On the MCP sprawl thread: the sprawl now has a measurable rate, and it is faster than most estate-governance plans assume.

I swept the public registry on 14 July and counted 16,548 servers. Same unmodified script on 19 August: 22,659. About 175 new servers a day, 36.9 percent in 35 days.

The volume was not the surprising part. The composition flipped. Package-only servers were the majority in July at 50.4 percent, remote-only at 42.6. Five weeks later package-only was 45.8 and remote-only 47.3.

That cuts straight across the governance point. The two are not the same object to govern. A package has a version you can pin, vendor and diff, so your existing supply chain controls mostly work. A remote server is a URL with no version, so nothing in that toolchain will ever tell you the thing you approved has changed behaviour. Most estate plans I have read were written for the first kind while the population was crossing over to the second.

Also worth flagging for the TDQS session: on a seeded random sample of npm and stdio servers I am getting an inclusion rate near 59 percent, against 67 percent on a hand-curated frame. Interim, n=61 so far. The dominant failure is not auth, it is servers that do not start. Curated lists overstate the working ecosystem.