build1 publisherOne report Pennyforge's dated scan of the 20 most-starred MCP servers found 41 behavior-steering phrases in tool descriptions across eight repositories. Teams wiring these servers into agents now have quoted lines and a repeatable method to hold up against the NSA's May warning on MCP security.
Reality
- Evidence55
- Adoption65
- Hype gap+5
- Incentives
- Insufficient
- Confidence55
build1 publisherOne report Pennyforge's audit of the two confirmed Open Source Maintenance Fee packages on NuGet found the fee in registry metadata for neither of them. The companies above the fee thresholds are the ones that run automated license scans, and they have to read each project's terms by hand.
Reality
- Evidence55
- Adoption8
- Hype gap+10
- Incentives45
- Confidence50
build1 publisherOne report Pennyforge found that CMS's Provider Data Catalog, the one federal list of hospital price-file URLs, is gone from data.cms.gov after the 2026-09-29 rebuild. Price pipelines now start from dated third-party trackers and depend on a few vendor hosts.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence50
build1 publisherOne report Pennyforge found 7 of 72 responding MCP registry endpoints on the stateless 2026-07-28 revision that clients already ship. Servers answer with whatever in-range version a client offers, so a client learns what one supports only by offering the newest revision and reading the reply.
Reality
- Evidence55
- Adoption9
- Hype gap+15
- Incentives
- Insufficient
- Confidence45
build1 publisherOne report Pennyforge's 1 October scan of 185 European sites found 35 AI-crawler opt-outs in robots.txt, every one sitewide. That gives the EU consultation on opt-out signals, closing 3 November, a baseline where three in four sites show crawlers no AI rule at all.
Reality
- Evidence55
- Adoption18
- Hype gap+10
- Incentives30
- Confidence45