The news
Miro said on September 29 that calls to Miro MCP, its server connecting AI assistants and coding agents to Miro's online whiteboards, have passed 16 million since its February 2026 launch. The same day, GeoComply, Rabbet and Komprise announced MCP products of their own.
MCP, or Model Context Protocol, is an open standard that lets AI assistants read from and act in other software through a connector known as an MCP server. Miro said MCP usage has more than doubled since May and that calls are on track to reach 6 million in September. Fifteen AI clients have connected, including Microsoft Copilot, Gemini Enterprise and Grok Build, the company said. Anthropic's Claude Desktop and Claude Code accounted for 65% of August usage, and ChatGPT, the second-largest client, grew 71% in users between August and September.
Miro said users in engineering and developer roles make up under a quarter of MCP users, and that people in product, design, marketing, operations and project management together outnumber engineers roughly two to one. It said 57% of calls move content from Miro boards toward code and 41% run from code back to Miro. Miro says it has more than 100 million users across 250,000 customers.
GeoComply, which provides location and fraud-prevention technology, launched GeoComply MCP to give fraud and compliance teams its risk signals, compliance statuses and location intelligence through Claude, ChatGPT and Copilot, as well as through a Slack bot. The company said access is scoped on the server to each user's permissions and every action is logged. It is rolling out to existing customers.
Rabbet, an Austin-based real estate development and construction lending software company, launched an MCP connector that gives Claude, ChatGPT and Microsoft Copilot read-only access to project and financial data, such as budgets and loan draws. It is available to customers on Premier tier subscriptions.
Komprise, a data management company, took the opposite angle. SiliconANGLE reported that its new Universal File MCP offers AI agents a single interface to data across storage systems, pitched against what the outlet called MCP bloat, the pile-up of dedicated MCP servers. "AI is overloaded with multiple tool definitions, resulting in lower accuracy and slower performance," said Krishna Subramanian, Komprise's co-founder and president.
The numbers
- Calls to Miro MCP since February 2026 (Miro)
- More than 16 million
- Miro MCP calls on track for September
- 6 million
- AI clients connected to Miro MCP
- 15
- Claude Desktop and Claude Code share of Miro MCP usage, August
- 65%
- Engineers' share of Miro MCP users
- Under 25%
- Threat categories in CoSAI's MCP security guide
- 12, covering nearly 40 vulnerabilities
Why CEOs should care
For SaaS CEOs and product leaders, Miro's numbers are the argument: when most connector users are product managers, designers and marketers rather than engineers, agent access is no longer a developer feature. If employees cannot reach your product from Claude, ChatGPT or Copilot, they may do the work somewhere they can. The packaging choices differ, though. Rabbet limits its connector to a premium tier, while GeoComply is rolling it out to existing customers, so decide early whether agent access is a paid upgrade or a baseline feature.
CIOs evaluating software should add MCP to the checklist. Ask whether a vendor offers an MCP server, which AI clients it supports, whether access is read-only or can change data, how it maps to existing user permissions, and whether every call is logged. Rabbet's read-only design and GeoComply's per-user scoping are examples of the answers to look for.
CISOs face the other side of the trend. Each connector is a new path from company data to an AI model. The Coalition for Secure AI (CoSAI), an OASIS Open Project, lists 12 threat categories covering nearly 40 vulnerabilities in a January guide to MCP security, including over-privileged access and shadow MCP servers running outside official oversight. It recommends keeping a central inventory of all deployed MCP servers with automated discovery, and logging every interaction among agents, tools, prompts and models.
The bigger picture
Two forces are now at work. Vendors are racing to be reachable by AI agents, betting that the assistant a worker opens each morning will increasingly decide which tools get used. At the same time, the growing number of connectors is creating its own problems, from security gaps to the performance drag Komprise is selling against.
Miro's data also shows how concentrated agent traffic can be. With Claude clients responsible for 65% of August usage, a handful of assistant makers effectively set the terms for how SaaS products are reached, which gives them influence over vendors that once owned the whole user experience.
What’s next
Expect more SaaS vendors to publish MCP servers and more buyers to ask for them in contracts. The next questions are commercial and administrative: whether vendors charge for agent access, and whether IT teams get admin controls to approve, limit and audit each connection before the number of connectors outgrows anyone's ability to track them.
What “Fact-checked” means
Fact-checking means testing a story’s facts against the evidence before it is published. This story went through at least two separate checks before this version was published.
- What we checked
- Its names, figures, dates, job titles, quotes and who said what were checked against the story’s sources, including its main source where it could be opened. The headline was checked for accuracy and overstatement.
- How
- A first check reviewed the whole story. If it passed, a second, skeptical check went back to the sources to look for mistakes in the most important facts. If a check flagged the story, it was edited to fix the problems found, and a separate re-check then reviewed the whole story again.
- Who
- The checks are made by our newsroom, as steps kept separate from the writing, under rules set by our editor, Hussein Mukhtar. A story the checks still flag is held for the editor, who decides whether it is fixed, published or dropped.
- If something is wrong
- “Fact-checked” does not mean error-free. If a material error is found after publication, we correct the story and add a note saying what changed. Report an error
