PaperlayerView exact revision on arXiv

Source-linked AI summary

How are AI agents used? Evidence from 177,000 MCP tools

Merlin Stein

arXiv:2603.23802v1cs.CY

TL;DR

Developers, researchers, and governments lack large-scale evidence about how AI agents are used and which consequential tasks their tools enable. This paper monitors 177,436 public MCP tools, classifies their capabilities and task stakes, and tracks usage over 16 months. It finds that action-tool usage increased substantially while software development remained dominant, and argues that tool monitoring can extend oversight beyond model outputs.

  • Problem

    Large-scale evidence is limited about how AI agents are used, which tasks their tools enable, and which tools are widely used.

  • Method

    The paper analyzes 177,436 agent tools from public MCP repositories, classifies their direct impact and task consequentiality, and tracks downloads over time.

  • Results

    Action-tool downloads rose from 27% to 65%, while software development accounted for 67% of tools and 90% of downloads.

  • Takeaways & Limitations

    Monitoring public agent tools can help anticipate and monitor large-scale or high-stakes deployment risks beyond model outputs.

  • Takeaways & Limitations

    MCP repositories are only one distribution channel, so the results represent a lower bound on the actions available to AI agents.

Abstract

from arXiv · show

Today's AI agents are built on large language models (LLMs) equipped with tools to access and modify external environments, such as corporate file systems, API-accessible platforms and websites. AI agents offer the promise of automating computer-based tasks across the economy. However, developers, researchers and governments lack an understanding of how AI agents are currently being used, and for what kinds of (consequential) tasks. To address this gap, we evaluated 177,436 agent tools created from 11/2024 to 02/2026 by monitoring public Model Context Protocol (MCP) server repositories, the current predominant standard for agent tools. We categorise tools according to their direct impact: perception tools to access and read data, reasoning tools to analyse data or concepts, and action tools to directly modify external environments, like file editing, sending emails or steering drones in the physical world. We use O*NET mapping to identify each tool's task domain and consequentiality. Software development accounts for 67% of all agent tools, and 90% of MCP server downloads. Notably, the share of 'action' tools rose from 27% to 65% of total usage over the 16-month period sampled. While most action tools support medium-stakes tasks like editing files, there are action tools for higher-stakes tasks like financial transactions. Using agentic financial transactions as an example, we demonstrate how governments and regulators can use this monitoring method to extend oversight beyond model outputs to the tool layer to monitor risks of agent deployment.

1 Introduction

The paper addresses limited large-scale evidence about which agent tools are developed, what tasks they enable, and how widely they are used. It monitors MCP servers and classifies tools to measure agent-tool capabilities, task domains, stakes, and usage trends.

  • Dataset: 177,436 public MCP tools form the paper’s agent-tool dataset, sourced from GitHub and Smithery.The dataset is presented as the largest existing dataset of AI agent tools.
  • Findings: 67% of published tools are software-related, accounting for 90% of usage.Financial and administrative tools are also popular.
  • Findings: Agent actions are concentrated in the United States, with approximately 50% of usage, followed by Western Europe at about 20% and China at about 5%.The geographic estimate uses tool-download IP addresses, but downloaded tools may not actually be called.
  • Findings: Action-tool usage rose from 27% in 11/2024 to 65% in 02/2026.The increase was driven by general-purpose tools that let agents use computers or browsers in unconstrained environments.
  • Risks and monitoring: Action tools mainly support medium-stakes occupations, while financial transactions are a rapidly growing area of potentially high-stakes agent action.The paper uses agentic transaction tools as an example for monitoring deployment risks.
  • Findings: AI assistance appears in 28% of MCP servers and 36% of tools, while AI-assisted server creation rose from 6% in 01/2025 to 62% in 02/2026.Claude Code accounted for 69% of AI-coauthored servers.

2 Background

The background frames agent risk around the action space supplied by tools: tools determine whether agents can merely access information or directly modify external environments. Monitoring tool availability and use can therefore inform assessment of deployment-related risks.

  • Action space: An agent’s action space is the set of actions it can take in the world, and tools define that space.The paper focuses on action space rather than autonomy or goal complexity.
  • Tool generality: General-purpose tools expose agents to unconstrained environments, while narrow-purpose tools constrain actions to specific capabilities or APIs.Examples include browser interaction, code execution, and specialized tools.
  • Mistakes and misalignment: Irreversible action tools can turn erroneous or misaligned behavior into direct harm, including database deletion, exposed records, or financial loss.Agents limited to reasoning tools can deceive users but cannot act directly themselves.
  • Structural risks: Shared models and high-stakes tools could produce correlated failures across financial systems or critical infrastructure when deployed at scale.The paper connects tool monitoring with oversight of consequential entities and agent deployments.
  • Risk implications: Tools that enable a large action space, such as general-purpose action tools, amplify risks across risk types.They increase the range of environments in which agents can act.
  • Monitoring: MCP tools published on developer platforms may provide early indicators of broader agent-tool trends and risks.Large-scale downloads might foreshadow larger-scale usage, while monitoring cannot directly observe all agent actions.

3 Data

The study builds a historical dataset of public MCP servers and tools from GitHub, Smithery, and curated server lists, then uses package downloads as a proxy for ecosystem interest. The resulting dataset contains 19,388 verified servers and 177,436 distinct tools, while coverage and download measures impose important scope limits.

  • Dataset construction: Three sources provide coverage: GitHub repositories, the Smithery MCP registry, and prominent GitHub server lists including official and community lists.Smithery contributed 2,437 servers, while the GitHub search contributed 16,956 servers in the final dataset.
  • Dataset construction: 177,436 distinct agent tools were identified on 19,388 verified MCP servers after filtering an initial pool of 73,338 potential servers.The dataset combines repositories and registries, retaining servers with clearly defined tools in README files or descriptions.
  • Dataset composition: Official servers contribute 8,469 tools and 45M of 78M total PyPI and NPM downloads, making them relatively more popular than their tool count suggests.The official subset includes servers from legally registered commercial entities such as PayPal, Stripe, Google, and GitHub.
  • Usage measurement: Package downloads proxy ecosystem interest rather than runtime execution because they count installation events, not individual tool calls.The analysis therefore emphasizes relative usage trends and distribution shifts rather than absolute execution counts.
  • Usage measurement: Download-based usage may overrepresent developer experimentation because remotely hosted servers, cached installations, private mirrors, and routine local workflows are not fully captured.The authors note that observed distributions may indicate which tools developers pilot rather than which tools operate in routine production workflows.

4 Methodology

The paper combines top-down O*NET classification with bottom-up topic modeling and human validation to characterize MCP tools by task domain, direct impact, generality, and consequentiality. It also tracks usage, geography, and AI co-authorship, while acknowledging reliability and coverage constraints.

  • Topic modeling: 25% of topics were not assigned to clusters, while topic coherence was high in both the main and held-out test sets.The bottom-up validation reports a 26% outlier rate in the test set and evaluates coherence across both datasets.
  • Task-domain classification: The top-down pipeline assigns tools to O*NET task domains through high-, mid-, and bottom-level clusters, while the bottom-up BERTopic analysis checks whether natural clusters support the classification.The hierarchical process narrows from 12 high-level clusters to 400 mid-level clusters and then to O*NET tasks.
  • Task-domain classification: 78% agreement with human validators supports the highest-level task classification, but lower-level assignments are less reliable because O*NET tasks are highly specific and tools often have broad remits.The study consequently focuses on the highest hierarchical level, called task domain.
  • Consequentiality: The study maps O*NET occupational impact scores to tool availability as a proxy for whether agents are used in high-stakes settings.The underlying survey asks how decisions affect other people or an employer’s image, reputation, or financial resources.
  • Direct impact: Tools are classified by direct impact as perception, reasoning, or action, with human validators agreeing 81% on direct impact and 85% on functionality conditional on matching impact.Weighted least-squares regressions are used for time trends, with specifications selected to balance simplicity and explanatory power.
  • Generality: Generality distinguishes narrow-purpose tools from general-purpose tools such as web browsing, and is assigned at server level because servers typically bundle tools for one environment.Human experts agreed 72% on the server-level generality labels.
  • AI co-authorship: AI-created servers are identified from labeled repository evidence such as AI commit trailers, configuration files, bot accounts, or explicit AI mentions, but this approach underestimates unmarked AI assistance.A first-month restricted variant limits evidence to the first 30 days after repository creation to reduce false positives in time-trend analyses.

5 Results

Agent tools are concentrated in software and IT, while action-tool usage has shifted sharply toward modifying external environments. Most actions remain medium-stakes, but financial and other high-stakes capabilities are emerging, with deployment concentrated geographically and increasingly using general-purpose tools.

  • 67% of agent tools support software development and IT tasks, which account for 90% of downloaded MCP servers.
  • 18% of tools support finance and business management tasks, representing 5% of MCP server downloads.
  • Most action tools support medium-stakes occupations, but high-stakes financial occupations have disproportionately more action tools.
  • The United States accounted for half of global downloads in 2025, compared with approximately 20% for Western Europe and 5% each for China and Singapore.
  • Action-tool usage rose from 27% to 65% of downloads between November 2024 and February 2026, driven primarily by general-purpose browser and computer-use tools.
  • General-purpose tools grew from 41% to 50% of downloads, while 94% of general-purpose server downloads involved action capabilities and 95% of downloaded perception tools remained narrow-purpose.
  • Servers with payment execution capabilities increased from 47 in January 2025 to 1,578 in February 2026, alongside evidence of emerging autonomous-payment tools.

6 Discussion: What do these tool use findings tell us about the risks of AI agents in different domains?

The expanding action space of AI agents increases the potential consequences of errors and complicates governance, especially as general-purpose tools operate in less controlled environments. Public tool monitoring can provide early deployment signals, but it does not directly measure risk and must be supplemented with private-tool and usage-context data.

  • 36x more public tools were available to agents in early 2026 than a year earlier, expanding the potential consequences of errors and misalignment.
  • The monitoring approach does not measure risks directly and requires data on private internal tools and the usage context of general-purpose tools.
  • Expanding general-purpose access increases exposure to misuse and security risks, including prompt injection when agents can execute code and access file systems.
  • Tools for software development and financial tasks are numerous and heavily used, creating potential for structural changes in these domains.
  • General-purpose tools are harder to govern than narrow tools because a browser-use tool can perform both necessary tasks and potentially harmful actions.
  • For consequential actions such as large financial transfers or legal registration, developers and regulators could require human authentication.
  • Potentially consequential actions increasingly occur in general, unconstrained environments such as the internet rather than through restricted, secure APIs.
  • Tool monitoring is useful for early exploratory questions about agent use, while surveys, interviews, and usage data can deepen later understanding.

7 Conclusions and future work

The study measures a rapidly expanding AI-agent action space, while emphasizing that MCP repositories provide a lower-bound view of available tools. It identifies growing use of action and general-purpose tools, but calls for broader monitoring, finer taxonomies, and sector-specific risk models.

  • Conclusion: 177,000 tools were available by 02/2026, up from approximately 4,888 in 01/2025, while action-tool downloads rose from 27% to 65%.For company-built tools, the action-download share rose from 21% to 71%.
  • Conclusion: 41% to 50% of downloads shifted toward general-purpose tools, and 94% of those downloads involved action capabilities.The expansion was concentrated in tools enabling access to unconstrained environments.
  • Conclusion: Software development accounts for 67% of tools and 90% of downloads, while higher-stakes domains such as finance and cryptocurrency show limited expansion.The study describes financial transactions as an example of a higher-stakes domain requiring sector-specific monitoring.
  • Limitations: MCP repositories do not capture the full breadth of deployed agent tools, so the findings represent a lower bound rather than a comprehensive account.Developers may use custom integrations, proprietary tooling, or distribution channels outside the monitored data.
  • Future work: Future monitoring should measure agent systems and actual external actions, while refining action taxonomies and economic-task mappings.Suggested refinements include duration, reversibility, consequentiality, modification degree, sector-specific distinctions, and expert validation of O*NET mappings.
  • Future work: Sector-specific risk models are needed to identify when agent activity moves from contained activity toward systemic risk.For finance, proposed monitoring includes agents’ share of transactions, concentration, correlations, and early indicators of payment-system stress.

A.1 Detailed human validation results

Human validation supports the LLM-based classifications, but agreement is lower for detailed occupational-task assignments than for broader direct-impact labels.

  • Human validators agreed 78% with Claude Sonnet 4.5’s O*NET task classification and 81% with its direct-impact classification.
  • 78% agreement was obtained for server-level O*NET classification and 74% for tool-level classification in blind validation.
  • Lower-level occupational-task assignments were less reliable because O*NET tasks are highly specific while MCP tools often have broader remits.
  • 81% human–LLM agreement was obtained for direct impact, with 85% agreement on functionality conditional on matching impact level.
  • 78% agreement was observed for MCP server-level direct-impact classification, where each server received its highest tool-level impact.

A.2 Hierarchical classification methodology

The paper builds a three-level O*NET task hierarchy and uses hierarchical classification to map MCP tools to occupational tasks while reducing the effective search space.

  • Task hierarchy: The hierarchy is created by embedding task descriptions, clustering them with K-means, and assigning clusters to categories by cosine similarity.
  • Task hierarchy: 0.61 average assignment similarity indicates semantic alignment between middle-level clusters and top-level categories.
  • Tool mapping: The classifier selects a top-level category, then a middle-level cluster, then one O*NET task using tool and server context.
  • Tool mapping: 92 options replace the original 18,796-option search across the three hierarchical classification steps.
  • Example hierarchy: Figure A1 illustrates the hierarchy with financial-analysis and customer-service clusters nested beneath a business-management category.
  • Task hierarchy: 18,796 O*NET tasks are organized into 400 middle-level clusters and 12 predefined top-level categories.
  • Design choices: The approach uses deterministic semantic assignment, a 1024-dimensional embedding model, and a fixed 12-category structure.
  • Occupational mapping: Mapping tasks to 1,016 occupations enables analysis of occupational tool support, gaps, and availability across consequentiality levels.

A.3 AI-Created Server Detection

AI-created servers are identified from repository traces such as configuration files, bot contributors, co-authorship markers, and AI-tool mentions, then cross-validated against README-level AI detection.

  • Detection method: Four repository signals identify AI-created servers: configuration files, bot contributors, Co-Authored-By matches, and AI-tool mentions.
  • Detection method: The most likely AI agent is selected using weighted evidence scores of 10, 5, 3, and 1 for those signals.
  • First-month analysis: The first-month variant restricts evidence to the first 30 days after repository creation and excludes servers without a created_at date.
  • Cross-validation: 28.2% of repositories identified as significantly AI-generated by Pangram were captured by the conservative commit-mining approach.
  • Interpretation: The methods measure different constructs: README text generation versus AI coding-agent use evidenced in development history.
  • Cross-validation: Pangram classified 85 of 197 repositories as AI-generated, whereas commit mining classified 55 of 197 as AI-created.
  • Interpretation: The main disagreement involved repositories with AI-generated documentation but no commit-level evidence of coding-agent use.

A.4 LLM Prompts

The prompts extract MCP tools and server characteristics, classify generality and payment autonomy, and assign tools to O*NET and direct-impact categories through structured examples.

  • A.4.1 Processing readme to extract tools, MCP server validity and cleaned readme.: README processing extracts distinct tools, names, descriptions, capabilities, integrations, use cases, and task-specific context into structured JSON.
  • A.4.1 Processing readme to extract tools, MCP server validity and cleaned readme.: The prompt removes installation, prerequisites, setup code, directory-layout, license, contribution, and URL content from filtered README text.
  • A.4.1 Processing readme to extract tools, MCP server validity and cleaned readme.: MCP validity is encoded as is_mcp_server=1 for actual servers with tools or capabilities and 0 for documentation or references.
  • A.4.2 Prompt for MCP server classification on generality and payment autonomy.: Generality is classified across industry scope and environmental openness, distinguishing cross-industry or open tools from specialized or constrained ones.
  • A.4.2 Prompt for MCP server classification on generality and payment autonomy.: The blockchain example treats a send_transaction tool with an available private key as autonomous payment execution without external approval.
  • A.4.4 Prompt for direct impact classification.: The direct-impact prompt distinguishes perception, reasoning, and action tools, including database queries, planning, analysis, and environmental modification.

A.5 Methods for monitoring agent use

The monitoring approach maps MCP-server usage to task and occupation domains while highlighting strong concentration among the most-used servers. The results are partly sensitive to classification of a few high-usage servers and incomplete usage data.

  • Domain mapping: Task and occupation domains are used as two approaches for mapping agent activity.The notes distinguish high-level task domains from Standardised occupation classification clusters.
  • Usage assignment: Server-level usage is assigned to tools under the assumption that one server use equals one use of every tool on that server.This is stated as an assumption underlying the usage assignment.
  • Usage concentration: 42.9% of PyPI downloads come from the top 1% of servers, while the top 10% account for 74.5%.The top 1% comprises 13 servers.
  • Limitations: Results are partly susceptible to misclassification of a few high-usage servers.Smithery’s use-count statistic was omitted because monthly data splits were missing.
Loading 2603.23802v1…