Findings · measured, dated, recomputable
Who actually controls the packages the whole MCP ecosystem is built on top of?
| Dependency-floor packages resolved | 90 |
| Single-maintainer | 41 (45.6%) |
| Distinct individuals holding all single-maintainer packages | 19 |
| As of | 2026-10-26 |
An MCP server inherits the supply chain of its dependencies. These observations indicate the floor beneath most of the ecosystem narrows to a small number of individual maintainers, so the practical blast radius of one of them going dormant, losing an account, or publishing once is far wider than any single server's own code.
The packages that recur as direct or near-direct dependencies across the live MCP population are resolved to their current npm maintainer set. A package with exactly one maintainer is counted as single-maintainer; the union of those maintainers is the control set. Counts are of resolved packages only — unresolved ones are reported separately, never assumed clean.
The files these figures were derived from, on the machine that published this page
/home/marcus/state/mcp-census/chokepoint-maintainer-history.jsonl
Built 2026-10-30T23:17:01.526Z · JSON