An Empirical Study of Model Context Protocol Applications
- ID: 10d11003
- arXiv: https://arxiv.org/abs/2607.25635
- PDF: https://arxiv.org/pdf/2607.25635
- 作者: Muhammad Hamza Arshad Majeed, May Mahmoud, Sarah Nadi
- 发布: 2026-07-28
- arXiv 分类: cs.SE
- 抓取时间: 2026-07-30
中文导读
从 GitHub 挖了1723 个 MCP 应用，发现生态在配置/SDK 上已收敛，但人工 oversight 严重缺失——只有 37.2% 在工具执行前加了 blocking 审批门。多数 MCP 应用里 LLM 能无条件调用任何已启用的工具。MCP 标准了连接工具的方式，但没规定谁来批。
为什么值得关注
1723 个 MCP 应用里只有 37.2% 有工具执行审批门；MCP 标准了连接，没标准 oversight
English Abstract
The Model Context Protocol (MCP) standardizes how large language model applications communicate with external tools, but leaves the application side unspecified: unlike traditional dependencies resolved through package managers, developers integrating MCP servers face no conventions for configuration, communication, or human oversight. This ecosystem is also under-researched, with existing work focused on servers rather than the applications consuming them. We conduct a large-scale study of 1,723 MCPApps mined from GitHub. We first derive MCPAppTax from a representative sample, then use an LLM-assisted pipeline to apply it across the full dataset, characterizing server integration across configuration, SDK use, and human-in-the-loop mechanisms. Our results show that the ecosystem has converged on some practices but not others: most MCPApps configure servers using files (85.2%) and use an official SDK (81.1%) to communicate with servers, yet no naming convention has emerged for configuration files. Human oversight diverges most, logging (90.8%) and enable/disable controls (77.2%) are common, but only 37.2% gate tool execution behind a blocking approval step, leaving the LLM able to invoke any enabled tool unconditionally in most MCPApps.