118,434 MCP servers scanned: 64% have zero stars, only 4.8% use OAuth
Glittering_Device653 · reddit · 2026-11-14
HostedMCP, an open directory of MCP servers and agent skills, published its November 2026 State of MCP report covering 118,434 servers from the official registry, GitHub, npm and PyPI:
- Extreme star concentration: 64% of servers have zero GitHub stars; the star Gini across 86,922 repos is 0.984, with 92 repos holding 60% of all stars.
- Remote has overtaken local: 59.9% remote-only vs 32.4% local-only where transport is known.
- Weak auth: only 4.8% of servers with a known auth method use OAuth; API keys in env vars remain the default.
- 44% declare no license.
- Automated checks on 15,380 servers (read-only, nothing executed): 97 embed model-targeted instructions in tool descriptions or README, 55 have package names one edit from a popular package, 36 ship a dependency with a critical advisory.
- Skills: 669 of 7,500 pre-approve shell access in allowed-tools, letting agents run commands without asking.
Each finding links to exact evidence; full methodology on hostedmcp.org.
More from coding & agent
- Solo dev builds real-time conference translation platform for 70 languages with an agentic harness — evisoft · 2026-11-14
- Open-source Blender add-on runs NVIDIA Kimodo, ARDY and MotionBricks locally for AI motion generation — bdsqlsz · 2026-11-14
- TestPrune: pruning regression tests to unblock AI-driven autonomous bug fixing — burkov · 2026-11-14
- Context beats model choice: Databricks benchmark shows 91% vs 58% for data agents — CautiousUse8597 · 2026-11-14
- Developer skips localhost entirely: prompts go straight to production with AI agent safeguards — marclou · 2026-11-14
- HeyGen MCP demo: one ChatGPT prompt books tickets and sends an avatar birthday video — toolstelegraph · 2026-11-14