Yes — the incumbents are shipping MCP servers: a Sep-2026 map of first-party MCP, from GitHub and Stripe to Google Workspace, Salesforce and Blender

Research date: 10 Sep 2026 (GitHub API snapshots 10–11 Sep). Every case carries the vendor URL it was verified against; press-reported items are labeled and collected in the caveats. “First-party” here means the vendor publishes the server itself — a docs page on its own domain and/or a repo under its own org. Companion articles: codex-blender-control-2026-09-10.md, computer-use-landscape-2026-09-07.md, codex-mcp-server-pattern.md.

TL;DR

• Yes. By 2026, shipping a first-party MCP server has become the default way an incumbent software vendor makes itself agent-accessible — and it is no longer a dev-tools-only phenomenon: Google Workspace, Microsoft 365, Salesforce, Slack, Notion, Linear, Zapier and X all ship or preview one, alongside the developer platforms (GitHub, GitLab, Atlassian, Cloudflare, Vercel) and the creative apps (Adobe, Blender, Autodesk, Unreal, Houdini).
• It went remote. The 2025 pattern was a local stdio server; the 2026 pattern is a vendor-hosted Streamable HTTP endpoint with OAuth — mcp.stripe.com, mcp.supabase.com, mcp.atlassian.com/v2/mcp, *.googleapis.com/mcp/v1, docs.x.com.
• Vendors keep the wheel. Read-only switches, project scoping, OAuth scopes instead of API keys, human confirmation for writes, and admin allow/block lists are now standard vocabulary — though read-only is rarely the default, so the safe configuration is opt-in.
• Why they bother: distribution (your server shows up inside ChatGPT/Codex/Claude/Cursor without you writing a client), governance (you can audit what the agent did), and displacement of community servers you can’t control — one of which (the popular community Figma server) shipped a remote-code-execution CVE in Oct 2025.
• Counter-currents are real: Elastic deprecated its own server for a product endpoint, JetBrains absorbed its proxy into the IDE, Atlassian forced a v1→v2 migration (deadline 2027-03-01), Microsoft is de-emphasising Playwright MCP in favour of CLI + skills for token efficiency, and several incumbents compete with their own agent rather than an MCP endpoint.
• Who’s still out: no first-party MCP for npm/PyPI registries, none found for Fly.io, Apple ships MCP frameworks for developers but nothing for its own consumer apps, and Google Workspace’s official servers are still a Developer Preview.

1. What counts as “first-party” — and why the distinction is the whole question

The MCP ecosystem has two populations that look identical in a client’s tool list:

• Vendor-shipped: e.g. Figma’s own Dev Mode MCP server (figma.com/blog), Blender’s official server from the Blender project (blender.org/lab/mcp-server).
• Community-shipped: e.g. GLips/Figma-Context-MCP (~15.8k★) — popular, but not Figma’s; ahujasid/blender-mcp (28k★) — popular, but superseded in spirit by Blender’s own.

The 2026 trend line is community shape → first-party product: Blender built an official server next to a 28k★ community one; JetBrains deprecated its standalone proxy once the capability moved into the IDE; Elastic deprecated its own repo in favour of an endpoint inside Agent Builder. That is the strongest signal that this is a vendor strategy, not a hobbyist phenomenon.

2. Developer platforms, dev-tools, infrastructure

3. Enterprise SaaS and productivity — the cohort that “has no API culture”

4. Creative, 3D and media apps

Covered in depth in the companion article codex-blender-control-2026-09-10.md. The short version — every one of these is programmatic, none is screenshot-driven:

Adobe/Affinity/Blender/Boris FX/Foundry/SideFX/Unreal per NVIDIA’s SIGGRAPH 2026 write-up; Fusion/SketchUp/Ableton/Splice/Resolume per Claude for Creative Work. Unity’s Claude Code plugin is press-reported (10 Sep 2026).

5. Operating systems and browsers

• Microsoft ships a registry, not a pixel driver: MCP on Windows / On-device Agent Registry (“a secure, manageable interface to discover and use agent connectors”), default connectors including a File Explorer MCP server, servers “contained in a separate environment by default”, per-agent access control via Settings/Intune, plus App Actions as Windows’ App-Intents analogue. MCP on Windows · App Actions
• Apple ships MCP for developers, not for its own apps: App Intents, on-screen awareness, and MCP + the Agent Client Protocol in Xcode 27 (GitHub and Figma first). newsroom, 8 Jun 2026
• Google ships chrome-devtools-mcp (51.6k★) and co-edits WebMCP — the spec that lets a website publish tools so agents stop parsing pixels: “web pages that use WebMCP can be thought of as Model Context Protocol servers that implement tools in client-side script.” Spec (Draft CG Report, 9 Sep 2026) · implementation status: ChatGPT Desktop supported, Chrome 149 / Edge 150 origin trials, Brave experimental, no Firefox/Safari.

6. What they expose, and the guardrail vocabulary

• Read-mostly, writes opt-in: Notion, Linear, Grafana (--disable-write), MongoDB (--readOnly), Neon (?readonly=true), Supabase (?read_only=true), Microsoft 365 Copilot connectors (read-only).
• Real write surfaces: Stripe (stripe_api_write), GitHub (issues/PRs), Atlassian, Salesforce (sobject-all), Google Workspace (drafts, uploads, events, chat), Zapier.
• The sentences vendors now write: “Enable human confirmation of tools” (Stripe); “Always review and authorize actions requested by the LLM before execution” (Neon); deletes “only after explicit user approval” (Dynamics); OAuth-code-only so “the human stays at the wheel” (Salesforce); org-wide allow/block with Defender tracing (Microsoft); MCP policy disabled by default (GitHub).

7. Five patterns worth naming

1. Remote-first + OAuth. Hosted endpoints are the norm; local stdio survives mainly where the target is the local machine (browser drivers, IDE plugins, some DB/observability tooling).
2. Registries as a second product. Official MCP Registry (registry.modelcontextprotocol.io), GitHub’s github.com/mcp, Docker’s hub.docker.com/mcp with SBOM/provenance, plus vendor connector directories inside ChatGPT/Codex/Claude.
3. Community → first-party absorption. The security argument is concrete: the community Figma server — not Figma’s — shipped a remote-code-execution CVE-2025-53967.
4. Lifecycle management arrives. Atlassian v1→v2 migration (deadline 2027-03-01), Salesforce servers off by default, Dynamics’ static MCP server retiring 2026-10-01. MCP endpoints now have deprecation policies, like any API.
5. MCP is not always the answer — even for its authors. Microsoft’s Playwright MCP steers agents to playwright-cli + skills for token efficiency; Adobe, Salesforce and Meta compete with their own agents (Firefly agent, Agentforce, Muse) rather than only an endpoint.

8. Caveats

• Press-reported, not vendor-verified here: Atlassian GA (2026-02-04), Datadog GA (2026-03-09), MongoDB Atlas-managed MCP launch, Docker catalog launch, Slack’s two blog posts, Unity’s Claude Code plugin, and ServiceNow (its site timed out for this sandbox — treat as unverified).
• GitLab docs are behind a bot challenge; facts were read from GitLab’s own GitHub mirror doc sources. The canonical URL was not opened directly.
• Star counts are live GitHub API values from 10–11 Sep 2026 and move daily; they are not comparable across Gitea/GitHub or across project ages.
• “No official server found” statements (npm, PyPI, Fly.io, Apple consumer apps) are absence of evidence, not vendor denials.
• Zapier’s usage numbers are vendor marketing on the product page, not audited figures.
• Microsoft Learn pages intermittently render an “access requires authorization” banner while still serving content; the Work IQ overview is explicitly (preview).