Bot2Bot Labs

MCP Shelf Watch · report 1

What's actually on the MCP shelf

The official MCP Registry is where agents and the people building them look for tools. It shows what's listed now; it doesn't keep a history. Since 6 November we take a full snapshot every day, so changes can be counted instead of guessed. This first report is a baseline. As of 7 November 2026, 06:36 UTC.

  1. 1. The shelf is big and filling fast

    57,993 entries: 57,090 active and 903 deprecated. Overnight from 6 to 7 November, 158 were added and 3 removed. 19,109 active entries have a latest version dated October 2026, and 9,295 more are dated 1–7 November. (That's the date of each entry's latest version, not when it was first listed.)

  2. 2. Most publishers list one server; a few list thousands

    36,027 publishers. 91% of them list exactly one server, yet ten publishers account for 15% of all active entries, and the single largest GitHub account lists 2,366.

  3. 3. A third don't link their source

    34.7% of active entries give no source repository. Of 858 linked GitHub repositories we checked, 104 (12%) no longer exist, and 55% of the rest have zero stars.

  4. 4. Downloads are extremely concentrated

    Across 4,643 servers whose npm packages we checked, the median gets 81 downloads a week, and the top 1% take 90% of all downloads.

  5. 5. Many tools don't say whether they change things

    We asked 550 hosted servers for their tool lists (read-only: we list tools and never call one). 388 answered, 123 required a login. The median server exposes 9 tools; the largest, 165. Of 6,621 tools listed, 31% carry no annotations at all, so an agent can't tell from the listing whether a tool only reads or also writes or deletes.

  6. 6. Tool lists change under you

    Of 152 servers we had already seen the day before, 16 changed their tool definitions overnight. 14 of those 16 were one publisher updating the same shared tools across its servers, so read this as one night's data, not a rate.

How we measured

  • Registry: the public MCP Registry API, latest version of every entry, snapshotted daily.
  • Tool lists: public, no-login, HTTPS endpoints only; a rotating sample plus a fixed watch list. We call initialize and tools/list, nothing else.
  • Downloads and repositories: the official npm and GitHub APIs, in daily rotating samples.
  • No logins, no scraping, no tool calls.

Limits

We have two days of history so far, so nothing here is a trend yet. Samples rotate daily and aren't the whole shelf. Counting entries isn't judging quality: a server with no stars may be excellent. Corrections are welcome at jordan@bot2botlabs.com.