This week the MCP ecosystem published its own scoreboard, and it is uncomfortable in a useful way. The protocol now sees roughly 97 million SDK downloads a month (up from ~100,000 in late 2024) across 10,000+ active public servers and 15,900+ GitHub repos. Independent analyses of the monetization side agree: fewer than 5% of those servers earn anything. Meanwhile the week's most substantive engineering news was not a new server but auditing and containment — config scanners, zero-trust gateways, and hard data on how badly naive injection filters fail against tool poisoning.
| Metric | Value |
|---|---|
| MCP SDK downloads / month | ~100K (Nov 2024) → ~97M (Mar 2026) — roughly 970× |
| Active public MCP servers | 10,000+ |
| Largest directory listings | mcp.so ~19,800 · Glama ~20,000 · Smithery 7,000–8,000 |
| Servers with any revenue | < 5% |
Read those rows together and the conclusion writes itself: the bottleneck moved from building a server to distributing one. Community measurements put the gap at roughly 10× install volume for a server listed in five or more directories (npm, Glama, PulseMCP, mcp.so, Smithery, the official Registry) versus one published once. If you already have a working server, the highest-return hour this week is a listing pass, not another feature.
The sharpest new tool of the week is mcp-audit-tool (MIT, ~68★): a static scanner for the MCP configuration files of Claude Desktop, Cursor, Windsurf, Cline, Zed and VS Code. It ships 12 rules mapped to the OWASP MCP Top 10 and returns a 0–100 score with an A+→F grade plus JSON/SARIF for CI. We ran it against a deliberately broken three-server config: 0/100, grade F, six findings (2 critical, 3 high, 1 medium). The scanner works — and everything it caught is trivial to fix and almost impossible to spot by eye. Before an agent starts calling tools, check:
npx -y installs — the rug-pull vector.A new public test set of 629 real AgentDojo injections embedded in tool output measured the popular defenses: regex blocking caught 0%, and Meta's Prompt Guard 2 classifier caught about 1%. Any plan that relies on keyword matching over scraped text is dead on arrival. The defenses that map to the threat are structural — least-privilege tool surfaces, read-only defaults, human confirmation on destructive calls, and containment at the boundary. That is the job of the new zero-trust MCP gateways (e.g. MCPBastion, Rust): narrow each server's capability scope, redact secrets in both directions, and cap rate and quota per tool so a hijacked agent cannot exfiltrate in bulk. Scan configs before install, gate them after; design principles are in our MCP server security guide.
Three signals converged. A curated list of applications that run inside your own Cloudflare account instead of a SaaS passed 1,000★, turning self-hosting into a directory-level movement. The technical framing hardened too: local-first treats your device as the primary copy and the server as optional, paying off on privacy, cost, longevity and capability at once. And the buy-once economics keep showing up in public — a developer shipping a $49 one-time desktop app (Electron + SQLite, fully offline) reported 1,200 users in week one with no subscription and no VC, the same shape as our product line. One caveat: the "lifetime deal" label is being polluted by inflated revenue claims, so honest one-time vendors now have to show verifiable proof to be believed.
The July 2026 spec makes the protocol stateless (session state replaced by headers), overhauled OAuth (RFC 9207) and promoted MCP Apps — servers that render their own UI — to first-class status. Statelessness favours lean self-hosted servers; MCP Apps is the strategic one to watch, because a server with its own UI starts to overlap with packaged desktop products. Gaps still open:
Unchanged, and this week reinforced it: does it handle the messy 30% — anti-bot walls and dynamic pages (see our Cloudflare guide)? Does it run locally and bill once rather than meter every call? Does it return structure instead of raw HTML, since raw HTML is a context tax paid on every call (see the MCP scraping guide)? And does it pass a security review before touching your data? Last week's edition: Sep 20 MCP roundup.
The ecosystem's real problem in September 2026 is not supply but trust and distribution: 97 million monthly downloads with fewer than one in twenty servers earning anything describes a market where discoverability and verifiability are the scarce goods. That is why our line stays local, buy-once and auditable — Unified Scraper MCP, CF Bypass Browser MCP, LLM Scraper MCP and the rest of the catalog run on your machine with no account, no cloud dependency and no per-call meter. When the audit tools tell you to pin versions and keep data local, that is the architecture we shipped from day one.
This week in MCP: SDK downloads hit ~97M/month while under 5% of servers monetize, so distribution beats another feature; config scanning arrived and our test config scored a fitting 0/100; a 629-attack set showed regex filters catching 0% of tool-poisoning injections; local-first crossed 1,000★ as a movement; and the July 2026 spec went stateless with server-rendered MCP Apps. We publish a roundup like this every week.