Public MCP repositories show a rapid shift toward agent tools that take direct action: software-development agents dominate the ecosystem, and usage of action-enabled tools climbed from 27% to 65% in 16 months, including agents capable of financial transactions. The dataset suggests regulators should monitor the tool layer as well as model outputs to detect deployment risks beyond model-level behaviour.
How are AI agents used? Evidence from 177,000 MCP tools
Monitoring 177,436 publicly hosted MCP agent tools from Nov 2024 to Feb 2026, the authors find software development dominates (67% of tools, 90% of downloads) and the share of 'action' tools in usage rose from 27% to 65%, including some that enable higher-stakes activities like financial transactions.
Today's AI agents are built on large language models (LLMs) equipped with tools to access and modify external environments, such as corporate file systems, API-accessible platforms and websites. AI agents offer the promise of automating computer-based tasks across the economy. However, developers, researchers and governments lack an understanding of how AI agents are currently being used, and for what kinds of (consequential) tasks. To address this gap, we evaluated 177,436 agent tools created from 11/2024 to 02/2026 by monitoring public Model Context Protocol (MCP) server repositories, the current predominant standard for agent tools. We categorise tools according to their direct impact: perception tools to access and read data, reasoning tools to analyse data or concepts, and action tools to directly modify external environments, like file editing, sending emails or steering drones in the physical world. We use O*NET mapping to identify each tool's task domain and consequentiality. Software development accounts for 67% of all agent tools, and 90% of MCP server downloads. Notably, the share of 'action' tools rose from 27% to 65% of total usage over the 16-month period sampled. While most action tools support medium-stakes tasks like editing files, there are action tools for higher-stakes tasks like financial transactions. Using agentic financial transactions as an example, we demonstrate how governments and regulators can use this monitoring method to extend oversight beyond model outputs to the tool layer to monitor risks of agent deployment.
Summary
Main Finding
Monitoring 177,436 public MCP (Model Context Protocol) agent tools published between Nov 2024 and Feb 2026 shows that current AI agents are overwhelmingly concentrated on software-development tasks but are rapidly gaining direct action capabilities. Action-capable and general-purpose tools (those that let agents modify external environments or control browsers/computers) have grown substantially — rising from 27% to 65% of observed tool usage over the sample period — creating a much larger agent action space with important economic and systemic implications.
Key Points
- Dataset and scope
- Curated 177,436 public MCP tools (11/2024–02/2026); download/usage proxies from NPM and PyPI for 3,854 MCP servers covering 42,498 tools.
- MCP is the dominant open protocol for agent tools; most popular agent integrations (OpenAI, Anthropic, Google) expose MCP-style tools.
- Domain concentration
- 67% of published tools (and ~90% of observed downloads) are software-development / IT related.
- Other notable domains: finance and administrative tasks; financial-action tools are growing fastest among higher-stakes categories.
- Direct impact and generality
- Tools classified by direct impact: perception (read/access), reasoning (analyze), action (modify).
- Tools classified by generality: narrow/constrained (single API) vs general/unconstrained (browser, arbitrary code execution).
- Rise in action tools and in general-purpose tools (browser/code execution) drives the expanding action space.
- Time trends & geography
- Action-tool usage rose from 27% (Nov 2024) to 65% (Feb 2026) of total usage.
- Usage concentrated geographically: ~50% US, ~20% Western Europe, ~5% China (based on PyPI/NPM download IPs — Western bias).
- AI-assisted tool creation
- AI co-authorship detected on 28% of MCP servers (36% of tools).
- New MCP servers created with AI assistance rose from 6% (Jan 2025) to 62% (Feb 2026); Claude Code accounted for 69% of AI-coauthored servers in that period.
- Stakes and risks
- Most action tools map to medium-stakes occupations, but there is a notable and growing presence of high-stakes action tools (e.g., agentic financial transactions).
- Action tools expand attack surface (prompt injection, misuse), raise risks of mistakes and systemic cascades (correlated failures across many agents), and can accelerate tool proliferation when AI agents help build tools.
Data & Methods
- Data sources
- Public MCP server repositories scraped from GitHub and Smithery; package download metadata from PyPI and NPM used as usage proxies.
- Final curated dataset: 177,436 MCP tools; download-covered subset: 42,498 tools on 3,854 servers.
- Classification approach
- Automated classification of tools along five attributes that define an agent’s action space:
- Direct impact: perception / reasoning / action.
- Generality: narrow/constrained vs general/unconstrained.
- Task domain: mapped to O*NET occupational taxonomy to measure consequentiality.
- Usage geography: inferred from download IPs (PyPI/NPM).
- AI co-authorship: heuristics to detect AI-assisted creation (e.g., presence of code generation traces or metadata).
- Validation and limitations
- MCP download counts are an imperfect proxy for real tool invocation; downloads ≠ calls.
- PyPI/NPM-based geographies are biased toward Western regions; private or closed MCP deployments are not observed.
- Automated labeling (impact, generality, O*NET mapping, AI-assist detection) may have classification error; dataset available on request for replication and further study.
Implications for AI Economics
- Labor and task reallocation
- Heavy concentration (67% of tools, 90% of downloads) in software development suggests near-term, large productivity effects and task displacement in coding and related IT work.
- The rise of action and general-purpose tools implies agents can substitute for more complex, multi-step computer tasks, not just isolated information or text generation tasks; task content of jobs will shift toward oversight, coordination, and non-computerized tasks.
- Productivity vs. distributional effects
- Firms and workers that adopt action-capable agents may see outsized productivity gains (especially in software engineering, admin automation, and transaction processing), potentially increasing returns to capital and to firms that orchestrate agent fleets.
- Geographic concentration of usage (US/Western Europe) suggests uneven diffusion and uneven labor-market impacts across countries.
- Market structure and concentration risks
- Dependence on a few large LLM providers plus extensive reuse of the same agent tools raises systemic risk: model or tool failures can have correlated economic effects across many firms and sectors.
- Rapid AI-assisted tool creation (AI-authored tools rising fast) can accelerate diffusion and lower barriers to entry for agent-enabled automation, compounding concentration if tool ecosystems cluster around dominant platforms.
- Financial stability and sectoral risks
- Increasing presence of agentic financial-transaction tools raises direct regulatory concerns: faster, autonomous trading/execution could amplify volatility, enable fast systemic runs, or be exploited for fraud.
- Regulators should monitor not only models but the tool layer (APIs, MCP servers, download patterns) to detect emergent high-stakes agent deployment.
- Measurement and policy recommendations
- For macro and microeconomic monitoring, download and repository monitoring of MCP tools provide an early-warning signal for shifts in agent capabilities and deployment.
- Policy responses to consider:
- Require logging/auditing of action-capable tools (especially general-purpose action tools) used in critical sectors.
- Mandate human-in-the-loop / stepwise approvals for high-stakes agent actions (financial transfers, critical infrastructure changes).
- Monitor dependency concentration on a few LLMs and critical tool providers; encourage diversification and resilience.
- Track AI-authored tool proliferation to assess speed of autonomous tool-supply growth and potential need for governance.
- Research priorities
- Quantify causal impacts of agent-tool adoption on employment, wages, and firm productivity across sectors.
- Improve measurement: instrument real tool invocation (not only downloads), include private/enterprise MCP deployments, and de-bias geographic inferences.
- Model systemic risks from correlated agent behavior (financial markets, critical infrastructure) and design macroprudential safeguards.
Limitations to keep in mind: downloads are an imperfect usage measure; public MCP repositories undercount closed/private deployments; classification and O*NET mapping have error; results reflect the Nov 2024–Feb 2026 window and rapid change may continue.
Assessment
Paper Typedescriptive
Evidence Strengthmedium — The paper compiles a large, novel dataset (177,436 agent tools) and documents clear temporal patterns (e.g., rise in 'action' tools), providing strong descriptive evidence about the composition and downloads of public MCP-hosted agent tools; however, it does not identify causal effects on economic outcomes and its usage metric (server downloads) is an imperfect proxy for real-world deployment or economic impact.
Methods Rigormedium — The study systematically monitors public MCP server repositories over a 16-month period and applies O*NET mapping to categorize task domains, which is a rigorous approach for descriptive inventorying; nevertheless, there are important limitations: reliance on public MCP servers (excluding private/internal deployments and non-MCP tool ecosystems), potential misclassification in mapping tool intents to O*NET tasks, download counts that may not reflect actual execution or economic use, and limited validation against ground-truth deployments or outcomes.
Sample177,436 agent tools collected from public Model Context Protocol (MCP) server repositories between November 2024 and February 2026; tools were categorized into perception, reasoning, and action types and mapped to task domains and consequentiality using O*NET; usage measured by MCP server downloads (reporting that software development tools account for 67% of tools and 90% of downloads); includes qualitative exemplars (e.g., agentic financial transaction tools) and a temporal analysis of tool-type usage shares.
Themesadoption governance
GeneralizabilityOnly covers tools published on public MCP servers — excludes private, proprietary, enterprise, or alternative-agent ecosystems, MCP server download counts are an imperfect proxy for actual deployment, frequency of use, or economic impact, O*NET mapping is US-centric and may misrepresent task consequentiality in other institutional contexts, Time-bounded (Nov 2024–Feb 2026); trends may change with new standards, platforms, or regulation, Possible classification errors and heterogeneity within broad categories (e.g., 'action' tools vary widely in risk), Bias toward software-development tools may reflect developer publishing behavior rather than underlying economic prevalence
Claims (10)
| Claim | Direction | Confidence | Outcome | Details |
|---|---|---|---|---|
| We evaluated 177,436 agent tools created from 11/2024 to 02/2026 by monitoring public Model Context Protocol (MCP) server repositories. Adoption Rate | positive | high | number of agent tools observed |
n=177436
177,436 agent tools
0.3
|
| We categorise tools according to their direct impact: perception tools to access and read data, reasoning tools to analyse data or concepts, and action tools to directly modify external environments. Other | null_result | high | tool category / taxonomy |
n=177436
0.18
|
| We use O*NET mapping to identify each tool's task domain and consequentiality. Other | null_result | high | method for assigning task domain and consequentiality |
n=177436
0.18
|
| Software development accounts for 67% of all agent tools. Adoption Rate | positive | high | share of agent tools in the software development task domain |
n=177436
67%
0.3
|
| Software development accounts for 90% of MCP server downloads. Adoption Rate | positive | high | share of MCP server downloads attributed to software development tools |
90% of MCP server downloads
0.18
|
| The share of 'action' tools rose from 27% to 65% of total usage over the 16-month period sampled. Adoption Rate | positive | high | share of 'action' tools as fraction of total usage/downloads |
rose from 27% to 65%
0.18
|
| Most action tools support medium-stakes tasks like editing files. Task Allocation | null_result | medium | consequentiality / stakes of action tools (proportion medium-stakes) |
0.11
|
| There are action tools for higher-stakes tasks like financial transactions. Consumer Welfare | null_result | high | presence of action tools enabling high-stakes tasks (e.g., financial transactions) |
0.3
|
| Using agentic financial transactions as an example, we demonstrate how governments and regulators can use this monitoring method to extend oversight beyond model outputs to the tool layer to monitor risks of agent deployment. Governance And Regulation | positive | high | feasibility of a monitoring approach for regulatory oversight at the tool layer |
0.18
|
| Public Model Context Protocol (MCP) server repositories are the current predominant standard for agent tools. Adoption Rate | positive | medium | predominance of MCP servers as a standard for agent tools |
0.05
|