Recent years have seen the rise of AI agents, large language models (LLMs) that take multi-step actions on behalf of users. These systems have improved rapidly, and can now send emails, browse the web, execute code, and make financial transactions, often with minimal human oversight.
How are these AI agents actually being used in the real world? Despite growing adoption, little public data exists on where and how agents are being deployed. To address this gap, we analysed 177,436 AI agent tools published between November 2024 and February 2026 by monitoring public Model Context Protocol (MCP) server repositories. In this blog post, we outline our approach and key findings.
What is an MCP server?
MCP is the dominant open standard for giving AI agents access to external tools and services. It works like a universal plug: an MCP server wraps a specific capability, whether that is a Google Calendar, a cryptocurrency wallet, or a web browser, and makes it available to any compatible AI agent. Because these servers are published on public platforms like GitHub, tracking them provides visibility into what tools developers are building for agents and how widely those tools are being adopted.
Key findings
The scale of AI agent tooling is rising quickly: Over the last year, the number of publicly released MCP tools rose from around 5,000 to 177,000, accompanied by a substantial increase in download activity (from 80,000 to 14 million).
Agents are shifting from observation to action. Early in the period, most tools supported perception or analysis tasks such as reading files or querying data sources. By late 2025, download patterns had shifted toward tools that allow agents to take direct actions in external systems, such as executing code or using computers Action‑enabling tools now represent the majority of use, especially for tools released by established companies.
Agents are increasingly operating in unconstrained environments. General purpose tools operating in unconstrained environments like the open web grew from 41% to 50% of downloads. Critically, 95% of general-purpose tool downloads involved action capabilities. This means that potentially consequential agent actions are increasingly occurring in the least controlled environments – such as agents browsing the web or controlling a computer – rather than through restricted, secure API integrations.
Most MCP tools are currently used for software development and other IT tools: Tools for software development and IT account for 67% of all published tools and 90% of downloads, suggesting that most agents are used to accelerate technical workflows However, 14% of tools support finance and business management tasks, and tools exist for domains including scientific research, healthcare, education, and legal compliance.
Most action tools support medium stakes tasks, but finance is an outlier. Using O*NET impact ratings, we find that most action tools support medium-stakes occupations such as computer systems administration. Finance is one exception to this rule: high-stakes occupations including financial services agents, accountants, and financial managers, have more action tools than predicted by the overall pattern. MCP servers with payment execution capabilities grew from 46 in January 2025 to over 1,200 in January 2026, with a notable concentration in cryptocurrency tools that enable direct, potentially irreversible transactions.
Agent tool usage is clustered in certain regions Approximately half of action tool downloads originate from the United States, followed by Western Europe (~20%) and China (~5%). We note this likely reflects the Western-centric user base of the Python Package Index and may underrepresent activity in regions using alternative distribution channels.
AI agents are being used to build their own tools. We detect AI assistance in 29% of MCP servers (38% of tools). The share of newly created servers with detected AI assistance rose from 6% in January 2025 to 55% in January 2026. Claude Code dominates AI assisted tool creation, accounting for 66% of AI co-authored servers, followed by Cursor (10%) and GitHub Copilot (10%). This trend suggests that tool creation is no longer bottlenecked by human developers, meaning future advances could be rapid.
Overall, these results show that the AI agent ecosystem is expanding rapidly, with a notable shift from perception and reasoning tools toward action‑enabling capabilities, especially in unconstrained environments like browsers and full computer control.
Most agent tools today are still focused on medium-stakes work like software development. But the rapid growth of financial and other high-impact action tools shows how quickly agents are moving into more consequential territory. At the same time, more tools are being built by AI itself, which could speed this up even further as agents help create the capabilities they later use.
This project is part of a collaboration between AISI and the Bank of England. For more detail, see the full paper.
