Mozilla reposted this
MCP adoption is outpacing agent governance. in 21 months, monthly MCP SDK downloads grew from about 2 million to more than 110 million. public MCP servers grew roughly 500x over the same stretch. by march 2026, 28% of the fortune 500 were running MCP in production. yet only about 21% of companies say their agent governance is mature. identity is largely handled. MCP now requires OAuth 2.1 + PKCE, and A2A ships signed agent cards, so an agent can prove who it is. neither tells you what that authenticated agent is allowed to write, or where the data it touches is allowed to go. that’s the gap. agents are going into production faster than anyone is writing the rules for them. and the rules are what decides who’s in control. full data in Mozilla State of Open Source AI repost - link in the comments.