Millions of Agent SDK Downloads. How Many Real Customers?

Measured: seven packages, one dated snapshot

An agent can download a software library without ever finding a paying customer. A developer can build an agent that never reaches production. And a production service can complete a thousand useful tasks without making a single machine-to-machine payment. Those distinctions matter when the software industry uses package downloads to describe the arrival of an agent economy.

Developer registries offer one of the clearest public windows into how the infrastructure is spreading. Unlike self-reported deployment counts, they publish numbers regularly and expose historical records. But a download is an event, not a person, installation, company, working agent or sale. Machine Observer has been preserving those events as a separate measurement layer.

Machine Observer’s developer-data snapshot, recorded October 21, 2026 at 11:55:30 UTC, successfully retrieved counts for all seven packages it tracks. For the npm reporting week October 12–18, the recorded figures included 39,432,481 downloads of @modelcontextprotocol/sdk, the MCP TypeScript SDK’s original v1 package; 2,336,867 downloads of @a2a-js/sdk; 236,001 downloads of @x402/core; and 785,706 downloads of mcp-handler.

In the same snapshot, the separate PyPI Stats feed reported 65,372,845 downloads in its trailing week for the Python mcp package, 13,742,452 for fastmcp, and 77,315 for Python x402. The npm and PyPI figures have different collection mechanics and should not be added into one supposedly unified developer population.

Machine Observer’s first-party derived insight is the cross-registry comparison at that exact collection time. The original MCP TypeScript package registered roughly 167 times as many npm downloads as @x402/core during the same October 12–18 reporting interval. That ratio describes requests for two different packages. It does not mean MCP has 167 times as many developers, working agents, customers, or useful transactions. SDK architecture, dependency relationships, and package maturity vary.

The historical record adds a second useful view. For October 18, Machine Observer’s preserved official npm daily series shows approximately 7.14 million MCP TypeScript SDK downloads, 395,366 A2A SDK downloads, and 51,552 x402 core downloads. The site’s method keeps source-published days and revisions, with no filling in missing dates. That permits changes within a package to be examined without treating unlike download totals as a market-share survey.

What changed by October 28

Public npm package pages checked on October 28, 2026 displayed approximately 57.3 million weekly downloads for @modelcontextprotocol/sdk and 318,658 for @x402/core. This is a newer external read, not a fresh Machine Observer snapshot, and the displayed weekly windows move as the registry updates. It would be misleading to treat the difference from October 21 as a precise growth rate without preserving matched windows and collection timestamps.

The packaging itself is changing. The MCP maintainers now describe the old @modelcontextprotocol/sdk as the v1 maintenance line. The current v2 TypeScript release uses separate @modelcontextprotocol/server and @modelcontextprotocol/client packages. Their npm pages displayed approximately 13.3 million and 9.0 million weekly downloads, respectively, when checked October 28. Some dependency trees may use both; downloads across old and new packages cannot be summed and labeled new adopters. A serious adoption index needs to follow the migration explicitly.

Interpretation: distribution is ahead of attribution

The measured record shows intensive software-package distribution around agent protocols. It supports the claim that developers and automated build systems are pulling down agent infrastructure at scale. The record cannot tell us whether an MCP client called a useful tool, whether an A2A implementation completed a cross-agent task, or whether an x402 integration earned money from an independent customer.

Package managers repeatedly download dependencies in development, continuous integration, container builds, and automated deployment. One successful application may trigger many download events. A library may also be installed transitively, without the project author intentionally selecting it. Machine Observer’s historical methodology consequently treats registry counts as distribution signals rather than unique users.

This is also why software supply and economic demand belong on different dashboards. Published API prices are asking prices. A completed payment is evidence of settlement, but may be a test, a script, or a transfer between related parties. Verified delivery after a test payment confirms a narrower technical capability. Recurring external revenue requires evidence of unrelated customers choosing to pay repeatedly. No SDK download count establishes any of those later steps.

Hypotheses, not findings

Hypothesis 1: package growth precedes production usage. If the developer footprint is becoming operational infrastructure, independently measured callable services, successful authorized tool calls, and repeat external users should rise over time. Those data series would have to come from operator disclosures or carefully scoped probes, not download logs alone.

Hypothesis 2: the MCP v2 package split could distort apparent momentum. A decline in v1 downloads could simply reflect migration, while rising totals for server and client may double-count the same deployments. A family-level view with package-specific component lines could reveal the transition without claiming unique installs.

Hypothesis 3: payment libraries will be judged differently. MCP and A2A packages may be valuable even without a direct transaction. x402’s commercial proposition is closer to paid service delivery. For it, the more useful next measures are distinct external buyers, paid deliveries, repeat purchasing, refunds, and seller concentration, all with test activity removed or separately labeled.

What Machine Observer should measure next

The immediate improvement is methodological rather than promotional: track the full MCP v1/v2 package family, publish matched seven-day reporting windows, retain exact capture timestamps, and chart each package against itself before comparing protocols. Keep Python and JavaScript series separate. Pair the resulting developer signals with service availability and, where auditable, operator-reported external sales.

The agent economy is distributing its tools at extraordinary scale. That is a meaningful observation. Whether that distribution becomes durable commercial demand is the question the next generation of measurements must answer.