The state of MCP in 2026: which tools actually ship a server

The Model Context Protocol (MCP) is the open standard that lets an AI agent call another product's features and read its data through one common interface, instead of a bespoke integration for every app. Anthropic released it in late 2024, and by 2026 the argument is over: an MCP server is the default way agents connect to software. The adoption that settled it came from Anthropic's competitors — OpenAI shipped full MCP client support in ChatGPT in late 2025, and Google shipped official MCP support for its own services plus a managed remote server for Gemini in mid-2026. When Anthropic, OpenAI, Google, and Microsoft all back the same protocol, the standard is set.

So the interesting question in 2026 is no longer whether MCP won. It is which servers are actually worth connecting an AI agent to — because the raw count is enormous and mostly noise.

Update, September 13, 2026: the spec grew up, the registry didn't, and the count quadrupled

This piece closed in July with three things to watch. Two months on, one has happened, one has not, and the third has happened faster than we expected. One correction first.

What we left out on the day. The original describes MCP as the open standard Anthropic released, which is true, but it does not say who runs it now: since December 9, 2025 the protocol has been stewarded by the Agentic AI Foundation, a Linux Foundation directed fund co-founded by Anthropic, Block and OpenAI, with Anthropic still maintaining the core infrastructure. That was seven months old when we published and should have been in the piece. The foundation has since added a formal contributor ladder, working groups and a deprecation policy (May 27), and published a roadmap (August 22).

Remote and auth became boring, as predicted. The 2026-07-28 revision of the specification, finalised on July 28, is the biggest change to MCP since it shipped. The core is now stateless: the initialize handshake and session IDs are gone, replaced by per-request headers, and tools/list responses can be cached with a time-to-live. Elicitation was replaced by multi-round-trip requests that do not need an open stream. Authorization now requires issuer validation and replaces dynamic client registration with client ID metadata documents, and a formal extensions framework carries Tasks, MCP Apps and enterprise-managed authorization. Roots, sampling, logging, dynamic client registration and the legacy HTTP-plus-SSE transport are deprecated with at least a twelve-month window. The SDKs for TypeScript, Python, Go and C# were updated the same day, Ruby reached 1.0 and Rust is in beta. GitHub's server went stateless on July 23, Vercel's followed on July 31, and Claude's enterprise-managed auth went generally available through Okta on August 24. "Can you run one safely at scale" is now a spec question with an answer.

Discovery and trust did not get solved. The official MCP Registry is still labelled a preview, its API has been frozen at version 0.1 since October 2025, and there is no general-availability date or published server count. The curation problem this piece described in July is exactly where it was, and the incident below is what that costs.

The raw count ran away from the real set. Glama now indexes 86,594 servers, against the roughly 20,000 we quoted in July; part of that jump is how Glama counts, so treat it as an index size rather than a count of working servers. Smithery lists more than 20,900. SDK downloads are now close to half a billion a month, up from the 97 million we cited, with the TypeScript and Python packages each past a billion cumulative downloads. Anthropic's own connectors directory holds more than 950 servers. Our verified first-party set, by contrast, moved from a few dozen to 55 products in the MCP Servers category, and we published a ranked shortlist, the best MCP servers to connect an agent to, on August 2. The gap between the two numbers is the story, and it is wider than it was.

The first supply-chain campaign arrived. On August 10 a malicious MCP server was pushed into 23 GitHub pull requests in 74 minutes, in a campaign the researchers who found it called Deadbugz; its tool metadata reads as benign for the first two calls and turns hostile on the third, which defeats a one-time review. A path-traversal flaw in Atlassian's official server was also reported and fixed. Read together, they make the July argument sharper rather than weaker: a community wrapper can be built to deceive you, and even a first-party server needs the vendor's patch cadence behind it.

Client side, the picture is incremental. Gemini Enterprise added MCP connectors in preview on July 29 and automatic tool discovery on August 6; Microsoft's Copilot Studio added MCP servers as tools and a certification programme in preview in July; OpenAI renamed ChatGPT's Connectors to Plugins on July 9, with developer-mode write actions still labelled beta for business and education plans; Cursor's changelog shows no MCP changes in the window. No major vendor shipped a new first-party server between July 3 and today, and Notion's README now says its local server may be sunset in favour of the remote one, which is the direction the new spec pushes everyone.

The scale is real, and mostly noise

By 2026 one registry alone, Glama, indexed close to 20,000 MCP servers, and the MCP SDKs were pulling on the order of 97 million downloads a month. Those numbers prove the protocol won. They tell you almost nothing about what to build on.

The reason is that "an MCP server" is a low bar. A community-published wrapper around a public API is an MCP server. So is a weekend project, a fork of a weekend project, and a demo that no longer runs. A large share of those 20,000 are exactly that: fine for experimenting, risky to depend on. The number that matters when something you ship relies on it is much smaller — the count of real products that ship an official, first-party server.

What an MCP server actually is

An MCP server is a small adapter a product runs so that an AI agent — Claude, ChatGPT, Cursor, or any MCP-capable client — can use that product through a shared protocol. The agent is the client; the tool is the server. Before MCP, every agent-to-tool connection was a one-off: a custom plugin, a hand-rolled function wrapper, a scraped API. MCP replaces that with a single contract, so one integration works across every client that speaks the protocol. That is why it spread — a standard that removes N×M custom integrations is worth adopting even if you dislike the details.

First-party versus community is the line that matters

The distinction that separates the useful servers from the noise is first-party versus community. A first-party MCP server is one the product's own team builds, ships, and maintains — it authenticates properly, tracks the product's real capabilities, and does not disappear when a single contributor loses interest. That is the layer you connect an agent to when something depends on it working. A third-party wrapper can lag the product, break silently when the underlying API changes, or mishandle the credentials you hand it.

This is the line we curate on. We are building a shortlist of tools that ship an official, first-party MCP server — each one verified on the vendor's own documentation or repository — and deliberately leaving out the wrappers, the registries, and the plumbing. It is a work in progress, and it is meant to grow. The goal is not to count every server in existence; it is to keep an honest, checkable list of the ones that are real.

What the real server layer looks like

The products already shipping official servers cluster into a clear map of what an agent can plug into today. Grouped by what you would use them for:

• Web scraping and data: Firecrawl, Bright Data, Apify — the tools that turn the open web into structured input for an agent.
• Browser automation: Browserbase, Browserless, Hyperbrowser, Steel, Stagehand — headless browsers agents drive to click, fill, and navigate.
• Web search: Exa, Tavily — search built to be called by a model rather than read by a person.
• Databases and agent memory: MongoDB Atlas Vector Search, Redis, Mem0, Zep, Databricks — where agents store and recall context across sessions.
• Project management and work: Linear, Asana, Jira, Notion, Monday.com, Airtable, Attio — the systems of record agents now read from and write to directly.
• Design and site building: Figma Make, Canva, Webflow.
• Code and DevOps: Netlify, Daytona, Replicate, Hugging Face, Context7, Retool — the build-and-deploy surface for code agents.
• Automation and iPaaS: Zapier, Pipedream, Make.com, n8n, Workato, Composio, Arcade — the connective tissue that fans a single agent action out to hundreds of downstream apps.
• Voice and audio: Vapi, ElevenLabs.

This is a snapshot of a list we are actively extending, not a closed set. But read as a map, it already shows the useful version of "what can I plug an agent into today" — a few dozen categories of genuinely agent-ready software, not the whole internet.

Who is shipping servers — and why it matters

The products with official servers split into two camps, and the split is the real story.

The first camp is infrastructure built for agents from the start: Firecrawl, Browserbase, Exa, Mem0. For these, MCP is the front door — the primary way anyone is meant to use the product. That they ship a server is unsurprising; it is their whole business.

The second camp is established SaaS: Linear, Notion, Atlassian, Canva, MongoDB, Monday.com. These companies added an official MCP server so agents can act inside the tools people already run their work in. This camp is the signal. When a $10B work platform ships an MCP server, MCP has stopped being a developer curiosity and become table stakes for serious software. The agent-native tools proved the protocol; the incumbents adopting it is what makes it a standard.

The plumbing is not the product

The loudest part of the MCP conversation in 2026 is not the servers — it is the plumbing around them: registries, gateways, hosts, and auth layers like Smithery, Glama, mcp.so, and MCPTotal. That infrastructure is useful and necessary. But it is the phone book, not the businesses in it. An agent does not connect to a registry to get work done; it uses the registry to find the server it actually needs.

We keep the two separate on purpose. A directory of MCP servers is a different kind of thing from a tool that ships one, and blurring them is exactly how you get a headline count of "tens of thousands" that means very little to someone deciding what to build on.

Where MCP goes next

Three things are worth watching through the rest of 2026.

The first is consolidation. The protocol has won the standards question; the remaining work is making remote, hosted servers and their authentication boring and reliable rather than experimental. That is already happening — Google's mid-2026 remote MCP server for Gemini uses OAuth 2.0 and IAM with audit logging, and vendor registries are arriving to make trusted servers discoverable. The center of gravity is shifting from "can you stand up a server" to "can you run one safely at scale."

The second is discovery and trust. Once there are tens of thousands of servers, the hard problem is not finding one — it is knowing which are real, maintained, and safe to hand credentials to. That is a curation problem, not a count problem.

The third is the widening gap between the two numbers. The raw server count will keep climbing as more community wrappers appear. The set of real products you would actually connect an agent to grows more slowly and deliberately. In 2026, the second group is the one that describes the real state of MCP.

How to pick an MCP server you can trust

If you are wiring an agent to a real system, the choice of server matters more than the count of servers. Four checks separate the ones worth depending on from the thousands you should not.

Confirm it is first-party. The server should be documented on the vendor's own site or repository. A third-party wrapper can lag behind the product, break silently when the underlying API changes, or mishandle the credentials you hand it. Fame is not the test — a well-maintained server from a small agent-native tool beats an abandoned wrapper around a famous one.

Look at how it authenticates. A production-grade server supports proper authentication — API keys or OAuth — rather than asking you to paste a long-lived token into a config file. The 2026 direction of travel is remote, hosted servers with OAuth and scoped permissions, so you can revoke access without rotating everything.

Check that it is maintained. A server tied to a company's roadmap gets updated when the product changes. A server tied to a single volunteer contributor does not, and a stale server is worse than no server because it fails in ways your agent cannot see.

Match the capability, not the logo. The useful question is whether the server exposes the specific actions your agent needs — read a table, run a scrape, deploy a build — not whether the brand is recognizable. Read the server's tool list before you commit to it.

How we built this list

We treat a tool as an MCP server only if it ships an official, first-party MCP server that we verified on the vendor's own documentation or repository — not a community-built wrapper. MCP directories, registries, gateways, and auth infrastructure are excluded by design; they are the layer around servers, not servers you connect to. This is a curated, growing shortlist — a few dozen verified tools as of mid-2026, extended as more products ship official servers — not an attempt to count every server in the ecosystem. You can browse the current set on our MCP Servers category page, and we run a public MCP server for our own catalog so agents can query the directory directly.

Frequently asked questions

Who governs the Model Context Protocol? The Agentic AI Foundation, a Linux Foundation directed fund co-founded by Anthropic, Block and OpenAI, has stewarded MCP since December 9, 2025. Anthropic, which created the protocol in November 2024, still maintains the core infrastructure, and the specification is developed through the foundation's working groups and a formal enhancement process.

What changed in the MCP 2026-07-28 specification? The core became stateless — the initialize handshake and session IDs were removed in favour of per-request headers — tool lists became cacheable, elicitation was replaced by multi-round-trip requests, authorization gained issuer validation and client ID metadata documents in place of dynamic client registration, and an extensions framework now carries Tasks, MCP Apps and enterprise-managed authorization. Roots, sampling, logging and the legacy HTTP-plus-SSE transport are deprecated with at least a twelve-month window.

What is an MCP server? An MCP server is an adapter a software product runs so AI agents can use its features and data through the Model Context Protocol, a shared standard. The agent acts as the client; the product's server exposes its capabilities in a way any MCP-capable agent can call, replacing one-off custom integrations.

How many MCP servers are there in 2026? Public directories list tens of thousands — one registry alone indexes more than 86,000 as of September 2026, up from about 20,000 in mid-2026, a jump that partly reflects how it counts — but most are community wrappers or experiments. The number of official, first-party servers shipped by real products is far smaller, and that curated set is the one worth building on.

Is MCP from OpenAI or Anthropic? MCP was created and open-sourced by Anthropic in late 2024 and has been stewarded by the Agentic AI Foundation under the Linux Foundation since December 2025. It is an open standard, not owned by any single vendor, which is why competitors adopted it — by 2026 it had backing from Anthropic, OpenAI, Google, and Microsoft.

Do ChatGPT and Gemini support MCP? Yes. OpenAI added full MCP client support to ChatGPT (developer mode) in late 2025, covering both read and write actions, and Google supports MCP through the Gemini CLI and a managed remote MCP server for its Gemini Enterprise platform launched in mid-2026. An MCP server you ship works across all of them.

Which companies have official MCP servers? Established products with official servers include Linear, Notion, Atlassian (Jira), Canva, MongoDB, Airtable, Monday.com, and Zapier, alongside agent-native tools like Firecrawl, Browserbase, Exa, and Mem0.

What is the difference between an MCP server and an MCP client? The client is the AI agent or app (such as Claude, ChatGPT, or Cursor) that wants to use external capabilities. The server is the tool or product that exposes those capabilities. One client can connect to many servers, and one server can serve many clients.

Are MCP servers safe to connect? A first-party server from a vendor you already trust carries roughly the same risk as using that product's API. Community-built servers are higher risk, because you are granting an unvetted third party access to your data and credentials — which is why the first-party distinction matters.

— The ToolDirectory.AI editorial team