The MCP Ecosystem in 2026: What 177,000 Tools Actually Do
The UK AISI study of 177,436 MCP tools reveals a shift from passive observation to active modification. Agents are doing more, but security infrastructure is not keeping pace.
The MCP Ecosystem in 2026: What 177,000 Tools Actually Do
The UK AI Security Institute published the largest empirical study of AI agent tools to date, analyzing 177,436 MCP tools from 19,388 verified servers. The number is striking, but the structural shift behind it matters more. In sixteen months, action-oriented tools : the ones that modify files, execute commands, and interact with live systems : rose from twenty-seven percent to sixty-five percent of usage. Agents are not just observing anymore. They are doing. And the security infrastructure for that transition is not keeping pace.
This guide explains what MCP is, what those 177,000 tools actually do, and what builders need to know before wiring agents into production systems.
What MCP Is, Briefly
MCP stands for Model Context Protocol. It is an open standard that lets AI models connect to external tools through a simple server-client model. An MCP server exposes a specific capability : search a database, control a browser, edit a file, query an API. An MCP client : Claude Desktop, Cursor, VS Code, or any compatible agent : calls that server through a standardized interface.
The protocol was donated to the Linux Foundation in December 2025. That openness is the point: any model can talk to any MCP server. There is no vendor lock-in at the protocol layer. What changes is which model reasons best across multiple tool calls in sequence.
Background: MCP was created by Anthropic but donated to the Linux Foundation in December 2025. The protocol is open, which means Google Gemini, OpenAI's models, and any other compatible client can use the same servers. The competitive moat is not the protocol; it is which model executes multi-step tool calls most reliably.
Researched and written by Artificial Dispatch's AI newsroom, with an automated and human quality check before publishing. AI-generated reporting can contain errors, so verify anything important against the linked sources. Spot a mistake? Tell us and we will correct it.
The 177,000 Figure: What the Study Actually Measured
The UK AISI study is not a press release number. It is a longitudinal dataset tracking the MCP ecosystem from November 2024 through February 2026. The 177,436 tools come from 19,388 independently verified servers. The thirty-five-fold growth in twelve months is real, and it is accelerating.
The critical finding is the shift in tool taxonomy. Early MCP servers were mostly read-only: search, retrieve, query. By February 2026, action tools : write, execute, modify, deploy : dominated. Payment execution servers alone grew from forty-seven to 1,578, a thirty-four-fold increase. General-purpose tools like browser control and computer automation now account for fifty percent of all downloads.
This is not an abstract trend. It means agents are moving from research assistants to operational actors. The same protocol that once powered "search my email" now powers "transfer funds between accounts." The capability gap between what agents can observe and what they can modify is closing fast.
Agents are moving from passive observation to active environmental modification faster than the governance frameworks meant to constrain them.
What These Tools Actually Do
The domain concentration is extreme. Sixty-seven percent of MCP tools target software development, and ninety percent of downloads come from that category. If you are building with MCP, you are almost certainly working in the dev tooling space.
Finance is the notable outlier for high-stakes actions. The thirty-four-fold growth in payment execution servers suggests financial automation is the frontier where agents are gaining real operational authority. Other domains : healthcare, legal, manufacturing : are present but marginal in the current dataset.
Geographically, fifty percent of tool usage happens in the United States, twenty percent in Western Europe, and five percent in China. The distribution tracks PyPI and NPM download patterns more than it reveals regional adoption preferences.
A recursive pattern is worth noting: sixty-two percent of new MCP servers created in February 2026 were co-authored by AI, with Claude Code accounting for sixty-nine percent of those. Agents are building tools for agents. The loop is not hypothetical; it is already in the data.
What this means in practice:* A developer who needs a custom Slack integration can describe the requirement to Claude Code, which generates the MCP server scaffold, implements the OAuth flow, and writes the test suite. The developer reviews and deploys. The cycle accelerates because the barrier to creating a new tool is collapsing from "learn the protocol and build it" to "describe what you want and verify what the agent built."
This has implications for tool quality. A human-built MCP server is more likely to have thoughtful error handling and clear documentation. An AI-coauthored server may work for the happy path but fail unpredictably at edge cases. The ecosystem is scaling faster than quality control can keep up.
Tool categories to know:* Data access tools : SQL connectors, API wrappers, document parsers : are the most common and generally the safest. File system tools are next; they read and write local files, which carries obvious risk. Browser automation tools let agents navigate websites and extract data. Code execution tools run arbitrary code in sandboxed or unsandboxed environments. Payment and transaction tools are the smallest category by count but the fastest-growing by percentage. Each category demands a different security posture.
Advertisement
Advertisement
The Security Gap
The same day the AISI study published, a separate security analysis found approximately two thousand internet-exposed MCP servers with no authentication whatsoever. Zero. No API keys, no OAuth, no access controls. Anyone on the internet could connect to them and execute whatever actions those servers exposed.
This is not a theoretical risk. An unauthenticated payment execution server is a direct financial attack surface. An unauthenticated file modification server is a data destruction surface. The growth in action tools makes this gap more dangerous by the week.
Real-world exposure:* The security scan that uncovered the two thousand exposed servers used automated port scanning and protocol fingerprinting. It found servers on public IPs with no firewall rules, no API keys, and no rate limiting. Some exposed full database write access. Others exposed shell execution. Many were abandoned experiments left running on cloud instances.
Why this keeps happening:* MCP servers are easy to create and deploy. A developer can scaffold one in an afternoon, test it locally, deploy it for a colleague, and forget it exists. Without a registry that enforces authentication, there is no gatekeeper. The protocol is open by design (MCP specification), which means security is opt-in.
OAuth does not solve the deeper problem. Multi-hop delegation : where an agent calls a tool that calls another tool, each with its own identity and permission scope : lacks a standard framework. The Agent Identity Protocol has been proposed as a fix, but it is alpha-stage and not yet adopted. The next MCP specification release, expected June 2026, may address some of these gaps. Until then, the burden falls on individual server operators.
The action-tool shift is real. The authentication gap is real. The gap between them is where the risk lives.
How to Think About MCP as a Builder
Assume all action tools are dangerous until proven otherwise.* Read-only tools carry lower risk; action tools that write files, execute code, or trigger payments need the same security scrutiny you would apply to a production API with write access.
Audit your server exposure.* If you run an MCP server, check whether it is internet-facing. If it is, it needs authentication. The tooling for this audit is still primitive; manual review is often the only option.
Treat MCP as protocol, not product.* The protocol is open and standardized. The individual servers are not. Quality, security, and maintenance vary wildly. The server ecosystem is closer to browser extensions than to vetted app stores.
Expect rapid churn.* Thirty-five-fold growth in a year means most servers are new, unmaintained, or experimental. The server that works today may break tomorrow. Build with fallback paths.
Watch the specification release.* The June 2026 MCP spec update will likely include security and identity improvements. If you are planning a production MCP deployment, waiting for that release is reasonable unless you have urgent operational needs.
The catch: The 177,000-tool milestone is evidence of demand, not quality. The action-tool shift is evidence of capability maturation, not safety. The gap between what agents can do and what infrastructure allows them to do safely is where the real risk lives.
The Bigger Picture
The MCP ecosystem is growing because it solves a real problem: agents need tools, and tool builders need a standard interface. The 177,000 count is evidence of demand, not quality. The action-tool shift is evidence of capability maturation, not safety.
The open protocol is the right architecture. No single vendor controls the agent-tool relationship. But openness without governance creates the security vacuum we are seeing now. The next phase of MCP will be defined by whether identity, authentication, and permission frameworks catch up to the tool growth.
For builders, the practical advice is simple: use MCP for read and research today. Use action tools only with servers you control, authenticate, and audit. Fully autonomous agents modifying live systems is a real promise, but the infrastructure to do that safely is still being built.
