{
 "slug": "dependency-floor-maintainer-concentration",
 "url": "https://stillosdigitalholdings.com/findings/dependency-floor-maintainer-concentration",
 "question": "Who actually controls the packages the whole MCP ecosystem is built on top of?",
 "headline": "41 of 90 dependency-floor packages have a single maintainer — 19 individuals hold all of them.",
 "cite_as": "45.6% of the npm packages beneath the MCP ecosystem have a single maintainer, and 19 individuals control all of them (Still OS Digital Holdings LLC, dependency-floor census, n=90 packages, as of 2026-10-26).",
 "numbers": {
  "Dependency-floor packages resolved": "90",
  "Single-maintainer": "41 (45.6%)",
  "Distinct individuals holding all single-maintainer packages": "19",
  "As of": "2026-10-26"
 },
 "method": "The packages that recur as direct or near-direct dependencies across the live MCP population are resolved to their current npm maintainer set. A package with exactly one maintainer is counted as single-maintainer; the union of those maintainers is the control set. Counts are of resolved packages only — unresolved ones are reported separately, never assumed clean.",
 "producers": [
  "/home/marcus/state/mcp-census/chokepoint-maintainer-history.jsonl"
 ]
}