Research
Only 37.2% of MCP Applications Gate Tool Execution Behind Human Approval — Study of 1,723 Repos
An empirical study posted 2026-07-28 (arXiv 2607.25635) mined 1,723 MCP-consuming applications from GitHub and characterized how they configure servers, communicate, and handle human oversight — the first large-scale look at the application side rather than the server side. The ecosystem has converged on file-based server configuration (85.2%) and official SDKs (81.1%), but no naming convention has emerged for config files. Human oversight is the weak spot: logging (90.8%) and enable/disable controls (77.2%) are common, but only 37.2% put a blocking approval step in front of tool execution, meaning in most MCPApps the model can invoke any enabled tool unconditionally.
↳ Follow the thread