from scripts/study-mcp.js, which reads those listings and our review files and prints the numbers; next quarter's edition runs the same script.
One limitation shapes everything that follows. The registry returns servers in namespace order, and our collector stopped after 20,000 registry records, at namespaces beginning com.hem. This edition therefore covers every namespace from ac. to com.hem and none after it, including io.github.*, which developers use when they verify through a GitHub account rather than a domain. Treat the shares as describing that slice. The Q1 2027 edition will cover the whole registry, and the difference will be reported.
Mostly hosted, mostly one-off publishers
Of the 7,367 servers, 6,875 (93.3%) list a hosted endpoint and 492 (6.7%) are packages you run yourself. Only 2,865 (38.9%) link a source repository, so for most entries there is no code to read. The hosted share may be overstated. The GitHub-verified namespaces we missed are where individual developers publish, and a developer is more likely to ship a package than to run a server; the full count next quarter will settle it.
Publishing is spread thin. The slice has 5,855 publishers, and 5,568 of them (95.1%) list exactly one server; those one-off entries make up 75.6% of all listings. The ten largest publishers account for 763 servers, or 10.4%. They are not the companies you might expect. Smithery, a hosting service, lists 211 servers whose registry entries were last updated between September 2025 and January 2026. Wishpool's 125 country-by-country payment and invoicing servers were all last updated within the same three days in July 2026. A2AWire lists 119 servers for agent-to-agent payments and messaging, and getvda lists 95 with generic names such as "Auth Token MCP Service".
The registry is moving fast. 3,049 entries (41.4%) were updated in October, up to the 22nd, and 3,643 (49.5%) in the 30 days before collection. 5,743 (78.0%) changed within 90 days, and only 248 (3.4%) have gone untouched for over a year; the oldest date from September 2025, when the registry opened. An update date measures registry activity rather than maintenance. Publishing a new version refreshes it, and a bulk re-publish refreshes hundreds of entries at once without anyone fixing a bug.
Categories
We sort listings into our ten MCP categories with keyword rules applied to each server's name and description. Nearly half match no rule, which says as much about how vaguely servers describe themselves as it does about our rules.
| Category | Servers | Share | Hosted |
|---|---|---|---|
| Not matched | 3,463 | 47.0% | 94.2% |
| Search and knowledge | 883 | 12.0% | 95.1% |
| Finance and commerce | 737 | 10.0% | 95.4% |
| Developer | 610 | 8.3% | 86.1% |
| Design and media | 548 | 7.4% | 92.2% |
| Productivity | 365 | 5.0% | 94.2% |
| Communication | 271 | 3.7% | 95.6% |
| Cloud and infrastructure | 222 | 3.0% | 91.4% |
| Browser and web | 140 | 1.9% | 87.9% |
| Data and databases | 128 | 1.7% | 85.9% |
Finance and commerce outnumbering developer tools is the surprise. Part of it is agent payments: 355 listings (4.8%) mention x402, USDC, crypto, blockchain, a wallet or stablecoins. The categories where local packages hold on, developer tools and databases, are the ones where the server needs your files or your network.
What the 78 reviewed servers show
Our reviews are not a random sample. We chose servers that are widely used or do something distinctive, so they lean towards established vendors: 57 are vendor-built (73.1%), 14 come from the community and 7 are the reference servers still maintained in the MCP project's own repository. They are also more often local than the registry slice: 41 offer both a local and a hosted transport, 23 are hosted only and 14 run only on your machine.
| Authentication | Reviewed servers |
|---|---|
| OAuth offered | 40 (51.3%) |
| None needed for basic use | 25 (32.1%) |
| API key, token or credentials only | 13 (16.7%) |
OAuth has become the norm for hosted servers. All 23 hosted-only servers offer it, and 38 of the 57 vendor servers do. All 25 that need no authentication can run on your own machine, and they include all seven reference servers, such as Filesystem and Git.
Security advisories cluster in local HTTP modes and in the guardrails
Eleven reviews cite published security advisories. The worst are not in hosted servers. Todoist had a critical DNS-rebinding flaw in its optional local HTTP server, so a malicious website could write and delete tasks through it. n8n-mcp lists 15 advisories since May 2026, one critical, most in its multi-tenant HTTP mode, and Serena had three in 2026 that each ended in code execution. Two broke the safety switch itself: DBHub's read-only mode could be bypassed on MySQL and MariaDB, and the awslabs repository behind AWS's older servers published a critical read-only bypass in its Postgres server in September 2026.
Telemetry is often on until you turn it off
Ten reviews found telemetry or usage reporting enabled by default, including Azure, MongoDB, Chrome DevTools and Grafana. Two go further than usage counts. Shopify's published builds send usage events that can include tool inputs, and n8n-mcp collects sanitised workflow structures to train workflow-generation models. Blender MCP's README calls telemetry opt-in, yet an anonymous usage record is sent by default.
Read-only modes exist, with conditions
Fourteen reviews document a read-only switch, and five say the server has none: Asana, Cloudflare, Heroku, PayPal and Redis, whose README points to a read-only database user instead. The switches that do exist often come with conditions. AWS's read-only mode works only through its SigV4 proxy, not over OAuth. monday.com's flag is documented for the local server only and cannot be combined with its dynamic tools. Linear and Supabase do it properly, with a dedicated read-only endpoint and a read-only Postgres user respectively.
Tool counts keep growing
Of the 26 reviews that state a tool count, 14 put it at 40 or more. Vercel documents 248 tools, Grafana 129, Neon 119 unfiltered and GitHub 93. Every tool description costs context on every request, and the vendors know it: GitHub loads five toolsets by default, and Cloudflare's code mode replaces about 2,500 tools with four.
Local servers are being archived in favour of hosted ones
The MCP project has moved its GitHub, Postgres and Slack reference servers to an archive, leaving seven in the main repository; GitHub's own server replaced the first. Vendors are doing the same. ElevenLabs archived its local server in August 2026 in favour of the hosted one, and Browserbase archived its repository in July 2026 while its hosted server stays documented. Guides that tell you to install the old packages are now out of date.
What the listings cannot tell you
A registry entry proves that someone controls a namespace and filled in a form. It does not show whether the server works, who uses it, how many tools it registers, what it collects or whether its hosted endpoint answers. It has no install counts. The registry does not record authentication at all, which is why the auth, telemetry and read-only findings above come only from the 78 servers we reviewed from their documentation, source and advisories. None of these figures comes from running the servers.
For choosing a server, the listings are a starting point and the reviews are where the trade-offs are. Our guide to MCP servers worth installing covers the ones we would start with.