MCP Servers Move Into Marketplaces as Security Holes Pile Up

The protocol question is settled. Running it safely is not.

This month's coverage of the Model Context Protocol points to a clear shift. Few people now ask whether MCP will become the standard way for AI agents to reach tools and data. The questions now are who controls how servers get found, how fast vendors can get their servers in front of buyers, and whether security work can catch up with a pile of public, mostly unchecked endpoints. In my reading, MCP has made it as a standard. The ecosystem around it hasn't, and much of the risk now sits in that gap.

The adoption picture is consistent across reports. Anthropic open-sourced MCP in November 2024 and handed it to the Linux Foundation's Agentic AI Foundation (AAIF) in December 2025. Block and OpenAI co-founded that body.23 One agency's review published this month argues the debate over MCP's future is over, since OpenAI, Google and Microsoft have all adopted it and no single vendor controls it.27 Google's Agent-to-Agent (A2A) protocol joined the same foundation in August 2026, so the two main agent-interop standards now share a neutral home.28

The stateless rewrite is now the baseline

The biggest technical change this year is the 2026-07-28 specification. Maintainers finalized it on July 28. Anthropic's David Soria Parra called it the largest change to the protocol since authorization was added.21 The revision drops protocol-level sessions and the initialize handshake. Each request now carries its own version and capability information, and servers must answer a new server/discover call.2328

The change targets a practical problem. Under the old session model, operators needed sticky sessions or shared session stores. The new design is meant to work with ordinary round-robin load balancing behind an enterprise gateway.25 The revision also moves long-running Tasks into an official extension and deprecates Roots, Sampling and Logging. It adds a formal policy that keeps deprecated features in the spec for at least 12 months.2822 On authorization, it makes OAuth 2.1 with OIDC a requirement and adds an Enterprise-Managed Authorization extension, so IT administrators can grant server access through an identity provider.25

The extensions track has already produced its first new piece. On September 13, maintainers merged SEP-2640, the Skills Extension, with status Final. It gives agent skills a place in the spec, built on MCP Resources. It is the first proposal accepted since the July release.24

Migration is uneven. One verification tracker counts 48 servers confirmed on the current revision.24 Notion's hosted server added support in early August and still accepts clients on older versions. Cloudflare's documentation endpoint answered server/discover on the new revision in an August probe.24 Microsoft's Azure MCP server has migrated only in a 3.0.0 beta, with no stable release yet. Snyk's and Callstack's servers were still built against the November 2025 revision when checked.24 One explainer notes the cost: two backward-incompatible revisions eight months apart leave real maintenance work for server authors.28

Usage numbers point the same way but differ

Reported scale varies with who is counting and what. One summary says more than 10,000 MCP servers were in production by mid-2026, with SDK downloads above 97 million a month.21 The AAIF put the figure at 110 million a month in April.28 Another account says MCP's Tier 1 SDKs neared half a billion monthly downloads by July, and that the TypeScript and Python SDKs had each passed a billion downloads in total.22 These figures likely measure different SDK sets, so they shouldn't be read as one series. They agree on direction and disagree on size by a wide margin. The enterprise signals are firmer. Salesforce reported 4.5 million MCP calls through its Headless 360 platform by late May.21

Distribution is where vendors now compete

The clearest commercial trend is that having an MCP server no longer sets a vendor apart. What matters is how easily a customer can turn it on. TikTok shows this well. On October 5 it made its ads MCP server a ready-made connector in eight places: Claude, Perplexity, Kimi, Manus, Replit, Snowflake, Tencent WorkBuddy and the IAB Tech Lab Agent Registry.10 Meta launched ads connectors for ChatGPT and Claude in April, and Snap opened its ad platform to outside agents in June. Once every major ad platform had a server, the contest moved to directory placement.10 TikTok says advertiser use of its MCP grew more than 200% since launch but gives no starting figure, so the claim shows direction rather than size.10 Claude's directory version of TikTok's server also leaves out 26 tools, mostly for billing and payments. That suggests platform curators are deciding what agents may touch.10

Workplace software shows the same pattern. Google has connected Gemini in Workspace to Asana, Atlassian Rovo, HubSpot, Mailchimp, QuickBooks, monday.com and Salesforce over MCP. Since September 24, Google's Cloud API Gateway can also present existing REST operations as MCP tools, with authentication, quotas and logging intact.26 Atlassian's Rovo MCP v2 became generally available on September 8 and later added separate read and write tools for capacity planning.26 Microsoft's Work IQ server gives outside agents one endpoint for Microsoft 365, with ten generic tools covering email, calendars, files and Teams.26

Registries and marketplaces are splitting into layers

Discovery has settled into two tiers. The official MCP Registry launched in preview on September 8, 2025. Anthropic, GitHub, PulseMCP and Microsoft back it, and its REST API has been frozen at v0.1 since October 2025.4 It holds only metadata. It removes only illegal content, malware, spam and completely broken servers, and it is meant to feed downstream marketplaces rather than serve users directly.5 It also doesn't support private servers, so enterprises have to run their own catalogs.1

Commercial layers sit on top of it. MCP Market lists more than 48,000 servers and charges $29 for faster review. MCP.so has charged $39 for listings that are published without review.5 Swarms has expanded its marketplace so it connects to a submitted server, reads its tools, and generates setup configs for Claude, Cursor and VS Code. It takes a 10% fee on paid sales.3 Skills marketplaces are growing in parallel. One comparison counts several catalogs with tens or hundreds of thousands of listings and little or no security review.9

Some critics say this structure makes discovery a chokepoint. The official registry acts much like DNS for the ecosystem, and GitHub's registry adds a second center of gravity. The advice is to pin audited servers in a private catalog.6 I find that argument persuasive. The spec is open, but the business of finding and trusting servers is consolidating.

Security is the weakest layer

On security, the coverage agrees more than on anything else, and the picture is bad. OX Security analyzed 15,465 publicly indexed servers across five registries and found no marketplace vetting. That set came down to 5,095 unique hostnames. About 2.3% of those no longer resolve, and six sit on expired domains anyone could register for a few dollars, taking over the identity of an established server.29 The firm's conclusion is that the protocol isn't the problem. The trust placed in it is.29

The vulnerability count is rising. One tracker logged 33 MCP security records between September 3 and 15 alone, beyond separately covered flaws in IBM's ContextForge gateway and Langflow's MCP component.24 Ars Technica reports that independent researcher Syed Anas Mohiuddin showed what he calls "protocol pivoting" against agents from Google, JPMorgan Chase, Rapid7 and government bodies. In these attacks, instructions passed through MCP get forwarded to other agents over channels such as A2A.30 Google's MCP toolbox for databases had a server-side request forgery flaw rated 8, which Google has since fixed with allow-lists and startup validation.30 The NSA said in May that MCP's rapid spread had outpaced its security model.21

Security vendors are responding. RSA's new Agent ID platform finds agents and MCP servers, assigns each a human owner, and routes calls through a gateway that can require human approval for high-risk actions. Two of its modules reach general availability on November 16.2

Frameworks are converging on MCP

Agent frameworks now treat MCP as a basic feature. A survey of ten open-source frameworks found MCP support in LangGraph, CrewAI, Microsoft Agent Framework, OpenAI Agents SDK, Google ADK, Pydantic AI, Strands and Mastra. Most shipped releases in early October.13 Microsoft Agent Framework merged Semantic Kernel and AutoGen and reached 1.0 on April 3.20 Docker's new docker-agent defines multi-agent teams in YAML and connects to any MCP server.15 One outlet reports that DeepSeek Harness, an MIT-licensed plugin runtime released August 13, has about 248,000 GitHub stars, more than LangChain. That figure comes from a single report and deserves caution.14

The overall reading is consistent. MCP has become the shared plumbing that frameworks, platforms and marketplaces all build on. The next year will depend less on the spec and more on whether registries, gateways and directories start verifying what they list.