Originally published at curatedmcp.com/blog/week-2026-35

MCP Ecosystem Week 35: When Developer Demand Outpaces Your Allowlist

The MCP ecosystem continues its quiet consolidation around official integrations and developer-led adoption. This week brought no new catalog additions, but the usage patterns tell a clear story: your developers are already running—or want to run—servers you may not have formally approved yet. For platform and security teams, that gap between demand and governance is the real story.

This Week in MCP

No new servers were risk-classified this week. The catalog holds steady at 73 human-reviewed, risk-classified servers—a signal that we're moving past rapid growth into deeper integration patterns. If you're managing MCP allowlists across Cursor, Claude Code, Windsurf, and GitHub Copilot, focus this week on audit: which of your developers' tools are already connecting to the most-viewed servers without formal policy? The answer will likely surprise you.

On the Radar

Five official integrations dominate developer demand:

GitHub Copilot MCP and GitHub MCP (combined 174k views) unlock deep code intelligence and repository control. Governance consideration: these servers read repository contents, manage pull requests, and trigger workflows. Before allowlisting, clarify: Can developers initiate CI/CD via MCP? Who audits the audit logs? GitHub's built-in RBAC helps, but MCP bypasses some IDE-native controls.

OpenAI MCP (87k views) lets developers call GPT-4o, DALL-E, Whisper, and Embeddings directly from their MCP client. Red flag: token spend opacity. Developers can now burn OpenAI credits without submitting them through your normal procurement or cost-tracking flow. You need visibility.

Figma MCP (82k views) and Anthropic Claude MCP (76k views) are lower-risk but carry different considerations. Figma MCP reads design tokens and component metadata—useful, but ensure your design system is either public or that Figma workspace permissions are enforced at the token level. Claude MCP nests Claude within Claude for specialized reasoning; it's a legitimate tool, but developers sometimes use sub-agents to bypass your main Claude spend policies.

Governance Take

Here's what you're actually facing: Shadow MCP usage is already happening, and your IDE logs don't capture it uniformly.

A developer in Cursor using GitHub Copilot MCP, another in Windsurf using OpenAI MCP, and a third in Claude Code using Anthropic Claude MCP—they're all accessing external services, burning tokens, and reading/writing to your company's systems. Your SSO covers authentication, but not what they're doing after they authenticate. Your firewall logs won't show the individual MCP calls. Your GitHub audit logs will show the outcome (a merged PR) but not whether it was human-reviewed or agent-generated.

Start here: Inventory your current MCP usage across all four IDE platforms. Use per-machine enforcement to block everything except a minimal allowlist. Then add back servers one at a time, with clear governance rules:

• GitHub Copilot MCP & GitHub MCP: Require code review on any PR opened via MCP. Log the agent context.
• OpenAI MCP: Route through TokenShield for spend visibility—you need to see whether developers are burning credits on image generation or embeddings, and whether your cost profile matches your actual workload.
• Figma MCP & Anthropic Claude MCP: Allowlist by team. Design and specialized reasoning are lower-risk, but scope matters.

The servers aren't the problem. The gap between what your developers want and what you've formally governed is.

---

Govern MCP usage across your team with CuratedMCP — or scan your own stack free at https://www.curatedmcp.com/auditor.