In November 2024, Anthropic quietly released an open protocol that nobody predicted would become the backbone of the entire agentic AI industry within 16 months. By March 2026, it had 97 million monthly downloads, first-class support from every major AI platform on earth, and a growing list of CVEs that proved it was too important to ignore from a security standpoint. Here is every verified number that explains how that happened — and why it matters for every developer, enterprise architect, and digital business in 2026.

---

What Is MCP and Why Does Every AI Company Suddenly Care?

Before the numbers, the context. Model Context Protocol — MCP — is an open standard created by Anthropic and publicly released on November 25, 2024. Its job is deceptively simple: give AI agents a standardized, universal way to connect to external tools, data sources, APIs, and services. Think of it as USB-C for AI. Before MCP, every AI tool had its own proprietary way of talking to the outside world. Every integration was a custom engineering project. Every connection was rebuilt from scratch for every new AI client. MCP replaced all of that with a single shared language.

The comparison that has stuck hardest in developer communities is that MCP is to AI agents what HTTP was to the internet. It’s the plumbing layer that makes everything else composable, scalable, and interoperable. And the adoption statistics that have emerged across 2025 and into 2026 suggest the entire industry validated that comparison with remarkable speed and conviction.

What follows is every verified number behind MCP’s rise — organized by growth, ecosystem scale, enterprise deployment, security realities, market confidence, and where the standard goes next.

---

The Growth Story: From Zero to 97 Million in 16 Months

The Fastest Adoption Curve Ever Recorded For an AI Integration Standard

The headline number that frames everything else: MCP SDK downloads grew from approximately 100,000 in November 2024 to over 8 million by April 2025 — an 8,000% increase in five months. That is the fastest adoption curve ever recorded for any AI integration standard, according to multiple independent research sources tracking the protocol ecosystem.

But that was just the beginning. By December 9, 2025 — exactly 13 months after launch — Anthropic’s official ecosystem update confirmed that combined Python and TypeScript SDK downloads had crossed 97 million per month. At that point, MCP had crossed from developer curiosity into the kind of infrastructure category that defines an entire technology generation.

The growth timeline in clean numbers:

Month	Monthly SDK Downloads	Growth Milestone
November 2024	~100,000	Protocol launch
February 2025	~1,000,000+	1,000+ servers developed
April 2025	8,000,000+	OpenAI & Google adopt
October 2025	~50,000,000	Linux Foundation donation
December 2025	97,000,000+	Official ecosystem confirmation
May 2026	97M+ (sustained)	9,652 official registry records

That trajectory — zero to 97 million monthly downloads in 13 months — places MCP among the most widely adopted developer infrastructure tools in the history of AI tooling. For context, the npm package ecosystem took years to reach comparable download velocities for foundational web tooling. MCP did it in a single calendar year.

---

The Ecosystem: Servers, Clients, and Platform Adoption

How Big the MCP Ecosystem Actually Is Right Now

The server and client ecosystem that has grown up around MCP tells its own adoption story — and the numbers here require some precision, because different sources measure different things.

The most authoritative figures, sourced directly from Anthropic’s December 2025 ecosystem update:

• 10,000+ active public MCP servers — Anthropic’s official confirmed count

• 97M+ monthly SDK downloads — Combined Python and TypeScript

• First-class client support across ChatGPT, Claude, Cursor, Gemini, Microsoft Copilot, and Visual Studio Code

The official MCP Registry API, pulled May 24, 2026 (Digital Applied verification):

Registry Metric	Verified Count	Note
Latest server records	9,652	Latest versions only
Total server/version records	28,959	Includes all historical versions
GitHub repositories (mcp-server topic)	15,926	As of May 24, 2026
modelcontextprotocol/servers stars	86,148	GitHub repository
modelcontextprotocol/servers forks	10,799	GitHub repository
Official registry repository stars	6,852	GitHub repository

A separate academic dataset from mid-2026 catalogued approximately 14,000 MCP servers and 300 MCP clients. The MCP Growth analytics dashboard at mcpgrowth.den.dev reported a cumulative total of 53,026 servers with a growth rate of +15,269.9% since tracking began — though this figure includes all versions and submissions, not just active, verified servers.

The practical takeaway is this: MCP has a near-10,000 verified active public server footprint by the most conservative official measure, a GitHub ecosystem of more than 15,000 repositories, and a reference implementation repository that would rank among the most-starred infrastructure tools released in the past three years.

---

Platform Adoption: Every Major AI Vendor Is Now On Board

The platform adoption story is the part of MCP’s rise with the strongest source backing. The progression from Anthropic-only protocol to cross-vendor standard happened in less than six months:

Platform	MCP Integration	Date
Claude / Claude Desktop	Original MCP client, reference servers, connector directory	November 2024
OpenAI / ChatGPT	Connectors, remote MCP servers via Responses API	March–April 2025
Google DeepMind / Gemini	Gemini SDK support, automatic tool-calling loops	April 2025
Microsoft / GitHub Copilot	Copilot Studio + GitHub MCP Server public preview	May 2025
Visual Studio Code	Native MCP support	May 2025
Vertex AI Agent Builder	Google Cloud Agent Development Kit + MCP	2025
Cursor	Remote MCP URLs, Settings > Tools & MCP	2025
Vercel	MCP server deployment docs, AI SDK client path	2025

The most strategically significant moment in MCP’s standardization journey came on December 9, 2025, when Anthropic donated MCP to the Agentic AI Foundation (AAIF) under the Linux Foundation — transforming it from a company-owned protocol into a neutral, community-governed open standard. The founding platinum members of the AAIF include AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft, and OpenAI. That is, essentially, the entire AI industry acknowledging MCP as the standard they are all willing to build on.

---

💡 The strategic implication: When OpenAI, Google, and Microsoft all adopt the same open protocol that their primary competitor created — that is a statement about the protocol’s quality, not just its momentum. The industry converged on MCP because it solved a real problem better than anything else available.

---

Enterprise Deployment: What Production Actually Looks Like

The Gap Between Experimentation and Production Is Real — But Closing Fast

Enterprise adoption statistics for MCP require careful reading because different surveys measure at different stages — piloting, limited production, and broad production are meaningfully different things. The Stacklok State of MCP in Software 2026 report, which surveyed large enterprise technical leaders across software, financial services, and retail, provides the most rigorous breakdown:

Adoption Stage	All Software Respondents	Software Industry Cohort
Planning or evaluating	29%	26%
Pilot	30%	30%
Limited production	29%	26%
Broad production	12%	19%
In some form of production	41%	45%

The honest interpretation: 41% of large software organizations are running MCP in some form of production as of early 2026. That is strong adoption for a protocol that didn’t exist 18 months ago. It is materially different from some earlier claims of 78%+ enterprise production adoption, which were not source-backed. The 41% figure is the defensible one.

Additional enterprise data points that paint the broader picture:

• 28% of Fortune 500 companies had deployed MCP servers for production AI workflows by early 2026 (Truto, 2026 vendor/analyst estimate)

• 70% of enterprises already run AI agents in production, with another 23% planning deployment in 2026 (Team8 CISO Village Survey, 2025)

• 86% of MCP servers currently run locally on developer machines; only 5% run in true production environments (Clutch Security, 2026) — a deployment reality check that explains why raw server counts overstate production maturity

• At Block (the enterprise running Goose, one of AAIF’s founding projects), most employees report 50–75% time savings on common tasks using MCP-powered tooling

---

Who Is Actually Using MCP Inside Enterprises

Stacklok’s enterprise survey data reveals the primary user groups and use cases that are driving real production deployment:

Primary enterprise MCP user groups:

• Software developers (primary)

• Data analysts and data scientists

• Knowledge workers

• Management and leadership teams

Top enterprise software use cases for MCP:

• Test generation and automated QA

• Code review and vulnerability remediation

• Debugging and legacy code understanding

• Technical debt discovery

• Internal knowledge search and documentation retrieval

Hosting model breakdown: Enterprise respondents are split between private cloud, SaaS-hosted, and hybrid deployment models, with most planning to build MCP platforms in-house using a combination of open-source and proprietary components — often with outside expert support.

Top enterprise barrier: Security concerns and compliance requirements, followed by implementation cost, legacy integration complexity, team training, and business-value proof.

---

Developer Productivity: The ROI Data

Beyond adoption counts, the productivity impact data represents the clearest argument for why MCP deployment continues to accelerate despite security concerns.

The Zuplo State of MCP survey found:

• 49% of technical professionals measure the ROI of MCP adoption through developer productivity and time savings

• 42% measure it through enabling new capabilities

• 40% through improved user/customer satisfaction

• 30% say the primary value they get from MCP is better context for AI responses

• 25% cite enhancement of AI capabilities for specific tasks

• 70% of MCP consumers already have between 2 and 7 MCP servers configured within their AI environments

In practice, the most common MCP server types used by developers are data sources such as documentation and knowledge bases, followed by API integrations and development tools like Git — reflecting MCP’s strongest early ROI: context engineering for AI coding agents.

---

Market Confidence: Will MCP Become the Permanent Standard?

Sentiment Among Developers and Technical Leaders in 2026

The forward-looking confidence data matters as much as the current adoption data, because MCP’s value compounds over time — every additional server, client, and enterprise integration makes the whole ecosystem more valuable.

The Zuplo State of MCP survey captured the clearest confidence snapshot available:

• 72% of MCP adopters expect their use of MCP to increase in the next 12 months (34% significantly, 38% slightly)

• 54% are confident in MCP’s long-term viability as an industry standard

• 40% expect 26–50% of their AI tool usage to involve MCP within 12 months

• 28% expect MCP to account for more than 51% of their AI tool usage within 12 months

• 85% of developers are now familiar with MCP (Docker State of Agentic AI survey, 800+ developers)

The holdout population is real and worth acknowledging: nearly 40% of respondents remain skeptical about MCP’s long-term future, citing concerns about competing protocols such as Google’s A2A, UTCP, and ACP. The standards battle for agentic AI infrastructure is not over. But the Linux Foundation donation and the platinum membership roster of AWS, Google, Microsoft, and OpenAI represent a level of institutional endorsement that gives MCP a structural advantage over alternatives.

Gartner’s forward projection adds a market-level data point: 75% of API gateway vendors will add MCP features by 2026, treating MCP support as a table-stakes feature of modern API infrastructure rather than a differentiator.

---

The Security Reality: MCP’s Most Uncomfortable Statistics

Adoption Sprinted. Security Walked.

The security data surrounding MCP is the part of this story that every developer and enterprise architect needs to read carefully. Adoption grew at 8,000% in five months. Security maturity did not. The gap between those two trajectories has already produced real exploits, confirmed CVEs, and supply chain incidents affecting hundreds of thousands of developer environments.

The summary from multiple independent security audits: MCP adoption exploded in 2025, but security maturity lagged badly.

---

Authentication: The Foundational Problem

A credential audit of 5,200+ MCP servers conducted by Astrix Security in late 2025 found:

• 88% of MCP servers require credentials to operate

• 53% rely entirely on static API keys or Personal Access Tokens — the weakest form of authentication

• Only 8.5% use OAuth — the recommended standard from the MCP specification itself

• 79% pass credential keys via environment variables — a practice that creates secrets sprawl

• 24% of MCP servers operate with no authentication whatsoever (Zuplo survey; likely local/trusted deployments, but incompatible with zero-trust architectures)

A Trend Micro investigation found 492 MCP servers exposed to the open internet with zero authentication or encryption, providing unauthenticated access to 1,402 MCP tools — with 90%+ allowing direct read access. A follow-up scan found that count had nearly tripled to 1,467 exposed servers.

GitGuardian’s State of Secrets Sprawl 2026 found 24,008 secrets in MCP-related configuration files on public GitHub, with 2,117 still valid and exploitable at time of publication.

---

Vulnerability Rates By Attack Class

Independent security assessments across thousands of MCP server implementations found alarming rates of common vulnerability classes:

Vulnerability Type	Prevalence	Source
Path traversal	82% of file-operation implementations	Endor Labs (2,614 implementations)
SSRF (Server-Side Request Forgery)	36.7% of 7,000+ servers	BlueRock Security, 2026
Command injection	43% of tested servers	Equixly, 2025–Feb 2026
Critical vulnerabilities (any class)	33% of 1,000 scanned servers	Enkrypt AI, October 2025
Tool poisoning indicators	~5.5% of 1,899 servers	Academic study, Hasan et al., 2025
Any security finding	66% of 1,808 scanned servers	AgentSeal scan
Cross-server cascade rate	72.4% when multiple servers compromised	Security research, 2025
Average security score	34 out of 100	CoSAI audit of 17 MCP servers

⚠️ Important caveat: One independent audit found a ~78% false-positive rate from YARA-based MCP scanners (AppSec Santa, April 2026), meaning raw vulnerability percentages vary significantly by methodology. The directional picture is clear — security is immature — but specific percentages should be treated as indicative rather than precise.

---

Named CVEs: The Vulnerability Record Is Growing Fast

MCP’s rapid adoption has produced a CVE record that is growing at a rate that warrants serious attention. 30+ CVEs were filed against MCP servers in a single 60-day window in early 2026, with 43% being command injection patterns. The named CVEs include:

• CVE-2025-6514 (mcp-remote): CVSS 9.6 — OS command injection affecting mcp-remote v0.0.5–0.1.15, patched in v0.1.16. Achieved the first verified full remote code execution on a client operating system via an untrusted remote MCP server. Affected 437,000+ downloaded environments (JFrog Security Research Team, July 9, 2025)

• CVE-2025-49596 (Anthropic MCP Inspector): CVSS 9.4 — Remote code execution via browser/DNS rebinding and 0.0.0.0 binding, patched in v0.14.1 (Oligo Security / Tenable, June 13, 2025)

• CVE-2025-54136 “MCPoison” (Cursor): CVSS 7.2 — Persistent RCE via trusted-but-swapped MCP config (Check Point, patched Cursor 1.3, July 29, 2025)

• CVE-2025-54135 “CurXecute” (Cursor): RCE via MCP auto-start prompt injection (Aim Labs, August 2025)

• CVE-2026-33032 “MCPwn” (nginx-ui MCP): CVSS 9.8 — Authentication bypass, actively exploited in the wild at time of disclosure (Pluto Security / Recorded Future, patched March 15, 2026)

• Anthropic Git MCP Server (CVE-2025-68143/68144/68145): Three CVEs including path traversal and argument injection (Cyata / Dark Reading, January 2026)

The supply chain dimension of MCP security materialized with the postmark-mcp incident in September 2025 — a malicious npm package version that silently BCC’d all processed emails to an external attacker-controlled domain. This was the first documented malicious MCP server supply chain attack. It was followed by the OpenClaw/ClawHub incident, where Antiy CERT confirmed 1,184 malicious agent skills in a public ecosystem, and Snyk’s ToxicSkills audit found 13.4% of 3,984 audited agent skills contained at least one critical security issue.

---

The Bug Bounty Signal

The security research community’s engagement with MCP vulnerabilities is measurable through bug bounty data:

• HackerOne logged a 540% surge in prompt-injection vulnerability reports — the fastest-growing threat category in AI security (HackerOne 9th Annual Hacker-Powered Security Report, October 2025)

• AI vulnerability reports on HackerOne grew 200%+ year-over-year, with $2.1M+ paid for AI vulnerabilities — a 339% increase in bounty payouts year-on-year

• 82% of security researchers now use AI in their offensive workflows (Bugcrowd Inside the Mind of a Hacker 2026)

• Anthropic made its HackerOne bug bounty public in May 2026 with MCP integrations explicitly in scope; its separate Model Safety bounty offers up to $15,000 for universal jailbreaks

---

Enterprise Security Readiness: The Uncomfortable Gap

The security readiness data for enterprises deploying MCP maps closely to the broader agentic AI security crisis:

• Only 29% of organizations feel prepared to secure agentic AI (Cisco State of AI Security 2026)

• 88% of organizations reported confirmed or suspected AI agent incidents in the last year (Gravitee 2026), rising to 92.7% in healthcare

• Only 23% have a formal enterprise-wide agent identity strategy

• Only 18% are highly confident their IAM infrastructure can handle agent identities (CSA/Strata, February 2026)

• Only 24% of enterprises have a dedicated AI security governance team

• Only 14.4% of AI agents reach production with full security approval

• 47–53% of organizations have experienced AI agents exceeding permissions or suffering a security incident (multiple sources)

Gartner’s forward projections tie these trends directly to MCP’s growth:

• 25% of enterprise breaches will be traced to AI agent abuse by 2028

• More than 50% of successful attacks on AI agents will exploit access-control issues through 2029

• 25% of enterprise GenAI applications will experience 5+ minor security incidents per year by 2028, up from 9% in 2025

• 15% of all enterprise GenAI applications will experience at least one major security incident per year by 2029, up from 3% in 2025

---

The Financial Scale of the MCP Opportunity

MCP sits at the intersection of two massive market trajectories: the AI agents market and the API/integration infrastructure market. Both are growing at rates that dwarf almost every other enterprise technology category.

Market	2025 Size	2026+ Projection	CAGR
MCP-adjacent market	$1.2–1.8 billion	$4.5B+ by 2027	40%+
AI Agents market	$7.92 billion	$236 billion by 2034	45.82%
API Management market	~$6.2 billion	$26+ billion by 2031	~18%
AI Workflow Automation	~$15 billion	$40.77 billion by 2031	~22%

Gartner predicts that 40% of enterprise applications will feature task-specific AI agents by end of 2026, up from less than 5% in 2025. Every one of those agents needs a standard way to connect to tools and data. That is MCP’s market.

---

A2A, ACP, UTCP — Why MCP Is Still Leading

MCP does not exist in isolation. Several competing or complementary agent protocols have emerged, each solving slightly different problems in the agentic AI stack:

Protocol	Created By	Primary Function	Relationship to MCP
MCP	Anthropic (now AAIF/Linux Foundation)	AI ↔ Tools / Data sources	The incumbent standard
A2A	Google	Agent ↔ Agent communication	Complementary (different layer)
ACP	IBM / BeeAI	Agent ↔ Agent (REST-based)	Competing/complementary
UTCP	Community	Universal tool calling	Emerging challenger

The key clarification: MCP and A2A are not competitors — they operate at different layers of the same stack. MCP defines how an AI agent connects to tools and data sources. A2A defines how agents communicate with each other. Most production agentic systems will ultimately use both. The standards war is most live between MCP and emerging alternatives at the tool-integration layer — and MCP’s Linux Foundation home and platinum member roster give it a significant structural advantage in that fight.

---

The Six Numbers That Define MCP in 2026

If you need to walk away from this article with a dashboard-level understanding of where MCP stands, these are the six numbers that tell the complete story:

97 million — Monthly SDK downloads confirmed by Anthropic (December 2025). The demand signal that proves this is mainstream infrastructure, not a developer experiment.

9,652 — Verified latest server records in the official MCP Registry as of May 2026. The supply-side ecosystem that makes MCP useful at scale.

41% — Percentage of large software organizations in some form of production with MCP servers (Stacklok 2026). The enterprise penetration figure that puts MCP ahead of where most protocols are at 18 months old.

8.5% — Percentage of MCP servers using OAuth authentication. The security maturity gap that tells you exactly where the industry’s next 12 months of work needs to go.

30+ — CVEs filed against MCP servers in a single 60-day window in early 2026. The vulnerability acceleration signal that every security team needs to have on their radar.

72% — Percentage of MCP adopters who expect their usage to increase in the next 12 months. The forward confidence indicator that tells you MCP’s growth curve is not finished.

---

The Next 12 Months of the Standard

The consensus view from MCP’s core maintainers, independent analysts, and Stacklok’s enterprise survey is that MCP’s next phase is less about proving that a standard can attract developer attention — that battle is won — and more about operationalizing it safely at enterprise scale.

The clear directions for 2026 and into 2027:

• More first-party SaaS vendors will ship official MCP servers, moving from community-built wrappers to vendor-maintained, enterprise-grade integrations with proper security controls and SLAs

• Streamable HTTP will continue replacing older STDIO and SSE implementations as remote MCP server deployments grow and production requirements demand bidirectional transport

• Registry governance will mature, with trust scoring, namespace ownership verification, security auditing requirements, and stale-package detection becoming standard features of the MCP ecosystem

• Enterprise security tooling built specifically for MCP will emerge — covering prompt injection detection at the MCP layer, tool poisoning prevention, agent identity management, and OAuth 2.1 enforcement

• MCP composition with A2A will become a standard architectural pattern for multi-agent systems, with MCP handling tool connections and A2A handling agent-to-agent coordination

• Gartner’s prediction that 40% of enterprise applications will have task-specific AI agents by end of 2026 will translate directly into accelerating MCP server demand, as every new agent deployment needs tool connections

The open questions that will determine MCP’s trajectory: whether official and downstream registries can develop trust and curation mechanisms that make server selection safe at scale; whether security tooling can evolve fast enough to close the gap between deployment velocity and vulnerability rates; and whether competing protocols can find enough differentiation to challenge MCP’s structural advantage in the cross-vendor AI tool integration layer.

The careful conclusion: MCP is no longer speculative infrastructure. It is the de facto standard for connecting AI agents to the real world — adopted by every major AI platform, backed by the Linux Foundation, and running in production at 41% of large software organizations. The growth curve is real. The security gap is real. Both of those facts will define the next chapter of this story.

---

The Complete Stats Reference: Every MCP Number That Matters in 2026

Category	Statistic	Source
Launch date	November 25, 2024	Anthropic
Downloads at launch	~100,000/month	Pulse / ecosystem data
Downloads by April 2025	8,000,000+/month	Multiple sources
Downloads by December 2025	97,000,000+/month	Anthropic official
Growth Nov 2024 – April 2025	8,000%	Calculated
Active public servers	10,000+	Anthropic, Dec 2025
Official registry records	9,652 latest / 28,959 total	Digital Applied, May 2026
GitHub topic repositories	15,926	GitHub API, May 2026
Reference repo stars	86,148	GitHub API, May 2026
Linux Foundation donation	December 9, 2025	Anthropic / Linux Foundation
AAIF platinum members	AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft, OpenAI	Linux Foundation
Platforms supporting MCP	Claude, ChatGPT, Gemini, Copilot, VS Code, Cursor, GitHub	Anthropic ecosystem update
Enterprise in production	41% (limited + broad)	Stacklok 2026
Fortune 500 deployed MCP	~28%	Truto 2026 (treat with caution)
Servers running locally	86%	Clutch Security 2026
Servers in production	5%	Clutch Security 2026
Developer productivity gain	50–75% time savings	Block/Goose enterprise data
MCP usage increase expected	72%	Zuplo survey
Long-term viability confidence	54%	Zuplo survey
Servers using OAuth	8.5%	Astrix credential audit
Servers using static API keys	53%	Astrix credential audit
Servers with no authentication	24%	Zuplo survey
Path traversal vulnerability rate	82%	Endor Labs
Command injection rate	43%	Equixly
SSRF vulnerability rate	36.7%	BlueRock Security 2026
Critical vulnerabilities	33% of 1,000 scanned	Enkrypt AI
CVEs in 60-day window	30+	Multiple researchers, early 2026
Highest CVE CVSS score	9.8 (CVE-2026-33032)	Pluto Security
Prompt injection surge	540% YoY on HackerOne	HackerOne Annual Report
AI bug bounty payouts	$2.1M+ (+339% YoY)	HackerOne 2025
Secrets in MCP GitHub repos	24,008 found / 2,117 valid	GitGuardian 2026
AI agent incidents (enterprises)	88% reported one or more	Gravitee 2026
Orgs prepared for agentic AI	Only 29%	Cisco 2026
Formal agent identity strategy	Only 23%	CSA/Strata 2026
Gartner API gateway vendors adding MCP	75% by 2026	Gartner
Enterprise breaches from agent abuse by 2028	25%	Gartner
API gateway market 2026	$240B cybersecurity total	Gartner

FAQs