MCP's ceiling is the token bill, not the catalog: 75,000 servers nobody can afford to configure

The arithmetic is the whole argument. Ten servers at a dozen tools each is 120 tool schemas sitting in every request ^[5]; the meta-tool approach keeps five resident ^[7], roughly a 24-fold cut in what the model carries before it has heard the question ^[23]. That is a real saving and also a transfer. The schemas for the server you actually need still get loaded, only later, and `list_mcp_tools` pays for them with a live connect to that one server ^[7]. A fixed tax on every request becomes a variable cost with round trips attached: search, describe, list, then call.

The second-order effect is in the ranking function. The index merges four catalogs and boosts results by GitHub stars and npm downloads ^[8], with BM25 over MiniSearch rather than embeddings, which the author argues performs comparably for tool discovery at zero API cost ^[10]. His stated ranking problem is keeping the hundredth abandoned `gdrive-upload` clone out of the top five ^[11]. Accept that, and notice what it means: if the agent only ever sees five results, popularity counts become the distribution channel for tool use. Position, not availability, decides which server gets called.

Then there is the question of what "75,000" counts. Glama's index is about 75,000; PulseMCP lists about 22,000 ^[1][2] - a gap of some 53,000 records between two catalogs of the same ecosystem ^[24]. The author's own dedupe notes explain part of it: one server can appear as `io.github.acme/weather`, `pulse/weather-mcp` and `npm/@acme/weather-mcp`, with three different metadata shapes ^[20]. The headline figure is a count of registry entries, not of distinct working servers, and the sync work needed retry-with-backoff to survive npm's rate limits at all ^[18].

The security defaults cut against the premise in a way worth stating plainly. Spawning stdio servers via npx or uvx is off by default, and turning it on requires an explicit per-package allowlist, version-pinned ^[14]. So the model can search 75,000 entries and read a server's transports and env vars ^[7], but it cannot run a locally spawned one until a human has pinned that package by hand. Discovery is inverted; installation is not. Remote entries get an SSRF guard that refuses loopback, private ranges and the cloud metadata address ^[13], and downstream descriptions and results arrive labeled as third-party data, which the author says mitigates tool poisoning without solving it, because nobody has ^[16].

What is actually on offer, then, is not access to the ecosystem. It is a ranking over the ecosystem plus a standing refusal to execute most of it. That is a more defensible product than it sounds, and it is a different one from the existing gateways, which aggregate the servers you had already configured ^[21]. The constraint it addresses is a budget, not a directory, and budgets do not care how many entries the catalogs claim.