MCP Went From 100K to 97M Downloads in 18 Months — Inside the Protocol That Ate Agent Tooling

Eighteen months ago, MCP was a new protocol from one AI lab with about 100,000 SDK downloads — a reasonable but unremarkable start. By March 2026, that number was roughly 97 million monthly downloads. Call it a 970x increase, and the growth curve isn't the interesting part on its own — plenty of things go viral and fade. What's interesting is why this one didn't fade, and what actually got built on top of it.

The Problem It Actually Solved

Before MCP, connecting an AI application to an external tool or data source meant building a custom integration for that specific pairing. Ten AI apps, ten tools you wanted them all to use, meant somewhere close to a hundred bespoke integrations if you tried to cover every combination — the classic M×N problem.

MCP collapses that into M+N: build one MCP server for your tool, and every MCP-compatible AI application can use it. Build MCP support into your AI application once, and it can reach every MCP server that exists, including ones that didn't exist when you shipped.

That's not a new idea in software generally — it's the same logic behind every successful protocol, from HTTP to USB. What's notable is how fast an AI-specific version of it caught on.

The Moment That Actually Mattered: Neutral Governance

Raw download numbers are a lagging indicator. The leading one was structural: in December 2025, Anthropic donated MCP to the Linux Foundation, with OpenAI, Google, and Microsoft joining as co-sponsors.

That single event is arguably more important than any usage statistic, because it solved the actual adoption blocker. No competitor wants to build critical infrastructure on a rival's proprietary protocol — that's a dependency risk, not a convenience. The moment MCP had neutral governance with the industry's biggest players co-sponsoring it, the calculus flipped: it stopped being "should we help Anthropic's ecosystem" and became "this is shared infrastructure, same as any other open standard we build on."

The adoption data backs up that read. OpenAI, Google, Microsoft, and Salesforce all shipped MCP support within 13 months of launch — a genuinely fast cross-vendor convergence for anything in software, let alone in an AI landscape where these same companies compete directly on almost everything else.

The Numbers, With an Honest Caveat

Different sources count MCP servers differently, and the counts don't agree — worth stating plainly rather than picking whichever number sounds most impressive:

• Anthropic reported over 10,000 active public MCP servers at the time of the Linux Foundation donation (December 2025).
• An independent census from Nerq in Q1 2026 indexed 17,468 MCP servers across registries — a broader count that likely includes abandoned or low-quality entries alongside actively maintained ones.
• Monthly SDK downloads reached 97 million by March 2026.

Take the exact figures as directional, not precise — server counts depend heavily on what counts as "active," and registries aren't deduplicated against each other. The trend across every measurement, though, points the same direction: fast, sustained, cross-vendor growth, not a single-source spike.

On the enterprise side: 80% of Fortune 500 companies were deploying active AI agents in production workflows as of early 2026, and 28% had specifically implemented MCP servers — meaning MCP adoption inside large enterprises is real but still meaningfully behind general agent adoption. The protocol is ahead of most individual companies' internal rollout.

Two Waves, and What They Tell You

The server ecosystem breaks down into a clear pattern: developer tools accounts for the largest single category (1,200+ servers) — AI coding assistants, IDE integrations, agentic development tooling. That's the first wave, unsurprising given MCP's origins in developer-facing products.

Business application servers (950+) are the second wave — customer service, sales automation, internal operations tooling. This is the more consequential number, because it signals MCP moving past "thing developers use to wire up their coding agent" into "thing non-technical teams' workflows depend on." That's a harder adoption curve to climb, and it's climbing.

The Honest Technical Caveats

Server quality varies enormously, and a registry listing isn't a quality signal. With thousands of community-built servers, the gap between "actively maintained, well-scoped, production-ready" and "someone's weekend project that hasn't been touched in months" is wide, and there's no strong quality-filtering layer yet at the ecosystem level.

MCP servers are a new attack surface, not just a convenience layer. A server that gives an agent broad tool access — file systems, databases, external APIs — is exactly the kind of high-privilege "doer" that becomes dangerous if the same agent also processes untrusted content. This isn't hypothetical; it's the specific failure mode covered in our prompt injection defense architecture piece — MCP made tool access standardized and easy, which is also what makes over-scoped tool access an easy mistake to make at scale.

Auth and permissioning maturity is still catching up to adoption speed. Early MCP implementations, understandably, prioritized "does the connection work" over "is access scoped correctly." That gap is closing, but it closed slower than the download curve grew — a common pattern for fast-adopted infrastructure, and one worth being deliberate about rather than assuming solved by default.

What This Means If You're Building Anything Agent-Adjacent

If you're building a tool, a data source, or an integration that an AI agent might need to reach, MCP is no longer the experimental option — it's the default integration layer, the way REST became the default for web APIs. Skipping it means every AI application that wants to reach your tool needs a bespoke integration, which is exactly the problem MCP exists to eliminate.

For teams already producing structured data — extraction pipelines, scraped datasets, monitoring feeds — the natural next question is whether that output should be exposed as an MCP server rather than just a CSV export or a webhook. It's a genuinely open design question right now, not a solved pattern, but the direction of the ecosystem makes it worth asking rather than dismissing.

The protocol war that a lot of people expected — multiple incompatible standards, vendor lock-in, years of fragmentation — mostly didn't happen. That's rarer than the download chart makes it look.