The MCP Server Ecosystem: 10,000+ Servers in Production
By the Linux Foundation / AAIF handoff era (late 2025), public commentary cited more than 10,000 published MCP servers, with continued growth into 2026.
//
Search across all documentation pages
By the Linux Foundation / AAIF handoff era (late 2025), public commentary cited more than 10,000 published MCP servers, with continued growth into 2026.
Treat headline counts as order-of-magnitude ecosystem signal, not a quality score. This cheatsheet maps categories, evaluation axes, and adoption patterns.
| Signal | Typical claim (2025-2026 reporting) | How to read it |
|---|---|---|
| Published servers | 10,000+ at handoff; higher later | Includes demos, forks, and uneven quality |
| Host adoption | Major chat apps, IDEs, agent SDKs | Drives why packaging as MCP pays off |
| SDK downloads | Tens of millions monthly (reported) | Developer interest, not production SLAs |
| Categories | Dev tools → SaaS → data → enterprise | Long tail is real |
Ecosystem value ≈ (compatible hosts) × (reusable servers) × (trust)Without trust (review, pins, scopes), raw server count is noise.
| Examples of capability | Typical primitives |
|---|---|
| Filesystem, git, GitHub/GitLab | tools + resources |
| Issue trackers, PR review helpers | tools |
| Docs search, DeepWiki-class sources | tools / resources |
| Browser/automation bridges | tools |
Fit: coding agents, IDE copilots, CI assistants.
| Examples | Notes |
|---|---|
| Notion, Drive, Confluence-class connectors | High prompt-injection surface via documents |
| Calendar / email | Sensitive; strict scopes |
| Knowledge base search | Prefer retrieval tools over full dumps |
| Examples | Notes |
|---|---|
| Warehouse / SQL runners | Read-only roles first |
| BI metadata catalogs | Great as resources |
| Vector DB admin tools | Separate from query tools |
| Examples | Notes |
|---|---|
| CRM, support desks, ERP slices | Write tools need approvals |
| Payments / billing read APIs | Never broad write by default |
| HR systems | Highest privacy bar |
| Examples | Notes |
|---|---|
| Cloud control planes | Dangerous if over-scoped |
| Observability query tools | Excellent for incident agents |
| Feature flags / deploy hooks | Human-in-the-loop recommended |
| Examples | Notes |
|---|---|
| Design tools, 3D / Blender-class bridges | Often stdio on a workstation |
| OS utilities | Sandbox aggressively |
| Examples | Notes |
|---|---|
| Registries, gateways, auth brokers | Sit in front of other servers |
| Eval and tracing helpers | Pair with agent observability |
Score each candidate server 1-5:
| Axis | Questions |
|---|---|
| Provenance | Who publishes it? Signed releases? Company-backed? |
| Scope | Least privilege possible? Path/project limited? |
| Transport | stdio local vs remote HTTP; auth model clear? |
| Schema quality | Clear names, enums, descriptions? |
| Failure mode | Timeouts, empty results, rate limits documented? |
| Data handling | Logs PII? Forwards to third parties? |
| Host fit | Works in your clients/SDKs? |
| Ops | Version pins, update cadence, support channel? |
Ship only if: provenance ≥ 4 AND scope ≥ 4 AND host fit ≥ 3
Otherwise wrap behind an internal gateway or rebuild.| Tier | Server type | Default policy |
|---|---|---|
| T0 | Read-only docs/search | Allow with output size caps |
| T1 | Read-only business data | Tenant scoping + audit |
| T2 | Local filesystem read | Path jail required |
| T3 | Write tools (tickets, CRM) | Approvals + dry-run modes |
| T4 | Shell/cloud admin | Deny by default; dedicated break-glass agent |
Never mix T4 tools into a general chat agent "because the ecosystem has a server for it."
| Source | Pros | Cons |
|---|---|---|
| Official / reference servers | Educational, simple | Limited business logic |
| Vendor-published MCP | Maintained with product | License and rate limits |
| Community registries | Breadth | Variable security |
| Internal private servers | Perfect fit, controlled | You own ops |
| Host marketplaces | Easy install UX | May lag protocol versions |
Prefer internal servers for core IP systems. Use public servers for commodity connectors after review.
| Metric | Why |
|---|---|
| Approved server count | Controlled surface area |
| Tools exposed per agent role | Selection quality |
| Wrong-tool rate | Description/schema health |
| P95 tool latency | UX and timeouts |
| Write tools requiring approval % | Safety posture |
| Server version drift | Supply-chain hygiene |
No. It is a widely cited milestone from the foundation handoff period. Re-check current registry stats when you publish numbers externally.
No. Expect a long tail of demos. Production grade is an evaluation outcome, not a registry badge.
For personal DX, maybe. For company data agents, use allowlists and reviewed packages.
Yes when you need private data models, custom authz, or sharper tools than a generic connector.
Marketplaces are distribution UX. MCP is the wire contract. Evaluate both.
One high-quality read-only connector (docs or tickets) behind strict scopes and logging.
No. Downloads measure interest in building, not uptime of third-party servers.
Attack surface grows with convenience. Invest in review pipelines and gateways as adoption rises.
Stack versions: Pins from the category manifest (verify at build): OpenRouter (~315+ models, July 2026 pricing/fees); LangGraph 1.0+; CrewAI 1.14+; Microsoft Agent Framework 1.0; Vercel AI SDK 6; Pydantic AI (latest); LlamaIndex (latest); OpenAI Agents SDK (latest + MCP); MCP (Linux Foundation governance); A2A (HTTP+SSE+JSON-RPC 2.0); Solana
@solana/web3.js+@solana/spl-token.
Reviewed by Chris St. John·Last updated Jul 16, 2026