A Measurement Study of Model Context Protocol Ecosystem
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
The Model Context Protocol (MCP) has been proposed as a unifying standard for connecting large language models (LLMs) with external tools and resources, promising the same role for AI integration that HTTP and USB played for the Web and peripherals. Yet, despite rapid adoption and hype, its trajectory remains uncertain. Are MCP marketplaces truly growing, or merely inflated by placeholders and abandoned prototypes? Are servers secure and privacy-preserving, or do they expose users to systemic risks? And do clients converge on standardized protocols, or remain fragmented across competing designs? In this paper, we present the first large-scale empirical study of the MCP ecosystem. We design and implement MCPCrawler, a systematic measurement framework that collects and normalizes data from six major markets. Over a 14-day campaign, MCPCrawler aggregated 17,630 raw entries, of which 8,401 valid projects (8,060 servers and 341 clients) were analyzed. Our results reveal that more than half of listed projects are invalid or low-value, that servers face structural risks including dependency monocultures and uneven maintenance, and that clients exhibit a transitional phase in protocol and connection patterns. Together, these findings provide the first evidence-based view of the MCP ecosystem, its risks, and its future trajectory.
Key facts. Cited by 13 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 16 of its 44 references that are in the map. First posted on arXiv 29 Sep 2025.
Builds on
16 of 44 references.
Closest ancestors · 1
Same direction, newest first
Other references · 15
- 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
- 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,182
- 2021On the Opportunities and Risks of Foundation Modelscited by 4,033
- 2022Emergent Abilities of Large Language Modelscited by 2,512
- 2023AgentBench: Evaluating LLMs as Agentscited by 1,267
- 2024Large Language Model based Multi-Agents: A Survey of Progress and Challengescited by 769
- 2023Large Language Models as Tool Makerscited by 303
- 2023Tool Learning with Foundation Modelscited by 302
- 2024Preference Fine-Tuning of LLMs Should Leverage Suboptimal, On-Policy Datacited by 185
- 2024AIOS: LLM Agent Operating Systemcited by 97
- 2019Small World with High Risks: A Study of Security Threats in the npm Ecosystemcited by 37
- 2025ToolFuzz -- Automated Agent Tool Testingcited by 18
Built on by
Citing papers per year: 2025: 3; 2026: 10.
13 papers.
Sort:
- 2025AgentBound: Securing Execution Boundaries of AI Agentscited by 23
- 2025SoK: Trust-Authorization Mismatch in LLM Agent Interactionscited by 11
- 2026Behavioral Integrity Verification for AI Agent Skillscited by 7
- 2026Harness Engineering: Anatomy, Architecture, and Evolution of Coding Agents -- A Source-Code Study of Eleven Systemscited by 6
- 2026Don't believe everything you read: Understanding and Measuring MCP Behavior under Misleading Tool Descriptionscited by 5
- 2025MCPZoo: A Large-Scale Dataset of Runnable Model Context Protocol Servers for AI Agentcited by 4
- 2026Description-Code Inconsistency in Real-world MCP Servers: Measurement, Detection, and Security Implicationscited by 2
- 2026A Taxonomy of Runtime Faults in Model Context Protocol Serverscited by 1
- 2026VIPER-MCP: Detecting and Exploiting Taint-Style Vulnerabilities in Model Context Protocol Serverscited by 0
- 2026MCP Server Architecture Patterns for LLM-Integrated Applicationscited by 0
- 2026Scalable LLM Agent Tool Access in the Cloudcited by 0
- 2026An Empirical Study of Model Context Protocol Applicationscited by 0
- 2026API Secrets Should Never Become Tokens in the LLM's Vocabulary: A Threat Analysis of API Credential Handling in LLM Agent Systems and an Empirical Evaluation of a Vault-Mediated Execution Boundary27 Sep 2026
- 2026An Empirical Study of Model Context Protocol Applications28 Jul 2026
- 2026Scalable LLM Agent Tool Access in the Cloud17 Jul 2026
- 2026Harness Engineering: Anatomy, Architecture, and Evolution of Coding Agents -- A Source-Code Study of Eleven Systems15 Jul 2026
- 2026MCP Server Architecture Patterns for LLM-Integrated Applications29 Jun 2026
- 2026A Taxonomy of Runtime Faults in Model Context Protocol Servers3 Jun 2026
- 2026Description-Code Inconsistency in Real-world MCP Servers: Measurement, Detection, and Security Implications3 Jun 2026
- 2026VIPER-MCP: Detecting and Exploiting Taint-Style Vulnerabilities in Model Context Protocol Servers20 May 2026
- 2026Behavioral Integrity Verification for AI Agent Skills12 May 2026
- 2026Don't believe everything you read: Understanding and Measuring MCP Behavior under Misleading Tool Descriptions3 Feb 2026
- 2025MCPZoo: A Large-Scale Dataset of Runnable Model Context Protocol Servers for AI Agent17 Dec 2025
- 2025SoK: Trust-Authorization Mismatch in LLM Agent Interactions7 Dec 2025
1 more
- 2025AgentBound: Securing Execution Boundaries of AI Agents24 Oct 2025
- 2025AgentBound: Securing Execution Boundaries of AI Agentscited by 23
- 2025SoK: Trust-Authorization Mismatch in LLM Agent Interactionscited by 11
- 2026Behavioral Integrity Verification for AI Agent Skillscited by 7
- 2026Harness Engineering: Anatomy, Architecture, and Evolution of Coding Agents -- A Source-Code Study of Eleven Systemscited by 6
- 2026Don't believe everything you read: Understanding and Measuring MCP Behavior under Misleading Tool Descriptionscited by 5
- 2025MCPZoo: A Large-Scale Dataset of Runnable Model Context Protocol Servers for AI Agentcited by 4
- 2026Description-Code Inconsistency in Real-world MCP Servers: Measurement, Detection, and Security Implicationscited by 2
- 2026A Taxonomy of Runtime Faults in Model Context Protocol Serverscited by 1
- 2026VIPER-MCP: Detecting and Exploiting Taint-Style Vulnerabilities in Model Context Protocol Serverscited by 0
- 2026MCP Server Architecture Patterns for LLM-Integrated Applicationscited by 0
- 2026Scalable LLM Agent Tool Access in the Cloudcited by 0
- 2026An Empirical Study of Model Context Protocol Applicationscited by 0
12 most cited of 13 All 13 (JSON)
- 2026API Secrets Should Never Become Tokens in the LLM's Vocabulary: A Threat Analysis of API Credential Handling in LLM Agent Systems and an Empirical Evaluation of a Vault-Mediated Execution Boundary27 Sep 2026
- 2026An Empirical Study of Model Context Protocol Applications28 Jul 2026
- 2026Scalable LLM Agent Tool Access in the Cloud17 Jul 2026
- 2026Harness Engineering: Anatomy, Architecture, and Evolution of Coding Agents -- A Source-Code Study of Eleven Systems15 Jul 2026
- 2026MCP Server Architecture Patterns for LLM-Integrated Applications29 Jun 2026
- 2026A Taxonomy of Runtime Faults in Model Context Protocol Servers3 Jun 2026
- 2026Description-Code Inconsistency in Real-world MCP Servers: Measurement, Detection, and Security Implications3 Jun 2026
- 2026VIPER-MCP: Detecting and Exploiting Taint-Style Vulnerabilities in Model Context Protocol Servers20 May 2026
- 2026Behavioral Integrity Verification for AI Agent Skills12 May 2026
- 2026Don't believe everything you read: Understanding and Measuring MCP Behavior under Misleading Tool Descriptions3 Feb 2026
- 2025MCPZoo: A Large-Scale Dataset of Runnable Model Context Protocol Servers for AI Agent17 Dec 2025
- 2025SoK: Trust-Authorization Mismatch in LLM Agent Interactions7 Dec 2025
12 newest of 13 All 13 (JSON)
Similar, not cited
Close in wording, no citation either way
- 2026A Two-Dimensional Study of the Model Context Protocol: Publication and Adoption
- 2025A Large-Scale Evolvable Dataset for Model Context Protocol Ecosystem and Security Analysis
- 2025Model Context Protocol (MCP) at First Glance: Studying the Security and Maintainability of MCP Servers
- 2025Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions
- 2025A First Look at the Security Issues in the Model Context Protocol Ecosystem
- 2025Network and Systems Performance Characterization of MCP-Enabled LLM Agents
- 2026Understanding How Enterprises Adopt the Model Context Protocol for LLM-Driven Software Engineering
- 2025From REST to MCP: An Empirical Study of API Wrapping and Automated Server Generation for LLM Agents