11,000 MCP Servers and the Allowlist Problem Nobody Solved

A new aggregator claims the Model Context Protocol ecosystem has passed 11,000 servers, scattered across four registries that do not talk to each other.

The number comes from TormentNexus, a commercial index that pulls listings from Glama, Smithery, npm and GitHub into one search schema. Treat the figure as a vendor count, not an audited census — but the fragmentation it describes is real, and it is the reason nobody on your platform team can answer which MCP servers your developers are actually running.

Four registries, four different jobs

Each source solves a different problem, which is precisely why no single one works as a catalog:

Registry	Strength	Gap
Glama	Commercial marketplace, vetted production-ready servers with documentation	Curated, so the open-source breadth is not represented
Smithery	Community registry, strong on experimental and niche servers	Varying documentation and maturity to sift through
npm	Hundreds of servers shipped as Node packages under mcp-server or @modelcontextprotocol/*	No ratings or usage metrics; needs precise keyword guessing
GitHub Topics	Source code and implementation detail	A code repository is not a product catalog

The index claims discovery cost rises from a five-minute search to a multi-hour investigation across four or five platforms, and that its own per-server cards carry quality score, latest version, monthly downloads and repository stars. Those are the vendor's claims for its own product; the useful takeaway is which metadata you should be demanding before you install anything.

The governance bill comes due at install time

A separate weekly review of the ecosystem makes the sharper point. Five newly risk-classified servers landed in one week, all free, and three of them hand agents direct access to external systems: send21 lets agents draft payments while humans sign in their own wallet (non-custodial, so agents cannot move money unapproved), Kleap lets agents create and publish live websites, and ReefAPI MCP exposes 250+ live web APIs across e-commerce, jobs, finance and social. Two more — ContextStream and Robot Speed — stay inside the perimeter but widen what agents can see.

Kleap is the one worth pausing on. A server that publishes live sites under your domain turns a successful prompt injection into a phishing-page generator, which is a supply-chain problem rather than a data-access one.

Double-approving the same access

The review lists the week's five most-viewed servers as GitHub Copilot MCP, OpenAI MCP, Figma MCP, GitHub MCP and Anthropic Claude MCP — all official integrations, and all carrying governance friction. Copilot MCP and GitHub MCP both bridge GitHub, so a team can allowlist one without realizing it has approved repository and workflow access twice. The OpenAI and Anthropic servers create sub-agent chains, which the review calls elegant for specialization and opaque for audit.

The structural gap it names is allowlist drift: most platform teams can see which servers developers install in Claude, but are blind across Cursor, Windsurf and local IDE plugins. Approving a server in one tool does not stop anyone running it in another.

Three questions before you allowlist anything

• Does your SSO cover the server's auth model, or do developers authenticate to it directly?
• Are API credentials scoped per user, or shared across the team?
• Can you revoke access atomically across every IDE at once?

If the answer to the third is no, server count is not your problem — enforcement is. Worth watching: whether any registry starts publishing risk classifications the buyer can verify independently, rather than ones the listing vendor assigns to itself.