MCP server statistics, 2026
as of 2026-11-05 ·The most recent listing of the sources finished Nov 4, 2:51 AM ET. These figures were counted at Nov 5, 12:21 AM ET, and they include the reads that landed during the day. Every source finished its most recent run on time, though a run can end before it has seen every entry a source lists.
This page answers a few plain questions. How many MCP servers, agent skills and plugins exist? How many tools do they expose? How often does their small print change? How many security advisories name them? How many remote servers answer when asked? Every number below is counted from Small Print's own record. Each number says how it was counted and on what day. You are welcome to quote any line with its link. The numbers change, so please cite the date.
Key figures
- 339,448 MCP servers, skills and plugins are on record from 20 public sources, and 1,264 of them are no longer listed by their source.
- 275,207 entries (81.1%) have had their small print read: tool definitions extracted, a tool list fetched, every file hashed, or the code read with no tool declarations found.
- 2,268,161 tool definitions are on record across 139,957 MCP servers.
- The median MCP server exposes 7 tools.
- The median tool description is 155 characters long.
- 553,629 changes to the small print are on record.
- 315,060 changes were recorded in the last 30 days, 87,563 in the last 7.
- 18,925 changes were to instruction files.
- 525 changes added text that names a secret-bearing file, a named address, or the vocabulary of exfiltration.
- 84 changes added text with words the override rule looks for, such as "do not tell" or "ignore previous instructions".
- 6,434 security advisories are on record, and 1,237 of them name an MCP server, skill or plugin on record.
- 2,714 advisories carry a malware identifier from the OpenSSF Malicious Packages project, published through OSV.
- 40,651 of 70,131 remote MCP servers (58%) return a tool list without a sign-in.
- 10,034 (14.3%) asked for a sign-in or refused the request.
How many MCP servers, agent skills and plugins are there?
As of 2026-11-05, Small Print has 339,448 entries on record from 20 public sources. That is 225,408 MCP servers, 63,808 agent skills and 50,232 plugins. An entry is one name at one source, so software that is published in two places is two entries.
- 339,448 MCP servers, skills and plugins are on record from 20 public sources, and 1,264 of them are no longer listed by their source. One entry per name at a source (an npm or PyPI name, a container image, a registry id, a skill's repository path). The same software published at two sources, or under two names, is two entries; the line about repositories below counts how often that happens. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#entries
- 225,408 of them are MCP servers. Entries of kind mcp. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#servers
- 63,808 are agent skills and 50,232 are plugins. Entries of kind agent-skill and agent-plugin. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#skills
- 275,207 entries (81.1%) have had their small print read: tool definitions extracted, a tool list fetched, every file hashed, or the code read with no tool declarations found. Entries with at least one read version (packages/schema/src/read.ts): a content hash, a file-tree hash, or an empty tool list from a completed read. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#read
- 829,465 versions are on record, 504,655 of them read. Rows in the version table; read means a content hash, a file-tree hash, or an empty tool list from a completed read is stored. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#versions
| source | listed | read |
|---|---|---|
| npm | 86,186 | 85,903 |
| MCP servers found on GitHub | 47,551 | 12,493 |
| the official MCP registry | 43,221 | 33,560 |
| plugins found on GitHub | 40,648 | 39,109 |
| Smithery skills | 25,229 | 15,025 |
| skills.sh | 23,411 | 21,334 |
| PyPI | 21,624 | 21,462 |
| Smithery | 21,447 | 17,063 |
| Hugging Face Spaces | 12,651 | 12,638 |
| ClawHub | 9,104 | 9,019 |
| Claude Code marketplaces | 2,728 | 2,653 |
| Gemini CLI extensions | 2,253 | 2,201 |
| the awesome-mcp-servers list | 1,325 | 1,312 |
| Docker's MCP registry | 326 | 219 |
| GitHub's Copilot plugins | 204 | 192 |
| Zed | 73 | 71 |
| OpenAI's Codex plugins | 65 | 62 |
| advisory-named repositories | 55 | 54 |
| Cline's MCP marketplace | 54 | 51 |
| Kiro powers | 29 | 29 |
"Listed" means the source publishes the entry under its own name. "Read" means Small Print has read at least one version of the entry, in one of the ways the read line above lists. Here is what counts as one entry for each source.
How many tools does an MCP server expose, and how long is a tool description?
Small Print has read the latest version of 139,957 servers, and those servers define 2,268,161 tools between them. The typical server exposes 7 tools, and the typical tool description is 155 characters long.
- 2,268,161 tool definitions are on record across 139,957 MCP servers. Length of the extracted tool list on the latest read version of each server. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#tools-total
- The median MCP server exposes 7 tools. Median of per-server tool counts on the latest read version. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#tools-median
- 7,329 servers expose 50 or more tools. Servers whose latest read version lists at least 50 tools. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#tools-big
- 8,233 servers were read, and the reader found no tool declarations in their code. Latest versions read with an empty extracted tool list. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#tools-none
- The median tool description is 155 characters long. Median length of the description field across tool definitions on latest read versions. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#desc-median
- 24,568 tool descriptions run to 500 characters or more. Descriptions of at least 500 characters on latest read versions. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#desc-long
The five largest tool lists on record: quickmcp-server (5,751), hakodev2k/AI-Engineering (2,744), pipeworx gateway (2,530), secops-soar-mcp (2,133), isihouseatl/claudebrowser (2,116).
How often does the small print change between versions?
553,629 changes are on record. A change is an edit to a tool description, a tool's input form, the list of tools, or instruction files. A new version number on its own is not a change, and neither is a registry that stops listing an entry. Each new version is compared with the version read just before it, so an edit is counted once. Those changes are spread across 29,745 entries and 67,221 releases. 315,060 of them were recorded in the last 30 days. A change is dated by the day Small Print first read it, which can be long after the release came out.
- 553,629 changes to the small print are on record. Drift events other than a plain version bump or a change in whether a registry lists the entry: a tool added or removed, a description, schema or instruction change. Each version is compared with the one read just before it. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#drift-total
- 315,060 changes were recorded in the last 30 days, 87,563 in the last 7. Drift events by detection date, which is the day Small Print first read the version, not the day it was released. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#drift-30
- 87,563 changes were recorded in the last 7 days. Drift events by detection date, last seven days. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#drift-7
- 29,745 entries have changed their small print at least once since being read. Distinct entries with at least one drift event. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#drift-assets
- 67,221 releases changed the small print. Distinct (entry, new version) pairs with at least one change. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#drift-releases
- 155,001 of the changes rewrote a tool description; 198,425 changed an input schema. Drift events by field. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#desc-changes
- 146,511 tools were added in a release and 34,766 removed. Drift events of kind tool.added and tool.removed. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#tools-added
- 18,925 changes were to instruction files. Drift events of kind skill.instructions, where the entry is a skill or a plugin. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#instr-changes
- 88,679 of 169,759 version bumps (52.2%) changed nothing in the small print. Version bumps whose canonical content hash is identical to the previous version. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#bumps-same
The five entries with the most recorded changes: @aurentiaai/mcp-server (2,104), @unclick/mcp-server (1,750), @apideck/mcp (1,316), @appaflytech/zeyrek-ai-mcp (1,203), canvas-lms-mcp (1,166). A high count means the server is being developed actively. It does not mean there is a problem with it.
How many changes are graded high, and under which rule?
690 recorded changes are graded high under Small Print's written rules. 525 of them add text that names a file holding secrets, a network address, or words about moving data out. 84 add text with words the override rule looks for, such as "do not tell" or "ignore previous instructions". 1 adds text that holds characters a reader cannot see, or a word that mixes letters from two alphabets. 80 were graded high under another rule, which is named on the entry's page. 302 more were graded high by these rules and then lowered to medium, because a reading of the sentence by Jev, a decision model, found it only documents the action. 92 others were kept high by Jev and then lowered to medium by the second review, which reads the whole change and writes its reason on the entry's page. Lowered changes are counted as medium. The second review has read and confirmed 1 of the high grades; the others have not been confirmed yet. A grade is the result of a published rule applied to public text. It is not a verdict on anyone.
- 525 changes added text that names a secret-bearing file, a named address, or the vocabulary of exfiltration. Drift events graded high under an exfiltration rule other than the two input-form rules, which also match override words and are counted under another rule; the rules and their patterns are on the grading page. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#high-exfil
- 84 changes added text with words the override rule looks for, such as "do not tell" or "ignore previous instructions". Drift events graded high under the override rule. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#high-override
- 80 changes were graded high under another rule. Drift events graded high whose rule is not one of the three above; the entry's page names the rule. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#high-other
How many security advisories name MCP servers and agent skills?
6,434 security advisories are on record, from 6 sources. 1,237 of them name an MCP server, skill or plugin on record and are matched to the versions they affect. The others name no MCP server, skill or plugin on record. 280 entries carry at least one advisory.
- 6,434 security advisories are on record, and 1,237 of them name an MCP server, skill or plugin on record. Advisories on record by source: ghsa (2,881), osv (2,276), nvd (1,222), vulnerablemcp (46), Small Print's own records (8), csa-mcps (1). Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#adv-total
- 1,237 advisories name an MCP server, skill or plugin on record and are linked to its exact package and version range. Advisories with at least one affected MCP server, skill or plugin and range resolved in the catalog; a package no catalog source lists is not an entry. An entry the record holds only because an advisory names its package is not counted here, so the advisories page, which counts those too, shows a higher number of advisories tied to an entry. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#adv-linked
- 4,918 advisories are critical and 906 high, under the advisory rules on the grading page. Each advisory's page names the rule that set its grade. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#adv-critical
- 2,714 advisories carry a malware identifier from the OpenSSF Malicious Packages project, published through OSV. Advisories whose id or alias is a MAL- record. MAL- identifiers are assigned by the OpenSSF Malicious Packages project and published through the OSV database; the word is theirs, attributed. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#adv-malware
- 280 entries carry at least one advisory. Distinct entries with an advisory link. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#adv-assets
How many remote MCP servers answer a tools/list request?
Small Print has asked 70,131 remote servers for their tool list, each in one short conversation that opens a session and asks for the list. The figures below are each server's most recent answer, and some of those answers are more than a week old. 40,651 of them (58 percent) answered with a list of tools. 10,034 asked for a sign-in or refused the request. 13,118 could not be reached, or answered without opening a session. 2,053 answered, but not with a list of tools Small Print could read.
- 40,651 of 70,131 remote MCP servers (58%) return a tool list without a sign-in. Remote reads with status ok: initialize then tools/list over streamable HTTP or SSE, nothing called. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#remote-ok
- 10,034 (14.3%) asked for a sign-in or refused the request. Remote reads answered 401 or 403. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#remote-auth
- 13,118 (18.7%) could not be reached, or answered without opening a session. Remote reads with no answer, or an answer that opened no session. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#remote-down
- 2,053 answered, but not with a list of tools Small Print could read. Remote reads where the server answered but gave no tool list Small Print could read. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#remote-protocol
What languages are MCP servers written in?
Of the versions that were read from their published code, the languages break down as follows: js 134,443, python 48,253, ts 27,375, go 1,014, and others. A version counts under each language that contributed tool definitions to it.
- 134,443 read versions carry tool definitions written in JavaScript. Versions whose extraction label includes the language; a version read from two languages counts once for each. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#lang-js
- 48,253 read versions carry tool definitions written in Python. Versions whose extraction label includes the language; a version read from two languages counts once for each. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#lang-python
- 27,375 read versions carry tool definitions written in TypeScript. Versions whose extraction label includes the language; a version read from two languages counts once for each. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#lang-ts
- 1,014 read versions carry tool definitions written in Go. Versions whose extraction label includes the language; a version read from two languages counts once for each. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#lang-go
- 794 read versions carry tool definitions written in Rust. Versions whose extraction label includes the language; a version read from two languages counts once for each. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#lang-rust
- 196 read versions carry tool definitions written in C#. Versions whose extraction label includes the language; a version read from two languages counts once for each. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#lang-csharp
- 89 read versions carry tool definitions written in Java. Versions whose extraction label includes the language; a version read from two languages counts once for each. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#lang-java
- 10 read versions carry tool definitions written in Kotlin. Versions whose extraction label includes the language; a version read from two languages counts once for each. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#lang-kotlin
How often does the security press name a specific MCP server or skill?
Small Print has read 396 articles from the security news feeds it follows. 17 of them name a package in the catalog by its exact name, and those articles cover 154 entries.
- 17 of 396 security articles name a catalog package outright. Articles matched to an entry by exact registry name, scoped name or repository URL; the headline stays the source's own. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#news-linked
- 154 entries have been named in at least one article. Distinct entries with a press mention. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#news-assets
How can anyone check that the record was not edited after the fact?
Small Print writes rows to a chain. Each row lists the fingerprints not yet in the chain, takes a fingerprint of the whole list, and combines it with the row before. So far, the chain has 49 rows. The latest row, for 2026-11-04, is 1b53526ec9c47a0c91ea710dab48490d5552eeb5f0900a7ef3892e428e506c2f. Every row, and the lines behind it, can be read at /api/chain. Anyone who saved an earlier row can recompute the chain and see whether any recorded fingerprint changed since then.
- The record chain has 49 rows. Rows in the record chain; each lists the version hashes not yet in the chain, hashed with the previous row's chain hash. Method and every row: /api/chain. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#chain-days
- 47 of the 49 chain rows carry a signature. Rows in the record chain with a stored signature. Cite: Small Print, MCP server statistics, 2026-11-05, https://smallprint.dev/stats#chain-signed
How these numbers are made
Small Print counts one entry per name at each of its public sources, so the same software published at two sources is two entries. It fetches their lists and reads new versions as it reaches them, so not every entry counted here has been read yet. For servers, it reads the tool definitions from the published code. For remote servers, it asks for the tool list without calling any tool. For skills, it fingerprints the files. Security advisories are matched to entries by the version range they name. These are our own counts, from the same database the site reads, and part of them can be checked from outside: the record's fingerprints are written into a chain at /api/chain, and a short script that checks its links and signatures, and recomputes the rows whose lines are kept, is public at tools/verify-chain.mjs: node verify-chain.mjs against the live site. The grading rules are on the grading page. A machine-readable copy of these numbers is at /api/stats. To correct anything, use the dispute link on the entry page, explained on the maintainers page, or write to hello@smallprint.dev.