86,000件の Claude Code / Codex / Cursor 拡張を調べてわかったこと A survey of 86,000 Claude Code, Codex, and Cursor extensions uncovers key MCP ecosystem tr…

A recent large-scale survey examined roughly 86,000 extensions built for three of the most widely used AI coding tools — Claude Code, OpenAI's Codex, and Cursor — in an attempt to map the shape and maturity of the ecosystem forming around the Model Context Protocol (MCP). The analysis matters because these extensions increasingly determine how much real work developers can hand off to AI agents, and a data-driven view of what actually exists helps separate genuine capability from marketing.

To understand the study, it helps to know what MCP is. The Model Context Protocol is an open standard, introduced by Anthropic in late 2024, that defines a common way for language-model applications to connect to external tools, data sources, and services. Instead of every editor or agent inventing its own plugin format, MCP specifies a client-server interface in which an AI client can discover and call "tools," read "resources," and use predefined prompts exposed by a server. That standardization is what makes a cross-tool comparison meaningful: an MCP server written for one client can, in principle, be reused by another.

The three tools sit in slightly different niches. Claude Code is Anthropic's command-line agent for editing codebases and running tasks. Codex refers to OpenAI's coding agent lineage, now offered as an agentic tool rather than the original 2021 model. Cursor is an AI-first editor built on the VS Code foundation, popular for inline completion and chat-based refactoring. Each supports extensions or MCP integrations, though their configuration formats, permission models, and marketplaces differ, which complicates any attempt to count and categorize them consistently.

The survey's headline figure — around 86,000 extensions — is best read as evidence of rapid, sometimes chaotic growth rather than a precise census. Analyses of this kind typically find a heavy long-tail distribution, where a small number of widely adopted extensions account for most real usage, while the majority see little traffic, few updates, or appear to be experiments, forks, and near-duplicates. If that pattern holds here, it would echo what earlier plugin ecosystems, from browser add-ons to VS Code extensions, have shown: sheer volume is not the same as depth.

By category, the extensions likely cluster around a familiar set of developer needs. Connectors for GitHub, databases, file systems, web search, documentation retrieval, and issue trackers tend to dominate, because they map directly onto everyday coding workflows. A study like this can also surface quality signals — how many extensions are actively maintained, how many carry documentation or tests, and how concentrated authorship is among a handful of prolific publishers or vendors. Those metrics are useful proxies for whether the ecosystem is consolidating around dependable building blocks or still fragmenting.

Security and trust are the areas where such surveys are most valuable, and also where caution is warranted. Because MCP servers often run with meaningful permissions — reading local files, executing commands, or reaching external APIs — the risk surface grows with each installed extension. Independent researchers have repeatedly flagged concerns such as prompt injection, over-broad tool permissions, and unvetted third-party servers. A dataset of this size can help quantify how common risky patterns appear to be, but readers should treat any single study's numbers as directional rather than definitive, since methodology, deduplication choices, and the fast-moving nature of these registries all affect the counts.

The broader context is an industry racing to standardize agent tooling. Beyond MCP, related efforts include OpenAI's function-calling conventions, emerging agent-to-agent communication proposals, and vendor-specific plugin stores. The fact that a survey can now span Claude Code, Codex, and Cursor together suggests MCP is becoming a de facto interoperability layer, even if adoption and implementation quality vary widely across tools.

For developers, the practical takeaway is to weigh popularity and maintenance over raw availability, to audit permissions before installing, and to favor extensions from identifiable maintainers. For the ecosystem as a whole, the study appears to reinforce a familiar trajectory: an early phase of explosive, uneven growth that will likely be followed by consolidation, clearer curation, and stronger security norms as the tooling matures.