{"asOf":"2026-11-05","source":"Small Print, https://smallprint.dev/stats","licence":"Cite with the date and the link.","takeaways":[{"id":"entries","line":"339,448 MCP servers, skills and plugins are on record from 20 public sources, and 1,264 of them are no longer listed by their source.","value":339448,"method":"One entry per name at a source (an npm or PyPI name, a container image, a registry id, a skill's repository path). The same software published at two sources, or under two names, is two entries; the line about repositories below counts how often that happens."},{"id":"read","line":"275,207 entries (81.1%) have had their small print read: tool definitions extracted, a tool list fetched, every file hashed, or the code read with no tool declarations found.","value":275207,"method":"Entries with at least one read version (packages/schema/src/read.ts): a content hash, a file-tree hash, or an empty tool list from a completed read."},{"id":"tools-total","line":"2,271,653 tool definitions are on record across 140,249 MCP servers.","value":2271653,"method":"Length of the extracted tool list on the latest read version of each server."},{"id":"tools-median","line":"The median MCP server exposes 7 tools.","value":7,"method":"Median of per-server tool counts on the latest read version."},{"id":"desc-median","line":"The median tool description is 156 characters long.","value":156,"method":"Median length of the description field across tool definitions on latest read versions."},{"id":"drift-total","line":"553,629 changes to the small print are on record.","value":553629,"method":"Drift events other than a plain version bump or a change in whether a registry lists the entry: a tool added or removed, a description, schema or instruction change. Each version is compared with the one read just before it."},{"id":"drift-30","line":"315,060 changes were recorded in the last 30 days, 87,563 in the last 7.","value":315060,"method":"Drift events by detection date, which is the day Small Print first read the version, not the day it was released."},{"id":"instr-changes","line":"18,925 changes were to instruction files.","value":18925,"method":"Drift events of kind skill.instructions, where the entry is a skill or a plugin."},{"id":"high-exfil","line":"525 changes added text that names a secret-bearing file, a named address, or the vocabulary of exfiltration.","value":525,"method":"Drift events graded high under an exfiltration rule other than the two input-form rules, which also match override words and are counted under another rule; the rules and their patterns are on the grading page."},{"id":"high-override","line":"84 changes added text with words the override rule looks for, such as \"do not tell\" or \"ignore previous instructions\".","value":84,"method":"Drift events graded high under the override rule."},{"id":"adv-total","line":"6,434 security advisories are on record, and 1,237 of them name an MCP server, skill or plugin on record.","value":6434,"method":"Advisories on record by source: ghsa (2,881), osv (2,276), nvd (1,222), vulnerablemcp (46), Small Print's own records (8), csa-mcps (1)."},{"id":"adv-malware","line":"2,714 advisories carry a malware identifier from the OpenSSF Malicious Packages project, published through OSV.","value":2714,"method":"Advisories whose id or alias is a MAL- record. MAL- identifiers are assigned by the OpenSSF Malicious Packages project and published through the OSV database; the word is theirs, attributed."},{"id":"remote-ok","line":"40,651 of 70,131 remote MCP servers (58%) return a tool list without a sign-in.","value":40651,"method":"Remote reads with status ok: initialize then tools/list over streamable HTTP or SSE, nothing called."},{"id":"remote-auth","line":"10,034 (14.3%) asked for a sign-in or refused the request.","value":10034,"method":"Remote reads answered 401 or 403."}],"sections":[{"id":"how-many","question":"How many MCP servers, agent skills and plugins are there?","answer":"As of 2026-11-05, Small Print has 339,448 entries on record from 20 public sources. That is 225,408 MCP servers, 63,808 agent skills and 50,232 plugins. An entry is one name at one source, so software that is published in two places is two entries.","stats":[{"id":"entries","line":"339,448 MCP servers, skills and plugins are on record from 20 public sources, and 1,264 of them are no longer listed by their source.","value":339448,"method":"One entry per name at a source (an npm or PyPI name, a container image, a registry id, a skill's repository path). The same software published at two sources, or under two names, is two entries; the line about repositories below counts how often that happens."},{"id":"servers","line":"225,408 of them are MCP servers.","value":225408,"method":"Entries of kind mcp."},{"id":"skills","line":"63,808 are agent skills and 50,232 are plugins.","value":63808,"method":"Entries of kind agent-skill and agent-plugin."},{"id":"read","line":"275,207 entries (81.1%) have had their small print read: tool definitions extracted, a tool list fetched, every file hashed, or the code read with no tool declarations found.","value":275207,"method":"Entries with at least one read version (packages/schema/src/read.ts): a content hash, a file-tree hash, or an empty tool list from a completed read."},{"id":"shared-repos","line":"16,439 repositories are listed under more than one entry, such as the same server on npm and in a container registry.","value":16439,"method":"Distinct repository URLs that appear on two or more entries."},{"id":"versions","line":"829,515 versions are on record, 504,655 of them read.","value":829515,"method":"Rows in the version table; read means a content hash, a file-tree hash, or an empty tool list from a completed read is stored."}]},{"id":"tools","question":"How many tools does an MCP server expose, and how long is a tool description?","answer":"Small Print has read the latest version of 140,249 servers, and those servers define 2,271,653 tools between them. The typical server exposes 7 tools, and the typical tool description is 156 characters long.","stats":[{"id":"tools-total","line":"2,271,653 tool definitions are on record across 140,249 MCP servers.","value":2271653,"method":"Length of the extracted tool list on the latest read version of each server."},{"id":"tools-median","line":"The median MCP server exposes 7 tools.","value":7,"method":"Median of per-server tool counts on the latest read version."},{"id":"tools-big","line":"7,345 servers expose 50 or more tools.","value":7345,"method":"Servers whose latest read version lists at least 50 tools."},{"id":"tools-none","line":"8,220 servers were read, and the reader found no tool declarations in their code.","value":8220,"method":"Latest versions read with an empty extracted tool list."},{"id":"desc-median","line":"The median tool description is 156 characters long.","value":156,"method":"Median length of the description field across tool definitions on latest read versions."},{"id":"desc-long","line":"24,740 tool descriptions run to 500 characters or more.","value":24740,"method":"Descriptions of at least 500 characters on latest read versions."}]},{"id":"change","question":"How often does the small print change between versions?","answer":"553,629 changes are on record. A change is an edit to a tool description, a tool's input form, the list of tools, or instruction files. A new version number on its own is not a change, and neither is a registry that stops listing an entry. Each new version is compared with the version read just before it, so an edit is counted once. Those changes are spread across 29,745 entries and 67,221 releases. 315,060 of them were recorded in the last 30 days. A change is dated by the day Small Print first read it, which can be long after the release came out.","stats":[{"id":"drift-total","line":"553,629 changes to the small print are on record.","value":553629,"method":"Drift events other than a plain version bump or a change in whether a registry lists the entry: a tool added or removed, a description, schema or instruction change. Each version is compared with the one read just before it."},{"id":"drift-30","line":"315,060 changes were recorded in the last 30 days, 87,563 in the last 7.","value":315060,"method":"Drift events by detection date, which is the day Small Print first read the version, not the day it was released."},{"id":"drift-7","line":"87,563 changes were recorded in the last 7 days.","value":87563,"method":"Drift events by detection date, last seven days."},{"id":"drift-assets","line":"29,745 entries have changed their small print at least once since being read.","value":29745,"method":"Distinct entries with at least one drift event."},{"id":"drift-releases","line":"67,221 releases changed the small print.","value":67221,"method":"Distinct (entry, new version) pairs with at least one change."},{"id":"desc-changes","line":"155,001 of the changes rewrote a tool description; 198,425 changed an input schema.","value":155001,"method":"Drift events by field."},{"id":"tools-added","line":"146,511 tools were added in a release and 34,766 removed.","value":146511,"method":"Drift events of kind tool.added and tool.removed."},{"id":"instr-changes","line":"18,925 changes were to instruction files.","value":18925,"method":"Drift events of kind skill.instructions, where the entry is a skill or a plugin."},{"id":"bumps-same","line":"88,679 of 169,759 version bumps (52.2%) changed nothing in the small print.","value":88679,"method":"Version bumps whose canonical content hash is identical to the previous version."}]},{"id":"graded","question":"How many changes are graded high, and under which rule?","answer":"690 recorded changes are graded high under Small Print's written rules. 525 of them add text that names a file holding secrets, a network address, or words about moving data out. 84 add text with words the override rule looks for, such as \"do not tell\" or \"ignore previous instructions\". 1 adds text that holds characters a reader cannot see, or a word that mixes letters from two alphabets. 80 were graded high under another rule, which is named on the entry's page. 302 more were graded high by these rules and then lowered to medium, because a reading of the sentence by Jev, a decision model, found it only documents the action. 92 others were kept high by Jev and then lowered to medium by the second review, which reads the whole change and writes its reason on the entry's page. Lowered changes are counted as medium. The second review has read and confirmed 1 of the high grades; the others have not been confirmed yet. A grade is the result of a published rule applied to public text. It is not a verdict on anyone.","stats":[{"id":"high-exfil","line":"525 changes added text that names a secret-bearing file, a named address, or the vocabulary of exfiltration.","value":525,"method":"Drift events graded high under an exfiltration rule other than the two input-form rules, which also match override words and are counted under another rule; the rules and their patterns are on the grading page."},{"id":"high-override","line":"84 changes added text with words the override rule looks for, such as \"do not tell\" or \"ignore previous instructions\".","value":84,"method":"Drift events graded high under the override rule."},{"id":"high-hidden","line":"1 change added text that holds characters a reader cannot see, or a word that mixes letters from two alphabets.","value":1,"method":"Drift events graded high under the hidden-text rule."},{"id":"high-other","line":"80 changes were graded high under another rule.","value":80,"method":"Drift events graded high whose rule is not one of the three above; the entry's page names the rule."},{"id":"high-share","line":"0.1% of all recorded changes grade high.","value":690,"method":"High-graded events over all drift events other than version bumps."}]},{"id":"advisories","question":"How many security advisories name MCP servers and agent skills?","answer":"6,434 security advisories are on record, from 6 sources. 1,237 of them name an MCP server, skill or plugin on record and are matched to the versions they affect. The others name no MCP server, skill or plugin on record. 280 entries carry at least one advisory.","stats":[{"id":"adv-total","line":"6,434 security advisories are on record, and 1,237 of them name an MCP server, skill or plugin on record.","value":6434,"method":"Advisories on record by source: ghsa (2,881), osv (2,276), nvd (1,222), vulnerablemcp (46), Small Print's own records (8), csa-mcps (1)."},{"id":"adv-linked","line":"1,237 advisories name an MCP server, skill or plugin on record and are linked to its exact package and version range.","value":1237,"method":"Advisories with at least one affected MCP server, skill or plugin and range resolved in the catalog; a package no catalog source lists is not an entry. An entry the record holds only because an advisory names its package is not counted here, so the advisories page, which counts those too, shows a higher number of advisories tied to an entry."},{"id":"adv-critical","line":"4,918 advisories are critical and 906 high, under the advisory rules on the grading page.","value":4918,"method":"Each advisory's page names the rule that set its grade."},{"id":"adv-malware","line":"2,714 advisories carry a malware identifier from the OpenSSF Malicious Packages project, published through OSV.","value":2714,"method":"Advisories whose id or alias is a MAL- record. MAL- identifiers are assigned by the OpenSSF Malicious Packages project and published through the OSV database; the word is theirs, attributed."},{"id":"adv-assets","line":"280 entries carry at least one advisory.","value":280,"method":"Distinct entries with an advisory link."}]},{"id":"remote","question":"How many remote MCP servers answer a tools/list request?","answer":"Small Print has asked 70,131 remote servers for their tool list, each in one short conversation that opens a session and asks for the list. The figures below are each server's most recent answer, and some of those answers are more than a week old. 40,651 of them (58 percent) answered with a list of tools. 10,034 asked for a sign-in or refused the request. 13,118 could not be reached, or answered without opening a session. 2,053 answered, but not with a list of tools Small Print could read.","stats":[{"id":"remote-ok","line":"40,651 of 70,131 remote MCP servers (58%) return a tool list without a sign-in.","value":40651,"method":"Remote reads with status ok: initialize then tools/list over streamable HTTP or SSE, nothing called."},{"id":"remote-auth","line":"10,034 (14.3%) asked for a sign-in or refused the request.","value":10034,"method":"Remote reads answered 401 or 403."},{"id":"remote-down","line":"13,118 (18.7%) could not be reached, or answered without opening a session.","value":13118,"method":"Remote reads with no answer, or an answer that opened no session."},{"id":"remote-protocol","line":"2,053 answered, but not with a list of tools Small Print could read.","value":2053,"method":"Remote reads where the server answered but gave no tool list Small Print could read."}]},{"id":"languages","question":"What languages are MCP servers written in?","answer":"Of the versions that were read from their published code, the languages break down as follows: js 134,443, python 48,253, ts 27,375, go 1,014, and others. A version counts under each language that contributed tool definitions to it.","stats":[{"id":"lang-js","line":"134,443 read versions carry tool definitions written in JavaScript.","value":134443,"method":"Versions whose extraction label includes the language; a version read from two languages counts once for each."},{"id":"lang-python","line":"48,253 read versions carry tool definitions written in Python.","value":48253,"method":"Versions whose extraction label includes the language; a version read from two languages counts once for each."},{"id":"lang-ts","line":"27,375 read versions carry tool definitions written in TypeScript.","value":27375,"method":"Versions whose extraction label includes the language; a version read from two languages counts once for each."},{"id":"lang-go","line":"1,014 read versions carry tool definitions written in Go.","value":1014,"method":"Versions whose extraction label includes the language; a version read from two languages counts once for each."},{"id":"lang-rust","line":"794 read versions carry tool definitions written in Rust.","value":794,"method":"Versions whose extraction label includes the language; a version read from two languages counts once for each."},{"id":"lang-csharp","line":"196 read versions carry tool definitions written in C#.","value":196,"method":"Versions whose extraction label includes the language; a version read from two languages counts once for each."},{"id":"lang-java","line":"89 read versions carry tool definitions written in Java.","value":89,"method":"Versions whose extraction label includes the language; a version read from two languages counts once for each."},{"id":"lang-kotlin","line":"10 read versions carry tool definitions written in Kotlin.","value":10,"method":"Versions whose extraction label includes the language; a version read from two languages counts once for each."}]},{"id":"press","question":"How often does the security press name a specific MCP server or skill?","answer":"Small Print has read 396 articles from the security news feeds it follows. 17 of them name a package in the catalog by its exact name, and those articles cover 154 entries.","stats":[{"id":"news-linked","line":"17 of 396 security articles name a catalog package outright.","value":17,"method":"Articles matched to an entry by exact registry name, scoped name or repository URL; the headline stays the source's own."},{"id":"news-assets","line":"154 entries have been named in at least one article.","value":154,"method":"Distinct entries with a press mention."}]},{"id":"record","question":"How can anyone check that the record was not edited after the fact?","answer":"Small Print writes rows to a chain. Each row lists the fingerprints not yet in the chain, takes a fingerprint of the whole list, and combines it with the row before. So far, the chain has 49 rows. The latest row, for 2026-11-04, is 1b53526ec9c47a0c91ea710dab48490d5552eeb5f0900a7ef3892e428e506c2f. Every row, and the lines behind it, can be read at /api/chain. Anyone who saved an earlier row can recompute the chain and see whether any recorded fingerprint changed since then.","stats":[{"id":"chain-days","line":"The record chain has 49 rows.","value":49,"method":"Rows in the record chain; each lists the version hashes not yet in the chain, hashed with the previous row's chain hash. Method and every row: /api/chain."},{"id":"chain-signed","line":"47 of the 49 chain rows carry a signature.","value":47,"method":"Rows in the record chain with a stored signature."}]}],"sources":[{"registry":"npm","listed":86186,"read":85903},{"registry":"github-mcp","listed":47551,"read":12493},{"registry":"mcp-registry","listed":43221,"read":33560},{"registry":"github-plugins","listed":40648,"read":39109},{"registry":"smithery-skills","listed":25229,"read":15025},{"registry":"skills.sh","listed":23411,"read":21334},{"registry":"pypi","listed":21624,"read":21462},{"registry":"smithery","listed":21447,"read":17063},{"registry":"huggingface","listed":12651,"read":12638},{"registry":"clawhub","listed":9104,"read":9019},{"registry":"anthropic-plugins","listed":2728,"read":2653},{"registry":"gemini","listed":2253,"read":2201},{"registry":"awesome-mcp","listed":1325,"read":1312},{"registry":"docker","listed":326,"read":219},{"registry":"copilot-plugins","listed":204,"read":192},{"registry":"zed","listed":73,"read":71},{"registry":"codex-plugins","listed":65,"read":62},{"registry":"github","listed":55,"read":54},{"registry":"cline","listed":54,"read":51},{"registry":"kiro-powers","listed":29,"read":29}],"languages":[{"language":"js","versions":134443},{"language":"python","versions":48253},{"language":"ts","versions":27375},{"language":"go","versions":1014},{"language":"rust","versions":794},{"language":"csharp","versions":196},{"language":"java","versions":89},{"language":"kotlin","versions":10}]}