MCP Has 19K Servers And 43% Are Broken. Ship Anyway?
MCP hit 19,831 servers and 97M SDK downloads a month. 43% have command-injection bugs. Here's when to use it and when to stay REST.
Anthropic's Model Context Protocol went from a curiosity in November 2024 to the de facto AI tool-use standard 18 months later. There are 9,652 servers in the official registry as of May 2026 and 19,831+ on the Glama community index — up from about 50 at launch[1][2][3]. SDK downloads sit near 97 million per month[2]. Every serious model provider — Anthropic, OpenAI, Google, Microsoft — ships MCP support natively[4].
And 43% of them are exploitable.
An offensive-security study by Equixly, run through early 2026, found command-injection vulnerabilities in 43% of the MCP servers they tested. Endor Labs scanned 2,614 MCP implementations and flagged 82% as vulnerable to path traversal[5]. Public CVE databases logged dozens of MCP disclosures in the first months of 2026, including a CVSS 9.6 remote code execution flaw in a package that had been downloaded almost half a million times[6].
That's the real story of MCP in 2026. It's the biggest platform shift in AI integrations since the OpenAI function-calling spec — and most of the servers wiring your agent to your data are a weekend project someone published without an authentication story.
What MCP actually solves
I've been asked twice this week — by two different operators — some version of the same question: "Do I need to rip out my REST integrations and rebuild on MCP?"
No. That's not what MCP is for.
Traditional REST APIs are still the right primitive for system-to-system integration, cron jobs, and any high-throughput workflow where a machine already knows what call to make. MCP wraps existing APIs as an AI-friendly discovery layer[7]. You keep your REST endpoints. You add an MCP server in front of them when — and only when — an LLM agent needs to figure out at runtime which tool to call.
The distinction matters because the cost profile is very different. WorkOS puts it plainly: MCP gives you "runtime discovery, stateful sessions, standardized auth, and a protocol designed from the ground up for how AI agents actually work"[8]. Great for a Claude Desktop user picking tools by intent. Terrible for a batch job.
How terrible? Toolradar benchmarked a pricing check across 500 tools:
- REST API: ~50 seconds
- Same job via MCP: ~25 minutes[9]
That's a 30x overhead. If a human is waiting on one answer, MCP's latency vanishes into the LLM's own thinking time. If a scheduled process is chewing through hundreds of calls, MCP will turn a 1-minute job into an afternoon.
The other cost nobody prices in
Every connected MCP server loads its tool definitions into every single message the model processes. MindStudio measured Claude Code with a few servers attached and clocked up to 18,000 tokens per turn just in tool metadata[10]. You're paying for that overhead on input tokens on every turn — before the agent has done anything useful.
Multiply that by ten agent runs a day across a team. It adds up faster than the "AI made this easy" narrative admits.
Read the pattern carefully: MCP wins on discovery — the LLM auto-detecting capabilities and picking tools by intent with a single call. REST wins on execution — lower protocol overhead, faster round-trips. SDKs win on developer experience. Those are three different fights, and MCP is only unambiguously best at one of them.
What I'd actually do if I were shipping an agent this week
If you're a $5M-$20M operator adding AI to your stack, here's the pattern that survives:
1. Use MCP only where discovery matters
A support agent that has to pick between 40 internal tools based on a customer message? MCP. A nightly job that pulls yesterday's Shopify orders into a report? REST. Do not put a scheduled pipeline behind an LLM tool-picker unless you enjoy watching your token bill grow.
2. Assume every third-party MCP server is compromised until proven otherwise
The 43% command-injection stat is not a fringe number. Aembit's 2026 security guide groups the risks into five layers — transport, auth, context integrity, authorization, and supply chain — and each layer has documented breaches in the wild[11]. If you pull a random MCP server from a registry and hand it your production credentials, you're gambling with the same posture you'd use for an npm package you've never audited. Which, historically, has not gone well.
3. Prefer vendor-maintained servers over community ones
GitHub, Cloudflare, Sentry, Notion, Stripe, and most major SaaS platforms now ship official MCP servers. Those have security teams behind them. The 8,000-plus community entries in the registry range from "excellent" to "someone's homework"[3]. Pick from the first bucket.
4. Wrap sensitive tools with your own MCP server, not someone else's
If the tool touches customer data, money, or write operations to a production system, don't proxy it through a community server. Build a thin MCP server over your existing internal REST API. You keep your auth. You keep your audit log. You keep control of exactly what the model can and cannot do.
5. Cap the tool surface
The 18K-token-per-turn number is what happens when you connect everything. Every agent I've built in the last three months has fewer than eight tools loaded at any one time. If it needs a ninth, I split it into a second agent.
Why the hype is peaking now
Zylos Research called MCP "the de facto standard for agent-to-tool connectivity" earlier this year, now governed by the Linux Foundation's Agentic AI Foundation[12]. When something goes from Anthropic protocol to Linux Foundation project in 18 months, that's not a bubble — that's infrastructure hardening.
But infrastructure hardening on the governance side happens years before the security side catches up. That's the gap operators are staring into right now. The protocol works. The registry is exploding. The security ecosystem is a year and a half behind.
If you're building AI into your business this quarter, MCP is worth adopting. Just don't adopt it the way most of LinkedIn tells you to — plug everything in, brag about the stack.
Adopt it like you'd adopt any infrastructure that touches production: minimum surface, vendor-first, own the sensitive layer, measure the cost per turn.
The teams that get this right in 2026 will look, from the outside, like they moved slower. They'll ship fewer flashy demos. They'll also still have jobs and customers in 2027.
Book a 30-minute audit
If you're staring at your stack trying to figure out where MCP fits and where it doesn't, that's what the audit call is for. 30 minutes, I look at what you're building, and I tell you which integrations should stay REST and which are worth wrapping. No pitch.
-
MCP Adoption Statistics 2026: Model Context Protocol↩
9,652 latest server records and 28,959 server/version records in the official MCP Registry (May 2026)
-
Model Context Protocol News and Updates (2026)↩
19,831+ MCP servers on Glama registry and ~97M monthly SDK downloads in 2026
-
MCP Server Ecosystem Statistics 2026↩
Approximately 8,000-12,000 distinct MCP servers across directories, up from ~50 at launch in November 2024
-
API vs MCP in 2026: REST/gRPC vs Model Context Protocol↩
MCP became the de facto AI tool-use standard in 2025-2026 with Anthropic, OpenAI, and Google all adopting it
-
MCP Security Statistics 2026: CVEs, Vulnerabilities and Breach Data↩
43% of tested MCP servers vulnerable to command injection (Equixly); 82% of 2,614 MCP implementations vulnerable to path traversal (Endor Labs)
-
The State of MCP Security 2026: Incidents, Attack Patterns, and Defense Coverage↩
Dozens of MCP CVE disclosures in early 2026 including a CVSS 9.6 RCE in a package downloaded nearly half a million times
-
MCP vs API: When to Use Each for AI Agent Integration in 2026↩
MCP wraps existing APIs as an AI-friendly layer, so teams adopt MCP without discarding current REST endpoints
-
MCP vs REST: What is the right way to connect AI agents to your API?↩
MCP provides runtime discovery, stateful sessions, standardized auth, designed for how AI agents work
-
MCP vs API: What's the Difference? When to Use Each (2026)↩
Batch job checking pricing for 500 tools takes ~50 seconds via API vs ~25 minutes via MCP
-
Claude Code MCP Servers and Token Overhead: What You Need to Know↩
Each connected MCP server loads tool definitions into every message, costing up to 18,000 tokens per turn
-
MCP Security Vulnerabilities: Complete Guide for 2026↩
MCP risks span five layers: transport, authentication, context integrity, authorization, and supply chain security
-
Agent Interoperability Protocols 2026: MCP, A2A, ACP and the Path to Convergence↩
MCP is the de facto standard for agent-to-tool connectivity, now governed by the Linux Foundation Agentic AI Foundation
Ready to build your own AI system?
Book a Free Audit Call →Keep Reading
Anthropic Says Build Manager Agents. Cognition Says Don't. Pick One.
Anthropic says build orchestrator-worker AI agents. Cognition says don't. One team is right for your $5M business. Pick wrong and your bill 15x's.
One Agent Task = 41x The Tokens Of A Chatbot
AI agents burn 5–50x more tokens than a chat call, and cheaper models won't fix it. It's your architecture. Four moves that actually cut the bill this quarter.
AI Voice Agents Book Meetings 3x Better Than SDRs. Klarna's Trap Isn't Yours.
AI voice agents book meetings 3x better than human SDRs. Klarna proved the tech works — and where it breaks. Here's the four-part stack to build one that lasts.