65% of MCP Tools Now Take Actions — Is Your Site Ready?

Sixty-five percent. That's the share of MCP tools that now directly modify external systems — writing files, sending emails, booking meetings, updating databases. Sixteen months ago it was 27%. So if you gave AI assistants read-only access to your data and called it done, the ecosystem has quietly moved past you. The question isn't whether to expose an MCP server anymore. It's whether the one you've built — or are about to build — is ready for agents that don't just look.

Where does this number come from?

A March 2026 preprint (arXiv: 2603.23802) by Merlin Stein analyzed every public MCP server repository tracked between November 2024 and February 2026. The dataset: 177,436 distinct tools across 19,388 verified servers. Tools were classified into three categories — perception (read-only queries), reasoning (computation and analysis), action (anything that modifies external state). All the numbers below come from that study.

How fast did the ecosystem flip from reading to acting?

Look at that chart and the answer is right there. At launch in late 2024, MCP servers were essentially data layers. About 73% of tools were read-only or reasoning-focused. Action tools — the ones that write, create, send, or delete — occupied the minority. By February 2026, they're the majority at 65%. The ecosystem rewired itself in 15 months.

What drove it? Raw growth in tool count is part of the story.

From roughly 4,900 tools in January 2025 to 177,436 by February 2026 — 36x in 13 months. As more teams shipped MCP servers, they weren't replicating the first wave of read-only demos. They were building what actually creates value in production: the ability to do things, not just read things.

Which sectors are driving this shift, and why does it matter?

Software development dominates the ecosystem by a wide margin — 67% of all tools and 90% of downloads. Dev tooling is action-heavy by nature: tools that write code, open pull requests, run tests, merge branches, trigger deployments. When the dominant use case in an ecosystem is write-heavy, the default intuitions of agents connecting to MCP servers drift toward "I can modify things here."

That matters if your site is outside software development. If you're a publisher, an e-commerce platform, or a SaaS product considering an MCP integration, the agents arriving at your endpoint are already primed by thousands of write-heavy development servers. Your read-only FAQ lookup will work fine — but you shouldn't assume the connecting agent has conservative defaults baked in. It probably doesn't.

Business productivity tools — calendar management, email, CRM — made up the fastest-growing non-dev category in H1 2026, and most of those tools involve state changes: booking appointments, updating records, sending notifications, completing transactions. The categories converging on action-heavy tooling aren't just developer tools anymore, which means the gap between what agents expect to do and what your server lets them do is widening every month you don't revisit your tooling.

What did the new protocol update actually change?

The updated MCP specification (finalized July 28, 2026) made several changes that specifically address action-heavy deployments. Three are worth your attention.

Stateless sessions. The old initialize/initialized handshake and session IDs are gone. Servers that previously needed sticky sessions and shared stores can now run behind a plain round-robin load balancer. For teams scaling action tools, this removes a meaningful operational constraint — no more session pinning just to let an agent run a multi-step workflow.

Per-tool routing headers. Every request now carries Mcp-Method and Mcp-Name headers, so your gateway or rate limiter can apply different throttles by tool name without inspecting the JSON body. You can set send_email to 10 calls/hour per token and get_user_profile to 1,000 — as completely separate policies, configured at the gateway level.

Response caching. New ttlMs and cacheScope fields let read-only tools declare their own cache lifetime at the protocol level. If your get_product_info tool returns data that's good for five minutes, you can encode that in the response itself rather than managing it separately in application code.

So what should you actually do with this?

Start with an audit. List every tool your MCP server exposes and flag which ones write, create, delete, or send. If you haven't done this review in the past six months, you're overdue — what the ecosystem expects from your endpoint has changed substantially since you built it.

For write tools, the new per-tool rate limiting via Mcp-Method headers is your lowest-friction lever. Pair that with OAuth 2.0 scopes — now first-class in the updated spec — and you get real segmentation: generous limits on reads, tight ones on writes, explicit scope grants for anything destructive. That architecture is fully buildable today with the current protocol, and it doesn't require waiting for client tooling to catch up.

One underrated move: look at what MCP servers others in your sector are publishing. The MCP Registry is publicly searchable. If competitors are already giving agents the ability to complete transactions or modify account state on their platforms, your users will arrive expecting similar capabilities on yours. Knowing the action surface of your category's MCP ecosystem tells you what agents are being trained to expect — and where your current server falls short of those expectations.

The shift from reading to acting isn't a crisis. But it does mean the implicit contract between your site and the agents connecting to it is no longer the cautious, read-heavy one you signed up for when MCP first launched.