The state of MCP servers and agent skills, November 2026

Disclosure: I run HostedMCP, an open directory of MCP servers and agent skills. These numbers come from its database; the full report with methodology is on hostedmcp.org.

Most writing about the size of the MCP ecosystem quotes one directory's count, or a curated list of a few thousand repositories. We run a catalog that tries to see everything: the official MCP Registry, GitHub, npm and PyPI for servers, and GitHub for agent skills and plugin marketplaces. This report is what that catalog held on 14 November 2026, counted straight from the database.

Every number below is a measurement, not an estimate. Where a figure depends on a choice we made, such as which repositories count as skills, the methodology section at the end says so.

How big the ecosystem is

Two numbers here are worth a second look. More than half of all servers now come through the official MCP Registry, which only launched in 2025. And fewer than a quarter of servers make it to an indexed page: the rest have no stars, no usable description, or come from publishers that post thousands of near-identical entries. We flag 13,357 servers from such bulk publishers.

Skills are concentrated differently. 52,147 skills come from only 3,339 repositories, about 16 per repository, because collections such as Anthropic's own and the large community libraries hold hundreds or thousands each.

Attention: a tall head and a very long tail

Here is every active server by the star count of its repository; servers without a public repository count as zero.

Counting each repository once, 86,922 of them, the star Gini coefficient is 0.984. The median repository has zero stars, 97% have fewer than 100, and the top 1% hold 87.8% of every star in the catalog.

Analyses built on curated catalogs of around 12,500 repositories have reported a Gini near 0.87 and described a missing middle. With the full long tail included, the picture is starker still: it is less a missing middle than a near-empty everything except the very top. Most of the tail is not abandoned work, either. 77,578 servers, about two thirds, were pushed to in the last six months. They are small, recent and unnoticed.

Skill repositories are less extreme, partly because we only ingest skill repositories with at least five stars. Across 3,339 of them the Gini is 0.960, the median is 19 stars, and the top 1% hold 73.2% of stars.

Local or remote

The transport is known for 63,847 servers:

Remote has overtaken local. When MCP launched in November 2024, servers were processes you ran on your own machine; today most entries, especially in the MCP Registry, are hosted endpoints you connect to by URL. For users that means less to install and more trust placed in whoever runs the endpoint.

Authentication

We could determine how a server authenticates for 50,247 of them:

OAuth is the authorization method the MCP specification defines for remote servers, and the one that lets a user grant and revoke access without pasting a secret into a config file. Fewer than one in twenty servers use it. API keys in environment variables remain the default, which is why so many setup guides ask you to put a token in a JSON file.

Licenses

MIT dominates with 53,950 servers (45.6%), followed by Apache-2.0 with 8,623 and AGPL-3.0 with 1,612. But 52,226 servers, 44.1%, name no license at all. Without one, nobody else has the right to copy or modify the code, whatever the repository looks like. Among skills, 6,853 of 52,147 (13.1%) carry no license.

How many tools a server exposes

For 14,429 servers we know the exact tool list:

The typical server exposes between 6 and 15 tools. The 1,024 servers with 41 or more matter for a different reason: every tool definition is sent to the model with each request, and in our own measurements a large server's definitions alone can run past 100 KB.

What the checks found

We scan servers and skills weekly with automated checks that read public data: the repository, the license, OpenSSF Scorecard, package provenance, known advisories in OSV, package names that imitate popular ones, and the text a model will read, looking for instructions aimed at it. Nothing is executed. On 14 November 2026, 15,380 servers and 7,500 skills had a recent report.

Servers (15,380 scanned):

About 1.2% of scanned servers carry at least one high-severity finding. That is a small share and a real number: up to 188 servers that an agent could be pointed at today. Each finding links to its evidence on the server's checks report.

Skills (7,500 scanned):

The skill finding that stands out is not the rare malicious script but the common shortcut: almost one skill in eleven pre-approves shell access, so the agent can run commands without asking the user. Usually that is convenience, not malice. It is still the setting that turns a bad instruction into a bad command.

How much we could check. Coverage is uneven. 31.7% of scanned servers could be checked on fewer than 60 of our 100 points, mostly because they publish no package, so there is no provenance, advisory or typosquat check to run. OpenSSF Scorecard results existed for only 163 of the 8,360 servers where that check ran. Until 14 November our score divided by the points we could check, which let a server checked on 35 points show 100/100; scores now never count on fewer than 60 points. 10,327 servers meet our Verified rule.

What this means if you use MCP

• Stars tell you little below the top. With a median of zero, most servers have no social proof at all. Read the repository, the license and the checks report instead.
• Prefer servers that ask for less. OAuth over a pasted token, read-only modes where offered, and skills that do not pre-approve shell access.
• Remote is convenient and is trust. A hosted endpoint updates itself and needs nothing installed, and runs code you cannot see.
• A license is not a formality. Nearly half of servers have none, which matters the moment you fork or ship one inside a product.

Methodology and limits

• Date. All numbers come from the HostedMCP database on 14 November 2026. The catalog changes daily.
• Servers. Active servers from the MCP Registry, GitHub search, npm and PyPI, after merging duplicates of the same package or repository. Star figures cover the 95,967 servers that link a repository; distribution tables use distinct repository URLs.
• Skills. Folders containing a SKILL.md in public GitHub repositories with at least five stars. Repositories below that threshold are not ingested, so skill star figures start higher than server figures.
• Transport, auth and tool counts come from registry metadata, package manifests and, for tool lists, servers that publish them. Unknown values are left out of the shares, not counted as negatives.
• Checks read public data and the files an agent would read. They do not run code and are not a security audit. A finding is a pattern match with evidence, and a few may be false positives; the report for each listing shows exactly what was matched.

The full catalog, with every server's checks report, is at hostedmcp.org/servers, and skills at hostedmcp.org/skills.