Updated: | Originally published: | By Susanna Fagerholm
TL:DR
- MCP adoption has doubled. Official MCP servers across 816 SaaS products rose from 47 to 100, taking support from 5.8% to 12.3%.
- AI assistants are moving from reading to acting. Servers that can run workflows grew by 110%, almost five times faster than search.
- Most of the market is still open. 57% of products have no official MCP server, and outside developers are filling the gap.
- The takeaway: The SaaS products pulling ahead offer useful outcomes safely, not the most tools.
Page contents
When Anthropic released the Model Context Protocol (MCP) in November 2024, it set out to solve a familiar problem. Every AI assistant needed its own custom connection to every tool or data source it wanted to use. MCP replaced that patchwork with a single open standard: build a server once, and any compatible AI assistant can use it. MCP adoption is now reshaping how software companies think about their products.
Within a year, MCP had more than 97 million monthly SDK downloads, 10,000 active servers, alongside support across major AI tools and platforms.
The question is no longer whether MCP will become a standard. It’s what the standard is turning into, and what that means for the software companies on the other end of the connection.
From one company’s project to a shared standard
The most important change in MCP’s second year had nothing to do with code. Anthropic donated MCP to the Agentic AI Foundation, a fund under the Linux Foundation. The foundation was co-founded by Anthropic, Block and OpenAI, with support from Google, Microsoft, AWS, Cloudflare and Bloomberg.
This gives MCP a more neutral home and reduces the risk of building around a single AI vendor. For SaaS companies, that makes investment in MCP less of a bet on one provider and more of a commitment to shared infrastructure.
MCP’s production architecture is taking shape
MCP’s early versions suited developers experimenting on their own machines. The past year has been about making the protocol work for real businesses at scale.
Servers are easier to deploy. Improvements to the protocol and its surrounding infrastructure are making hosted MCP services more practical to operate. In practice, MCP servers can sit behind the same web infrastructure as any other online service.
Sign-in needs to work across organisations. Enterprise authorisation developments aim to make access easier to manage through organisational identity and policy, rather than leaving employees to configure every connection independently. The details depend on the relevant implementation and client support, but the direction is clear: enterprise access needs to be manageable, not just possible.
AI assistants can show, not just tell. MCP Apps extend the experience beyond text, allowing tools to return interactive interfaces such as dashboards, forms, visualisations and multi-step workflows within supported AI clients.
Our research shows SaaS vendors moving in the same direction. Among the official MCP implementations we studied, hosted delivery grew from 34 to 44, while implementations using OAuth-based authentication rose from 28 to 36. Those offering visual or interactive results went from just 1 to 6.
Vendors increasingly run MCP as a managed service for their customers, with every action happening under the user’s own identity. The challenge is no longer shipping a single server, but launching and maintaining them at speed.
SaaS MCP adoption has doubled
To understand how software companies are responding, we tracked the same 816 SaaS products across 2025 and 2026 for our report, The State of MCP: 2025 vs 2026. The number of products with a verified official MCP server rose from 47 to 100. That takes official support from 5.8% of the products we studied to 12.3%, or roughly one in eight.
The 2025 baseline was adjusted to reflect the same product universe and classification criteria used in 2026, so the increase reflects both market growth and expanded research coverage. It offers a clear view of how the landscape has changed, rather than a precise measure of growth alone.
MCP adoption is also spreading beyond its original audience. Developer tools and DevOps still lead, growing from 5 to 17 and from 6 to 14 official servers respectively. But databases grew from 2 to 8, sales from none to 5, and CRM from 1 to 5. MCP is shifting from a convenience for engineers to a general way for sales, support, marketing and operations teams to work with their software through AI.
Want the full breakdown? Our report examines adoption across 816 SaaS products, including category-level findings and the capabilities vendors are exposing.
From access to action
If one theme defines the current wave of MCP adoption, it’s the move from letting AI assistants read to letting them act.
Early MCP servers were mostly about access: searching documentation, fetching records and summarising information. That’s still the foundation, but our research shows stronger growth in capabilities that let assistants change things and carry out tasks.
| Capability | 2025 | 2026 | Growth |
|---|---|---|---|
| Reading, searching and discovering information | 40 | 49 | +23% |
| Creating and updating records | 25 | 35 | +40% |
| Running workflows and operational tasks | 10 | 21 | +110% |
| Visual and interactive results | 1 | 6 | 6 x |
Workflow and operational capabilities grew faster than read-and-search capabilities in our sample. This reflects the wider shift towards agentic AI. Assistants are expected not just to answer questions but to complete work: running automations, processing approvals, updating systems and carrying out multi-step tasks on a user’s behalf.
MCP is becoming the layer that makes that possible.
Action, within limits
An AI assistant that can only read information might give a wrong answer. An assistant that can act might send the wrong message, change the wrong record or expose the wrong data. As MCP moves towards action, security becomes central to MCP adoption.
The risks go beyond the model
One widely discussed risk is tool poisoning, where malicious or misleading tool descriptions or outputs can influence a model’s behaviour. The OWASP MCP Top 10 highlights risks across the MCP ecosystem, while security guidance from Microsoft and the Cloud Security Alliance underscores why tool definitions and execution behaviour deserve careful review.
The practical lesson is broader than any one attack: an AI integration must be designed around the consequences of the actions it can take.
Make safe behaviour the default
The more mature implementations are not simply exposing more functionality. They make deliberate decisions about four things at once:
- which tools an AI assistant can see
- whose permissions apply
- which actions need a person to confirm them
- what gets recorded afterwards
These controls turn an MCP server from a technical connector into part of the product, and a central part of whether customers trust it. It also means the tools themselves need to be clearly described and easy for AI models to use.
The gap: demand without supply
Despite all this momentum, MCP adoption across SaaS still has a long way to go. In our study, 465 of the 816 products (57%) had no verified official MCP server.
Demand hasn’t waited. In several categories, outside developers are building their own unofficial servers to fill the gap:
- Accounting: 10 products with community-built servers and none with an official one.
- ERP: 7 products with community-built servers and none with an official one.
- IoT: 7 products with community-built servers and none with an official one.
- Calendars: 6 products with community-built servers and none with an official one.
While this doesn’t prove vendor endorsement, security or production use, it does indicate market interest. It reveals where customers want to connect their software to AI workflows.
That brings real risk alongside the opportunity. The OWASP framework also flags shadow MCP servers, meaning servers running outside an organisation’s approval and oversight.
When customers rely on connections the vendor does not maintain, the security, reliability and user experience may be outside the vendor’s control. An official MCP server lets SaaS companies take back that control and decide which workflows deserve a supported, dependable integration.
But how do you decide what functionality to make available via AI? The tool below enables you to select a SaaS vertical category to see actual MCP use cases that have been implemented, also enabling you to see who has implemented it.
What this means for SaaS teams
The foundations for MCP adoption are taking shape. But publishing a server is no longer enough to stand out. The products pulling ahead won’t necessarily be the ones exposing the most tools, but the ones offering useful outcomes safely.
That starts with a different question. Instead of asking “Which API endpoints can we expose?”, ask “Which customer outcomes should an AI assistant be able to request through our product?”
Three principles follow from that:
- Choose an outcome, not a protocol project. Start with a customer task where the product holds valuable information or can remove real manual effort.
- Keep actions within clear limits. Use access controls, confirmation steps, audit records and the ability to revoke access, so AI assistants can be useful without being reckless.
- Design for more than one type of server. A read-only hosted server for customers and a more powerful version for administrators can serve very different needs.
The safest useful level of independence makes a stronger product than the widest range of tools.
MCP’s next phase won’t be defined by connectivity alone. It will be defined by whether SaaS companies can turn that connectivity into outcomes customers trust.
