# An Empirical Study of Model Context Protocol Applications

arXiv: https://arxiv.org/abs/2607.25635 · HTML: https://mlsanity.com/paper/2607.25635/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 10 of its 28 references that are in the map.
- First posted on arXiv 28 Jul 2026.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 10 of 10)

- [Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks](https://mlsanity.com/paper/2005.11401/) (2020)
- [Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions](https://mlsanity.com/paper/2503.23278/) (2025)
- [Model Context Protocol (MCP) at First Glance: Studying the Security and Maintainability of MCP Servers](https://mlsanity.com/paper/2506.13538/) (2025)
- [Do Developers Update Their Library Dependencies? An Empirical Study on the Impact of Security Advisories on Library Migration](https://mlsanity.com/paper/1709.04621/) (2017)
- [A Measurement Study of Model Context Protocol Ecosystem](https://mlsanity.com/paper/2509.25292/) (2025)
- [Selecting third-party libraries: The practitioners' perspective](https://mlsanity.com/paper/2005.12574/) (2020)
- [A Large-Scale Evolvable Dataset for Model Context Protocol Ecosystem and Security Analysis](https://mlsanity.com/paper/2506.23474/) (2025)
- [How are AI agents used? Evidence from 177,000 MCP tools](https://mlsanity.com/paper/2603.23802/) (2026)
- [A Large-Scale Dataset of MCP Implementations on GitHub](https://mlsanity.com/paper/2607.10123/) (2026)
- [GenAI Is No Silver Bullet for Qualitative Research in Software Engineering](https://mlsanity.com/paper/2603.08951/) (2026)

## Abstract (arXiv)

The Model Context Protocol (MCP) standardizes how large language model applications communicate with external tools, but leaves the application side unspecified: unlike traditional dependencies resolved through package managers, developers integrating MCP servers face no conventions for configuration, communication, or human oversight. This ecosystem is also under-researched, with existing work focused on servers rather than the applications consuming them. We conduct a large-scale study of 1,723 MCPApps mined from GitHub. We first derive MCPAppTax from a representative sample, then use an LLM-assisted pipeline to apply it across the full dataset, characterizing server integration across configuration, SDK use, and human-in-the-loop mechanisms. Our results show that the ecosystem has converged on some practices but not others: most MCPApps configure servers using files (85.2%) and use an official SDK (81.1%) to communicate with servers, yet no naming convention has emerged for configuration files. Human oversight diverges most, logging (90.8%) and enable/disable controls (77.2%) are common, but only 37.2% gate tool execution behind a blocking approval step, leaving the LLM able to invoke any enabled tool unconditionally in most MCPApps.