How are AI agents used? Evidence from 177,000 MCP tools — monitoring the action space

The Coinbase transaction example sharpens a boundary that a transcript blurs ^[1][1] Introduction“Unlike a standard LLM that can draft correspondence, list products, or recommend stocks, an agent can use tools to autonomously send an email (e.g. using Google MCP), search an online marketplace (…”Open source. A model can recommend moving cryptocurrency or draft instructions for doing so; those outputs do not establish that a transaction occurred. The naive measurement—scan generated text for action verbs—therefore counts advice, intention, and environmental modification as the same event.

Tool access supplies the missing distinction. The paper defines an agent’s agent action space as the set of actions it can take in the world and says tools define that set ^[2][2] Characterising the action space of AI agents“The \textbf{action space} of an AI agent describes the set of actions it can take in the world. Tools define an AI agent's action space.”Open source. In the Coinbase example, access to a transaction tool changes the available operation from describing a transaction to executing one ^[1][1] Introduction“Unlike a standard LLM that can draft correspondence, list products, or recommend stocks, an agent can use tools to autonomously send an email (e.g. using Google MCP), search an online marketplace (…”Open source. Credentials and permissions can still constrain access to a tool ^[2][2] Characterising the action space of AI agents“The \textbf{action space} of an AI agent describes the set of actions it can take in the world. Tools define an AI agent's action space.”Open source. The capability claim is therefore conditional: the tool opens a route to modification; it does not prove that the route was used.

That makes tool availability informative without making it behavioral telemetry. The causal chain is short: a server exposes an operation; the agent can select it; the operation may modify the external environment. Generated text exposes only a proposed step. Tool access exposes which environmental step is available. The paper states that an agent can act on instructions only when it has tools that permit the action ^[3][3] The action space shapes the risks of AI agents“Second, an AI agent can only act upon malicious instructions, when it has tools to act, e.g., to send emails or cryptocurrency \citep{mo2025attractive, hou2025modelcontextprotocolmcp, gan2024naviga…”Open source. Evidence about availability therefore does not establish that a particular call occurred; action-level records would be needed for that.

Capacity also depends on more than possession of a tool. The paper defines autonomy as the ability to complete tasks without further external direction or control ^[4][4] Characterising the action space of AI agents“\textbf{Autonomy} is the ability of an AI agent to fulfil tasks without external direction or controls, e.g. follow-up prompts by humans or other AI systems \citep{cihon2025measuring}.”Open source. A transfer tool could sit behind confirmation on every call, or an agent could invoke it as one step in a longer plan. The tool determines what action is available; system configuration and planning determine how that capacity is exercised. This is why output-only monitoring misses a consequential boundary, but tool monitoring alone still cannot establish behavior or intent.

One uncertainty now becomes operational. Saying that “tools matter” does not identify the functions exposed by public servers, distinguish a transfer function from a balance reader, or show when either appeared. The action-space lens needs an inventory before it can become a measurement.

Suppose a GitHub hit mentions Coinbase MCP. That hit is not yet evidence of a cryptocurrency-transfer tool: the same search can surface an actual server, a list pointing to servers, or documentation that merely mentions the protocol. Counting hits would mix documented tools with pointers and prose. Counting repositories would introduce a second error because one verified server can describe several distinct tools. The study therefore has to change both the inclusion rule and the unit being counted. ^[5][5] Identification of MCP servers via Online Repositories“After deduplication and filtering out servers with 0 stars, we used an LLM (Claude Sonnet 4.5) to verify each entry was a valid MCP server rather than documentation or unrelated code. In addition,…”Open source ^[6][6] LLM Prompts“EXTRACT tools information (try to copy the relevant exact text from the README):\\ Identify each distinct tool/function/capability mentioned,\\ Extract name and description for each tool,\\ Look fo…”Open source

First comes a broad candidate pool. The study searched GitHub repositories with at least $1$ star for “mcp server” in the name, description, README, or tags; queried the Smithery registry; and incorporated two prominent GitHub server lists. The lists improve coverage, but their entries already appeared in GitHub or Smithery, so they do not create an independent pile of duplicate servers. ^[7][7] Identification of MCP servers via Online Repositories“\textbf{GitHub.} We searched for repositories with at least 1 star whose name, description, readme or tags include the string `mcp server' (n = 16,956 MCP servers in the final dataset).”Open source <sup>[8]</sup>[8] Identification of MCP servers via Online Repositories“\textbf{Smithery MCP registry} (n = 2,437 in the final dataset). We chose Smithery due to its permissive registry API and size, compared to other registries.”Open source <sup>[9]</sup>[9] Identification of MCP servers via Online Repositories“\textbf{MCP server lists on GitHub.} To ensure coverage of prominent MCP servers and identify `official' servers, we include servers on two popular MCP server lists: The official MCP repository \ci…”Open source

Breadth alone produces a dirty inventory. After deduplication and removal of zero-star entries, an LLM judge rejected documentation and unrelated code, then retained only servers whose README or description clearly defined tools. That sequence reduced $73{,}338$ candidates to $19{,}388$ verified servers. ^[5][5] Identification of MCP servers via Online Repositories“After deduplication and filtering out servers with 0 stars, we used an LLM (Claude Sonnet 4.5) to verify each entry was a valid MCP server rather than documentation or unrelated code. In addition,…”Open source

Verification still leaves the wrong unit of analysis. A server is a container, not a single capability. The README-processing prompt therefore extracts every distinct function or capability as a separate record, with a unique name and description, while excluding installation instructions and other setup material. If the Coinbase README separately defines balance lookup and cryptocurrency transfer, those become separate tool records rather than one generic “finance server” observation. This tool-level expansion yielded $177{,}436$ distinct tools from the verified servers. ^[6][6] LLM Prompts“EXTRACT tools information (try to copy the relevant exact text from the README):\\ Identify each distinct tool/function/capability mentioned,\\ Extract name and description for each tool,\\ Look fo…”Open source ^[5][5] Identification of MCP servers via Online Repositories“After deduplication and filtering out servers with 0 stars, we used an LLM (Claude Sonnet 4.5) to verify each entry was a valid MCP server rather than documentation or unrelated code. In addition,…”Open source

The distinction matters: adding another server and adding another capability are not equivalent events. The observatory counts the latter while retaining the server that exposed it.

Finally, the dataset needs time. Each server receives its creation date, while README and tool contents come from dated captures: October 1, 2025 for servers created before October 2025, and February 1, 2026 for newer servers. This supports ecosystem-level change over time, but not a complete history of tools added to or removed from each server between captures. ^[10][10] Identification of MCP servers via Online Repositories“We track the evolution of the MCP ecosystem by noting each server's creation date. Rather than analyzing only the latest February 2026 snapshot, we capture historical server versions: for servers c…”Open source

The result is a dated inventory of distinct tools documented in public sources: discovery finds candidates, deduplication prevents repeated servers, verification removes false positives, and extraction exposes the tools described by each survivor. A cryptocurrency-transfer tool is now observable as a record. But the pipeline has not yet classified how directly or broadly that tool can affect an external environment.

Place a balance lookup, a strategy calculator, and a cryptocurrency transfer in one inventory. Calling all three “tools” records their existence but erases the important differences: one reads the world, one transforms information, and one changes an account. Even “financial tool” is too coarse, because it says nothing about the kind or breadth of access.

The first cut is direct impact. A classifier assigns each extracted capability to perception when it reads data, reasoning when it analyses data or concepts, or action when it modifies an external environment. The Coinbase transfer tool is therefore an action tool: its defining effect is executing a financial transaction, not describing one. Classification happens at tool level because one server can bundle read-only and modifying capabilities. ^[11][11] Characteristics of AI agents: Tools define an AI agent's action space“The \textbf{direct impact} of an AI agent tool describes whether a tool permits perception, reasoning or action. Agents need \emph{perception tools} to access and read data, \emph{reasoning tools}…”Open source ^[12][12] Assessing perception vs. reasoning vs. action“We assign the direct impact classification on tool level, as one MCP server may have tools to access and tools to modify external environments.”Open source ^[1][1] Introduction“Unlike a standard LLM that can draft correspondence, list products, or recommend stocks, an agent can use tools to autonomously send an email (e.g. using Google MCP), search an online marketplace (…”Open source

That label still conflates a fixed transfer endpoint with control of an arbitrary browser. tool generality supplies the second cut. A narrow-purpose tool exposes a constrained environment, such as a specific cryptocurrency API; a general-purpose tool exposes an unconstrained environment, such as browser or computer control. The Coinbase transfer remains narrow-purpose even though its effect may be consequential. Because a server usually exposes one environment, the study assigns generality at server level and propagates it to the server’s tools. ^[13][13] Characteristics of AI agents: Tools define an AI agent's action space“Tool \textbf{generality} describes whether the tool enables interaction with narrow, constrained or general, unconstrained environments. \emph{Narrow-purpose tools} enable agents to fulfil tasks in…”Open source ^[14][14] Assessing narrow-purpose (constrained) vs. general-purpose (unconstrained) access to external environments“Generality is a property of the environment an MCP server provides access to, and all tools on a MCP server typically interact with the same environment. Thus, we classify generality on server-leve…”Open source

The third cut asks what economic work the capability supports. A task domain label maps the tool into the O*NET taxonomy of tasks and occupations. The transfer tool therefore occupies a finance-related economic function, while direct impact records that it modifies an account and generality records that it does so through a constrained interface. These dimensions are not substitutes: changing one does not force either of the others to change. Together they turn unlike descriptions into comparable records without pretending that all actions have the same function. ^[15][15] Characteristics of AI agents: Tools define an AI agent's action space“The \textbf{task domain} of an AI agent tool describes the typical kind of work the tool helps to fulfil. We classify domains using the O*NET framework of economic tasks and occupations, and distin…”Open source

Applied to the running example, the three questions classify the Coinbase transfer capability as action, narrow-purpose, and finance-related: it modifies an external environment through a constrained cryptocurrency interface and supports financial work. ^[1][1] Introduction“Unlike a standard LLM that can draft correspondence, list products, or recommend stocks, an agent can use tools to autonomously send an email (e.g. using Google MCP), search an online marketplace (…”Open source ^[13][13] Characteristics of AI agents: Tools define an AI agent's action space“Tool \textbf{generality} describes whether the tool enables interaction with narrow, constrained or general, unconstrained environments. \emph{Narrow-purpose tools} enable agents to fulfil tasks in…”Open source ^[15][15] Characteristics of AI agents: Tools define an AI agent's action space“The \textbf{task domain} of an AI agent tool describes the typical kind of work the tool helps to fulfil. We classify domains using the O*NET framework of economic tasks and occupations, and distin…”Open source A count of such records can compare available capabilities, but it cannot show which capabilities attract ecosystem activity.

If the public Coinbase MCP server appears in package-download records, the tempting story is that an agent transferred cryptocurrency. That leap turns installation into behavior: the package may have been fetched to initialize a test environment while the transfer tool was never called. The opposite shortcut—giving every published server one equal vote—also fails. A dormant experiment would count as much as a server fetched repeatedly, erasing the available signal of ecosystem attention. ^[1][1] Introduction“Unlike a standard LLM that can draft correspondence, list products, or recommend stocks, an agent can use tools to autonomously send an email (e.g. using Google MCP), search an online marketplace (…”Open source ^[17][17] Usage of MCP servers“Package downloads serve as a proxy for ecosystem interest rather than a direct measure of runtime execution. This metric counts installation events (e.g., initialising an agent environment) rather…”Open source

A download-based usage proxy keeps that ranking signal while limiting what it can establish. The study tracks monthly downloads from NPM and PyPI between November 2024 and February 2026. It matches download records to $3{,}854$ of $19{,}388$ servers, covering $42{,}498$ of $177{,}436$ tools, so the weighting applies to a subset rather than the complete repository census. ^[18][18] Usage of MCP servers“To estimate how popular MCP servers are, we tracked monthly download statistics (2024-11 to 2026-02) for the subset of MCP servers hosted on the Node Package Manager (NPM) and Python Package Index…”Open source

Within that subset, repeated downloads give a server more influence than an equally classified server with few downloads. Aggregating those weights by capability label can therefore reveal which categories attract more package-registry activity and whether their relative shares move over time. It does not convert the weights into observed tool calls.

Concentration makes the proxy useful and fragile. In the covered data, the top $1\%$ of NPM servers account for $79.3\%$ of downloads, while the top $1\%$ of PyPI servers account for $42.9\%$. A few classification errors can therefore move a weighted ecosystem estimate substantially. ^[20][20] Cumulative usage distribution“Usage is concentrated. For NPM downloads, the top 1\% (13 servers) cover 79.3\% of downloads, the top 10\% of servers cover 93.1\%. For PyPI downloads, the top 1\% (13 servers) dominate with 42.9\%…”Open source

If the Coinbase server’s download share rises, the defensible conclusion is narrower than “agents executed more transfers”: package-registry attention shifted toward that server. Because shares are normalized to a fixed total, its increase must be offset by lower shares elsewhere. Downloads can support relative trends and concentration estimates, not counts of runtime execution or production deployment. With capability labels and this bounded proxy in place, one problem remains: did the ecosystem’s composition actually change?

The obvious shortcut is to treat more tools and downloads as evidence that the ecosystem is shifting toward environmental modification. It fails: if every category expands at the same rate, totals rise while the functional mix stays fixed. A Coinbase cryptocurrency-transfer tool adds an action capability, but its presence alone says nothing about the dominant mix ^[1][1] Introduction“Unlike a standard LLM that can draft correspondence, list products, or recommend stocks, an agent can use tools to autonomously send an email (e.g. using Google MCP), search an online marketplace (…”Open source ^[11][11] Characteristics of AI agents: Tools define an AI agent's action space“The \textbf{direct impact} of an AI agent tool describes whether a tool permits perception, reasoning or action. Agents need \emph{perception tools} to access and read data, \emph{reasoning tools}…”Open source. The useful test is whether each category’s share of the download-based usage proxy changes.

Start with task domain concentration. Software-development and IT tools account for $67\%$ of published tools, but servers mainly hosting them receive $90\%$ of downloads. Business management, finance, and customer service account for $18\%$ of tools yet only $5\%$ of server downloads ^[21][21] How widely are AI agents used across task domains?“We find tools designed for software development and IT tasks account for 67\% of the total dataset. 90\% of downloaded MCP servers mainly hosted software development and IT tools (Table \ref{tab:do…”Open source. The Coinbase transfer tool sits in that smaller functional region. Publication is therefore broader than download-weighted interest: the ecosystem contains finance capabilities, but software work dominates the measured activity.

The level and the movement tell different stories. Software remains the dominant task destination ^[21][21] How widely are AI agents used across task domains?“We find tools designed for software development and IT tasks account for 67\% of the total dataset. 90\% of downloaded MCP servers mainly hosted software development and IT tools (Table \ref{tab:do…”Open source. The action share grew rather than preserving the original direct impact mix, and the paper attributes that shift primarily to adoption of general-purpose browser and computer-control tools ^[22][22] What fraction of AI agents are used for perception, reasoning or action?“Action tools rose from 27\% to 65\% of downloads over the 16-month period (Figure~\ref{fig:action-tools-trend}). This shift from perception tools (which allow agents to observe environments) to act…”Open source. The dimensions overlap: $94\%$ of general-purpose server downloads involved action capabilities, while $95\%$ of downloaded perception tools operated in constrained environments ^[23][23] What fraction of AI agents are used to access narrow, constrained environments or general, unconstrained environments?“General-purpose tools (operating in unconstrained environments like the open web) grew from 41\% to 50\% of downloads (Figure \ref{fig:generality-tools}). This shift was concentrated in action tool…”Open source. Downloads thus expanded unevenly toward modification in unconstrained environments. But direct impact leaves a concrete problem unresolved: editing a file and transferring cryptocurrency both count as actions ^[11][11] Characteristics of AI agents: Tools define an AI agent's action space“The \textbf{direct impact} of an AI agent tool describes whether a tool permits perception, reasoning or action. Agents need \emph{perception tools} to access and read data, \emph{reasoning tools}…”Open source ^[1][1] Introduction“Unlike a standard LLM that can draft correspondence, list products, or recommend stocks, an agent can use tools to autonomously send an email (e.g. using Google MCP), search an online marketplace (…”Open source.

The Coinbase example shows why that distinction needs another dimension. A cryptocurrency-transfer tool is an action tool because it modifies an external environment, yet it is narrow-purpose because it exposes predefined operations in a constrained service ^[11][11] Characteristics of AI agents: Tools define an AI agent's action space“The \textbf{direct impact} of an AI agent tool describes whether a tool permits perception, reasoning or action. Agents need \emph{perception tools} to access and read data, \emph{reasoning tools}…”Open source ^[13][13] Characteristics of AI agents: Tools define an AI agent's action space“Tool \textbf{generality} describes whether the tool enables interaction with narrow, constrained or general, unconstrained environments. \emph{Narrow-purpose tools} enable agents to fulfil tasks in…”Open source. Neither label establishes its task consequentiality. The paper’s stakes measure maps tools to occupations rather than measuring realized harm; on that proxy, most action tools support medium-stakes occupations, while finance is an outlier with disproportionately many action tools in high-stakes occupations ^[24][24] How widely are AI agents used across task domains?“We find most action tools support medium-stakes occupations such as computer systems administration, with relatively few tools for low-stakes or high-stakes tasks (Figure ~\ref{fig:stakes-occupatio…”Open source.

A Coinbase cryptocurrency transfer tool and a file editor are both action tools: each can modify an external environment. Ranking them by that label alone therefore produces a tie, even though the supported decisions have different stakes. Direct impact identifies what kind of operation a tool permits; it does not identify what or whom the resulting decision can affect ^[11][11] Characteristics of AI agents: Tools define an AI agent's action space“The \textbf{direct impact} of an AI agent tool describes whether a tool permits perception, reasoning or action. Agents need \emph{perception tools} to access and read data, \emph{reasoning tools}…”Open source.

The study adds task consequentiality by mapping the work behind each tool. Its top-down classifier first assigns a tool to one of $12$ broad ONET categories, then to one of $400$ intermediate clusters, and finally to one of $18{,}796$ occupational tasks. This hierarchy makes the search tractable because the complete task list does not fit in the classifier’s context window ^[25][25] Assessing width of use across tasks“We use a three-level hierarchical classification approach originally proposed by Anthropic \citep[see Appendix][]{handa2025which}. We prompt the LLM to first allocate the tool into one of 12 high-l…”Open source. For the Coinbase example, the method asks which ONET task best matches the transfer operation; it does not infer stakes from the cryptocurrency label alone. Existing O*NET crosswalks then connect the selected task to Standard Occupational Classification occupations ^[26][26] Assessing width of use across tasks“For comparability to other studies, and consequentiality assignment we map tasks to occupations, using existing crosswalks from O*NET bottom-level tasks to the Standard Occupational Classification…”Open source.

The occupation supplies the missing variable. O*NET asks workers what results their decisions usually have for other people or for an employer’s reputation or financial resources. The study uses this decision-impact response as a proxy for the stakes of occupations supported by published tools ^[27][27] Assessing width of use across tasks“To assess risk, we mapped the amount of published tools to consequentiality of different tasks and occupations using O*NET impact data. The O*NET survey \citep{onetonlineWorkContext} identifies the…”Open source. The transfer tool therefore receives a stakes signal through its mapped occupational work, not merely because it can move cryptocurrency.

That chain preserves an important uncertainty. Human validation supports the broad task categories better than the highly specific lower levels, so the analysis emphasizes aggregated task domains and occupations rather than pretending that every fine-grained assignment is exact ^[16][16] Detailed human validation results“Assignment at lower hierarchy levels is less reliable due to the extreme specificity of O*NET tasks and broader remit of many MCP tools (e.g. the agreement between GPT-5 and Sonnet 4.5 at \textless…”Open source. The impact scale is also comparative rather than a calibrated quantity; the paper calls its absolute values imprecise ^[28][28] How widely are AI agents used across task domains?“Absolute values are meaningless and imprecise, thus the axis labels are omitted.”Open source. Even with those limits, the distribution separates the cases that the action label merged: most action tools map to medium-stakes occupations, while finance has disproportionately more action tools among high-stakes occupations than the overall pattern predicts ^[24][24] How widely are AI agents used across task domains?“We find most action tools support medium-stakes occupations such as computer systems administration, with relatively few tools for low-stakes or high-stakes tasks (Figure ~\ref{fig:stakes-occupatio…”Open source.

The Coinbase tool illustrates both the value and the limit of public metadata. Its availability can flag a capability for financially consequential action, but it cannot establish whether transfers occurred, at what volume, or in what user context. The paper therefore treats tool monitoring as an early signal for targeted interviews and usage-data investigation, not as direct observation of agent behavior or systemic risk ^[29][29] High-stakes example: Anticipating autonomous transaction trends via MCP tools“In line with Appendix~\ref{app:monitoring}, deeper monitoring of agent tools for accessing the financial system could inform targeted requests for interviews and usage data investigation.”Open source.

A Coinbase MCP wallet appeared on GitHub in January 2025 before its official release in April, making public tool monitoring an early signal ^[30][30] Methods for monitoring agent use“GitHub release of Coinbase MCP wallet in January 2025, official in April 2025”Open source. But the signal is thin: public-tool usage statistics have limited precision and make specific user groups difficult to identify ^[31][31] Methods for monitoring agent use“Usage statistics limited to non-caching downloads, difficult to identify specific user groups”Open source. Publication shows available capability, not that a transfer occurred. Waiting for later deployment evidence avoids that inference, but loses the early signal.

The obvious shortcut is to turn the early signal into a behavior estimate. That fails because package downloads proxy ecosystem interest and count installations, not tool calls ^[17][17] Usage of MCP servers“Package downloads serve as a proxy for ecosystem interest rather than a direct measure of runtime execution. This metric counts installation events (e.g., initialising an agent environment) rather…”Open source. Use the first rung only to prioritize follow-up where an action capability, an uptake signal, and task stakes coincide. For the Coinbase wallet, publication identifies a financial tool; rising downloads would strengthen the case for investigation, not estimate transaction volume. This rung ranks attention. It does not measure realized harm.

Once a case is selected, interviews and surveys can supply use-case context that public tools lack, while provider or firm usage data can link recorded use to accounts or user groups ^[31][31] Methods for monitoring agent use“Usage statistics limited to non-caching downloads, difficult to identify specific user groups”Open source. The paper proposes using financial-tool monitoring to inform targeted interview requests and usage-data investigation ^[29][29] High-stakes example: Anticipating autonomous transaction trends via MCP tools“In line with Appendix~\ref{app:monitoring}, deeper monitoring of agent tools for accessing the financial system could inform targeted requests for interviews and usage data investigation.”Open source. More broadly, it positions surveys, interviews, and usage data as later methods for deepening early tool-monitoring signals ^[32][32] Discussion: What do these tool use findings tell us about the risks of AI agents in different domains?“Tool monitoring is particularly helpful for answering early, explorative questions on use, in the absence of clear critical public use cases. Later, surveys, interviews and usage data can be used t…”Open source. But recorded use still does not show what happened in the external payment system.

Where the stakes justify it, move to action-level monitoring in the external system. For the Coinbase example, that means observing agent-attributable payment flows rather than inferring them from repositories. Relevant measures could include the agent share of transactions, concentration by market segment or time window, correlated activity, and indicators of payment-system stress ^[33][33] Limitations and future work“Future work should expand to \emph{agent systems} and their usage to track the orchestration of agent tools including autonomy; and \emph{agent actions} measuring actual agent actions in external s…”Open source ^[34][34] Limitations and future work“This could track: (1) agent actions as share of total transactions; (2) concentration in specific market segments or time windows; (3) correlation patterns; (4) early indicators of payment system s…”Open source. Those observations can support claims about behavior and systemic exposure that tool metadata cannot.

Report each rung with its own verb: a repository reveals available capacity, downloads indicate ecosystem interest, interviews establish reported context, private logs measure recorded use, and action traces establish observed behavior. Public tools therefore provide broad, early evidence that agents’ capacity to act is expanding; layered follow-up preserves that lead without relabeling capacity as conduct. That is how oversight can extend beyond model outputs while staying inside the evidence.