What 33,489 MCP servers declare they can do
On 2026-11-08 we asked every server in the official MCP registry with a public endpoint to list its tools. 23,293 of 39,336 answered. We also ran 17 vendors’ published MCP servers in isolated containers and asked them the same question, and 9,137 registry servers that ship only as a package. These figures are what their manifests declare — not what the products do.
declare no cap, no expiry and no way to switch a tool off.
10,111 servers declare at least one tool that sends, deletes or moves money.
12,965 servers annotate none of their tools as read-only or destructive.
Servers that declare tools which move money. None declares a spending limit.
What the tools declare
| A tool that can… | Servers | Publishers | Tools |
|---|---|---|---|
| Send something outward | 3,196 | 2,907 | 7,044 |
| Delete or destroy something | 7,742 | 4,706 | 32,484 |
| Move money | 1,737 | 1,344 | 3,572 |
| Change something (write) | 19,387 | 12,329 | 127,092 |
| Look something up (read) | 32,453 | 22,600 | 380,545 |
Counted by publisher
The 33,489 servers come from 23,348 publishers — a publisher being the registry namespace a server is published under. 6,740 of them (29%) publish at least one server declaring a tool that sends, deletes or moves money, against 30% of servers. The two shares differ because servers are not spread evenly: 7 publishers have 100 servers or more, and between them account for 6,814 servers, 20% of the index. A publisher's many servers often declare the same tools, so every per-server figure on this page counts those tools once per server.
| Publisher | Servers | Share of the index |
|---|---|---|
| io.github.sadri-dridi | 2,366 | 7% |
| io.github.pipeworx-io | 1,854 | 6% |
| io.github.mcp-dir | 1,115 | 3% |
| io.usefulapi | 884 | 3% |
| io.github.theluckystrike | 344 | 1% |
| io.github.cyanheads | 130 | <1% |
| com.a2awire | 121 | <1% |
Declared exposure
| Band | Servers | Share |
|---|---|---|
| High exposure | 5,257 | 16% |
| Elevated | 6,424 | 19% |
| Moderate | 9,426 | 28% |
| Low exposure | 12,382 | 37% |
Highest declared exposure
| Server | Exposure |
|---|---|
| 100Hires - AI ATS & Recruitment Software | 100 |
| 1Claw Vault | 100 |
| 1gateway | 100 |
| adb-mcp: Android emulator and device control over adb | 100 |
| AdButler | 100 |
| Adobe InDesign | 100 |
| AfterLaunch: the agentic growth marketing engine | 100 |
| Agent Commons | 100 |
| Agent Data Tools | 100 |
| Agent Data Tools: Chain data | 100 |
What this does not show
- Servers that require sign-in. 16,043 of the 39,336 public endpoints did not list their tools for an anonymous request, 11,448 of them because they asked for sign-in, so they are not counted. These figures describe only the servers that answer without it. The unanswered ledger records what each endpoint returned.
- Servers without a public endpoint. Beyond the 17 vendor packages run in isolation, servers distributed as packages are not included. Some vendors’ servers could not be read at all: Stripe, because its npm package relays to Stripe’s hosted server, which decides the tool list per API key; Supabase, because its server fetched its tool list over the network when asked; Apify, because its server fetched its tool list over the network when asked; Neon, because its server contacted Neon before it would start; Atlassian and Linear, because they publish hosted servers only, which require sign-in; Auth0, Azure, Azure DevOps and Heroku, because their published servers did not start in our isolated run.
- Configuration. Vendor packages were run without signing in. Some expose more or fewer tools once signed in or configured; each page says so where the vendor documents it.
- Controls outside MCP. Token revocation, admin consoles, rate limits and audit logs can exist in a product without appearing in its manifest.
- Change over time. Every figure is a snapshot from 2026-11-08. Each server page is dated.