The Pulse
AISI Finds AI Agent Tools Are Shifting From Reading to Acting
The UK AI Security Institute analyzed 177,436 public AI agent tools and found action-enabling tools gained share in downloads. The study flags growth in browser and computer-control tools, payment capabilities and AI-assisted tool developme
AI.info Team · Written with AI ·
AI agent tools that let systems change files, send messages or control browsers rose from 27% to 65% of tracked downloads over 16 months, according to a study published by the UK AI Security Institute on March 26, 2026. The analysis covers 177,436 tools built for the Model Context Protocol, or MCP, a standard that connects AI agents to services such as calendars, websites and software.
The findings mark a change in what developers are building and downloading: away from tools that mainly retrieve or analyze information and toward tools that let agents act on external systems. The study’s author, Merlin Stein, writes: “Notably, the share of ’action’ tools rose from 27% to 65% of total usage over the 16-month period sampled.”
“Notably, the share of ’action’ tools rose from 27% to 65% of total usage over the 16-month period sampled.”
Merlin Stein, “How are AI agents used? Evidence from 177,000 MCP tools”
Browser control drives the shift
Stein collected public MCP servers from GitHub and the Smithery registry, then classified the tools they exposed as perception, reasoning or action. Perception tools read information; reasoning tools analyze it; action tools modify an external environment, for example by editing a file or sending an email. An MCP server can provide several tools, and the study evaluates the capabilities of those tools rather than the behavior of any single AI system.
The download shift toward action was even stronger among tools released by registered commercial companies: their action tools rose from 21% to 71% of downloads over the same period. General-purpose tools, which can operate in less restricted settings such as the open web or a computer interface, increased from 41% to 50% of downloads. The paper says 94% of downloads for general-purpose servers involved action capabilities, including browser automation and arbitrary code execution.
Software still dominates, but payments are growing
The tool ecosystem remains concentrated in technical work. Software development and IT accounted for 67% of published tools and 90% of downloads, while 18% of tools addressed finance and business management. Most action tools mapped to medium-stakes occupations such as computer systems administration, using the study’s classification based on the US Department of Labor’s O*NET data.
Finance stood apart. Public MCP servers with payment-execution capabilities increased from 47 in January 2025 to 1,578 in February 2026, according to the paper. The researchers note a concentration in cryptocurrency-related tools, where transfers may be difficult to reverse. Those counts show that payment functions are being made available through public tools; they do not establish how many agents used them to make transactions.
Downloads are a proxy, not a record of actions
To track use over time, the study matched 3,854 servers, containing 42,498 tools, to download records from the Node Package Manager and Python Package Index. The authors treat downloads as an indicator of interest and adoption, not as a direct count of tool calls or completed tasks. A download may reflect setting up an agent environment, and the records omit private mirrors, direct source-code use and some remotely hosted tools.
The researchers also caution that their public-repository sample misses private company integrations and distribution channels outside the sources they tracked. Their estimates therefore describe a visible portion of the agent-tool ecosystem, not every tool available to deployed agents. That distinction matters: the study maps which capabilities are becoming easier to give agents, while leaving actual deployment and real-world outcomes for other forms of measurement.
AI agents are helping build the tools
The study found evidence of AI coding assistance in 28.3% of MCP servers and 36.3% of the tools they contained. Among newly created servers, the share with detected AI assistance rose from 6% in January 2025 to 62% in February 2026. Claude Code accounted for 68.6% of servers identified as AI-assisted, followed by Cursor and GitHub Copilot.
That estimate depends on traces in repository histories, such as AI tool configuration files, bot contributions or co-author records. The authors say this approach misses assistance that leaves no visible trace, including code copied from a web chat. The paper’s central measurement remains more concrete: in the tracked download data, action tools gained share while tools for reading and analysis lost ground.