MCP at 97 Million Installs: Infrastructure Standardization Is Done, the Governance Clock Is Running

The Standard Is Set

The integration layer for AI agents now has a winner, and it was not a close race. Over 97 million monthly SDK downloads, 10,000 active servers, and first-class client support across ChatGPT, Claude, Cursor, Gemini, Microsoft Copilot, and Visual Studio Code. That is not a product metric. That is infrastructure lock-in.

Anthropic launched MCP in November 2024 with roughly 2 million monthly SDK downloads. OpenAI's adoption in April 2025 pushed it to 22 million. Microsoft integrated it into Copilot Studio in July 2025, reaching 45 million. AWS followed in November 2025 at 68 million. By March 2026, all major providers had adopted it, with 10,000 active public MCP servers and 97 million monthly SDK downloads across Python and TypeScript.

The SDK reached 97 million monthly downloads in 18 months—a 970x increase from its initial 100,000. React took roughly three years to reach 100 million monthly downloads.

Why MCP Won, and Why It Stuck

The protocol solved a concrete problem: before MCP, connecting an AI agent to external tools meant custom integration work per tool, per model, per framework. The combinatorial sprawl frustrated anyone building production systems. MCP introduced a single interface: AI agents as clients connect to MCP servers that expose tools, resources, and prompts. Any MCP-compatible agent can use any MCP server without custom code—USB for AI tools.

Three structural choices sealed adoption. Anthropic open-sourced MCP under MIT with no fees or restrictions. The protocol uses JSON-RPC over standard transports, compatible with any language and runtime. Anthropic seeded the ecosystem with reference implementations for GitHub, Slack, Postgres, and Google Drive before competitors had reason to build alternatives.

The bidirectional network effect—more servers make agents more valuable, more agents make servers more valuable—accelerated adoption. When OpenAI adopted MCP in early 2025 and Google followed in early 2026, the standards war ended.

This Is Infrastructure Standardization, Not a Feature Race

Teams building agent systems now face a binary architectural decision. Standardizing on MCP means writing a tool integration once and exposing it to every major agent framework. Teams that built proprietary integration layers over the past 18 months carry technical debt proportional to their deviation.

In 2025, major AI vendors standardized around MCP as the default integration protocol for enterprise AI, aligning with organizations moving from pilot programs to production deployments. Architectural patterns lock in during this transition. It is happening now.

The ecosystem momentum is self-reinforcing. As of May 2026, GitHub's search returned 15,926 repositories with the mcp-server topic. Tool vendors without MCP support are increasingly explaining an absence.

The Governance Move That Changes Everything

Anthropic's most consequential decision about MCP was not releasing it—it was donating it. Anthropic gave MCP to the Agentic AI Foundation, a directed fund under the Linux Foundation, making it a founding project.

The foundation hosts three projects: MCP, goose (Block's local AI agent framework), and AGENTS.md (OpenAI's coding agent guidance standard). OpenAI and Block joined as co-founders, with AWS, Google, Microsoft, Cloudflare, and Bloomberg as supporting members.

This matters for enterprise adoption in ways downloads cannot capture. Vendor-neutral governance eliminates the single largest objection procurement and architecture review boards raise against open-source infrastructure sponsored by one company. The Linux Foundation imprimatur signals to CTOs that standardizing on MCP does not mean betting on Anthropic's commitment to stewardship.

The Security Liability That Ships With the Standard

Standardization concentrates risk. Between January and February 2026, security researchers filed over 30 CVEs targeting MCP servers, clients, and infrastructure, ranging from path traversals to a CVSS 9.6 remote code execution flaw. Equixly research found command injection vulnerabilities in 43% of tested MCP implementations.

OX Security uncovered a flaw in the protocol's STDIO transport mechanism from inception. Developers across Python, TypeScript, Java, and Rust now face potential arbitrary command execution. Anthropic has characterized the STDIO behavior as expected. The Linux Foundation will need to force resolution on this design and governance question.

For operators running MCP in production: sandbox MCP processes, treat all tool configs as potentially hostile, and monitor tool calls at the gateway level. MCP gateways provide observability, security features, and team provisioning that the protocol does not. These layers are not optional in production.

What to Watch

Near term (next 90 days): Whether the Agentic AI Foundation publishes a concrete security roadmap for STDIO vulnerabilities. Silence signals governance maturity.

Medium term (6 months): Whether major enterprises mandate MCP compliance in vendor RFPs. That is when MCP shifts from infrastructure choice to procurement requirement.

Structural (12 months): Fragmentation at the edges. Vendors will not fork the core protocol but will build proprietary MCP extensions and certified tool marketplaces. The risk is not a competing standard but incompatible MCP supersets.

Governance signal: How the Agentic AI Foundation handles its first major technical dispute—over security, versioning, or extension policy—determines whether this becomes a genuine neutral standard or an Anthropic moat with better branding. That test has not arrived yet.