State of MCP, October 2026: a TestedMCP data report

Download the data (CSV) scored.json

*Published 2026-10-22. Every number below comes from TestedMCP's automated test runs on that day; none is estimated or copied from a vendor.*

Headline: deprecation and archive status, verified

Of the original 31 listings, 7 are deprecated or archived, and 6 of them are official reference servers. This confirms the earlier internal estimate (7, including 6 reference servers). All 7 carry an npm deprecated flag *and* live in a GitHub repository marked archived:

• @modelcontextprotocol/server-puppeteer: npm says "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info."; repo modelcontextprotocol/servers-archived is archived. Our handshake result: working.
• @modelcontextprotocol/server-github: npm says "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info."; repo modelcontextprotocol/servers-archived is archived. Our handshake result: working.
• @browserbasehq/mcp-server-browserbase: npm says "This package has moved to @browserbasehq/mcp"; repo browserbase/mcp-server-browserbase is archived. Our handshake result: working.
• @modelcontextprotocol/server-redis: npm says "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info."; repo modelcontextprotocol/servers-archived is archived. Our handshake result: working.
• @modelcontextprotocol/server-postgres: npm says "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info."; repo modelcontextprotocol/servers-archived is archived. Our handshake result: working.
• @modelcontextprotocol/server-slack: npm says "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info."; repo modelcontextprotocol/servers-archived is archived. Our handshake result: auth-gated.
• @modelcontextprotocol/server-brave-search: npm says "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info."; repo modelcontextprotocol/servers-archived is archived. Our handshake result: auth-gated.

Across the expanded set of 136 listings, 22 (16%) are deprecated or archived. 18 are flagged deprecated on npm or have a yanked latest PyPI release, 18 sit in archived GitHub repos, and 14 are both. 13 of the 22 are former modelcontextprotocol reference servers. 7 of the 22 still install and complete a handshake, so an MCP client gives no warning that the package is unmaintained.

Vendor packages deprecated in favour of hosted remote MCP endpoints or CLIs: @browserbasehq/mcp-server-browserbase, @circleci/mcp-server-circleci, @neondatabase/mcp-server-neon, @railway/mcp-server, @sanity/mcp-server.

Full deprecation messages, quoted verbatim from the npm deprecated field or the PyPI yank reason:

• @browserbasehq/mcp-server-browserbase: "This package has moved to @browserbasehq/mcp"
• @circleci/mcp-server-circleci: "Deprecated: use CircleCI's hosted MCP server or CircleCI CLI MCP instead. See https://circleci.com/docs/guides/toolkit/circleci-mcp-overview/"
• @elastic/mcp-server-elasticsearch: "This package is deprecated. Please see the README at https://github.com/elastic/mcp-server-elasticsearch for details on how to run v0.4.0 or later."
• @modelcontextprotocol/server-aws-kb-retrieval: "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info."
• @modelcontextprotocol/server-brave-search: "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info."
• @modelcontextprotocol/server-everart: "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info."
• @modelcontextprotocol/server-gdrive: "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info."
• @modelcontextprotocol/server-github: "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info."
• @modelcontextprotocol/server-gitlab: "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info."
• @modelcontextprotocol/server-google-maps: "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info."
• @modelcontextprotocol/server-postgres: "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info."
• @modelcontextprotocol/server-puppeteer: "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info."
• @modelcontextprotocol/server-redis: "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info."
• @modelcontextprotocol/server-slack: "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info."
• @neondatabase/mcp-server-neon: "This package is deprecated. Use the remote MCP server at mcp.neon.tech instead. See https://neon.tech/docs/ai/neon-mcp-server for more details."
• @railway/mcp-server: "Deprecated: Railway MCP is now bundled into the Railway CLI. Use 'railway mcp'. See https://docs.railway.com/cli/mcp."
• @sanity/mcp-server: "This package has been deprecated. Use the remote MCP server at https://mcp.sanity.io instead."
• awslabs.core-mcp-server: "yanked: load individual MCPs"

The sample

• 136 listings: 89 npm packages and 45 Python packages from PyPI (installed with uv pip, launched the same way uvx would), and 2 remote servers tested over HTTP at their public endpoint (no install step; 'installed' means the endpoint was reachable). The 31 original listings were re-run under the new scoring.
• Sources: the official MCP Registry (registry.modelcontextprotocol.io, stdio packages), the modelcontextprotocol/servers reference and legacy lists, and well-known vendor and community packages. We dropped 9 candidate names that did not exist on npm or PyPI before testing.
• Tested in batches of 25, starting with no-key categories (browser, files, memory, fetch), plus a 6-package database batch run against live local Postgres 18 and Redis 6 instances, an 8-package vendor batch (DigitalOcean, Hostinger, Bright Data, ElevenLabs, Vercel, Mistral, Ollama, LM Studio) and a remote-endpoint batch (ScrapingBee, Vercel) tested over Streamable HTTP without credentials.

Results

The median score is 75.0/100 (mean 74.7). 59 listings (43%) had a push or release within 30 days of the test.

npm vs Python

Python servers fail more often on a fresh install. 7 Python packages crashed on startup with errors that point to the API change in version 2.x of the mcp Python SDK (for example 'Server' object has no attribute 'list_tools', or "pin 'mcp<2'"). None of them pins an upper bound on the SDK, so anyone who installs them today gets a broken server: postgres-mcp, mcp-server-fetch-python, mcp-server-tree-sitter, mcp-server-sqlite, playwright-mcp-server, mcp-server-office, mcp-server-kubernetes.

By category

Auth-gated share

21 of 136 listings (15%) are auth-gated: without a key, all they do is print a message naming the credential they need (1 remote server(s) instead answered HTTP 401/403 with an OAuth challenge). The old scoring gave these servers 20 of 30 handshake points. The new rubric gives them 5 and reports them separately from working servers. Another 32 failed for other reasons. Some of those may also be credential errors that didn't show up in our captured output (we keep only the last 400 characters of stderr), but we count them as failed rather than assume.

Functional task tests (no API keys)

We ran these only on servers that completed a handshake, and only in categories where a key-free task makes sense. When our test box blocked a task, we recorded it as *not run*, not as a failure. Causes included: sandbox DNS resolves public hosts to 198.18.0.1, so SSRF guards refuse the request; the harness skips bundled browser downloads; no backing service was running; a browser extension was required.

Overall, 29/34 executed tasks passed (85%) across 35 servers. The tasks: write, read and list a temp file; store and retrieve a memory entity; fetch https://example.com/; navigate to that page and read the title "Example Domain"; run a SQL SELECT on a seeded table; SET and GET a Redis key. Servers that passed every task they ran: @playwright/mcp, chrome-devtools-mcp, @wonderwhy-er/desktop-commander, markitdown-mcp, redis-mcp-server, @modelcontextprotocol/server-memory, @modelcontextprotocol/server-filesystem, basic-memory, fetcher-mcp, @henkey/postgres-mcp-server, @modelcontextprotocol/server-redis, @itseasy21/mcp-knowledge-graph, @tokenizin/mcp-npx-fetch, @kazuph/mcp-fetch, mcp-redis, @modelcontextprotocol/server-postgres.

Failures: @agent-infra/mcp-server-browser (read page title (expect "Example Domain")); mcp-knowledge-graph (store entity, retrieve entity); @browserbasehq/mcp-server-browserbase (navigate to https://example.com/, read page title (expect "Example Domain")). The harness picks tools and arguments from each schema using heuristics. A failure shows that the generic call did not work; it does not prove the server is broken.

Replacements for the deprecated Postgres and Redis reference servers: against live local instances, the maintained @henkey/postgres-mcp-server passed the SQL task, and both redis-mcp-server (Redis's official package on PyPI) and mcp-redis (npm) passed SET/GET. The deprecated reference servers still work against a live service too. postgres-mcp (Crystal DBA, PyPI) installed but crashed on startup because of the mcp SDK 2.x incompatibility.

Small-model readiness

76 servers have measured tool schemas (5 more working servers, added after the schema pass, are not yet measured and count as unknown). Their median schema cost is 1068 tokens and the maximum is 16536 (tiktoken cl100k estimate over name, description and inputSchema). 20 servers need more than 4k tokens, and 8 need more than a full 8k context window before the user types anything. Static rating: 34 high, 30 medium, 12 low, 60 unknown (no tools/list, or not yet measured). The thresholds are on the methodology page.

Live small-model runs: CPU only (8 vCPU, no GPU), Ollama 0.40.8, Q4_K_M GGUF, temperature 0, output capped at 512 tokens, driven by a minimal MCP client (harness/smallmodel.mjs).

These are 3 runs per pair, not the 10 the spec calls for, so treat them as directional. Raw logs are in data/smallmodel.json. Failure modes we saw: with markitdown-mcp, the 3B model returned an empty reply and made no tool call in all 3 runs, while the 1.5B model succeeded; with chrome-devtools-mcp, both models called navigate_page without the required pageId and got validation errors, which matches the community advice to start small models on servers with few tools. An earlier exploratory run with Qwen2.5 7B Q4_K_M (CPU) completed the memory and filesystem tasks once each, in 30-32 s; it is not included in the table.

Methodology

• Install (20 pts): npm install (Node 20.19) or uv pip install into a fresh Python 3.13 venv. Linux, 4-minute timeout.
• Handshake (30): stdio initialize (protocol 2025-06-18), then tools/list, with a 45 s timeout and no credentials. 30 = working, 5 = auth-gated, 0 = failed.
• Maintenance (25): GitHub pushed_at, or the latest release date if no repo was found. Scores 0 if the package is deprecated on npm, its latest PyPI release is yanked, or its repo is archived. GitHub metadata came from the GitHub search API on 2026-10-22.
• Docs (15): the package's own README (shipped in the npm tarball, or the PyPI long description), so monorepo packages are judged on their own subdirectory README.
• License (10): OSI-approved license detected.
• Functional tasks, small-model signals and pricing are recorded separately and do not change the score.

Limitations

• One run per package, on one Linux box, on one day. We used no credentials, so for auth-gated servers we only know that they ask for a key.
• Sandbox DNS maps public hosts to 198.18.0.1, which blocked SSRF-guarded fetchers and Ollama's own model registry (we loaded the models as GGUF files from Hugging Face instead). Bundled browser downloads were skipped, so servers that rely on a bundled Puppeteer or Playwright browser show their browser tasks as not run.
• Functional tasks use generic schema heuristics. We captured only the last 400 characters of stderr.
• Some generic PyPI names (for example mcp-server-memory) may not be the project their label suggests. We list them under the package name we actually tested.
• Archive status for the legacy reference packages follows where their source now lives (modelcontextprotocol/servers-archived, verified by checking that the files exist there). Their npm repository field still points at the active monorepo.
• We assert free_oss pricing only for 25 listings, where it can be verified from our run plus an OSI license. All other listings are unknown.

Download the data (CSV) scored.json