30,000+ downloads: what shipping 21 safe-by-default MCP servers taught me

The dockndevai MCP suite just crossed 30,000 downloads on npm: 30,185 across 21 servers, with about 8,000 a month still coming in. I also posted the announcement on LinkedIn. Here's what the suite is, what the number does and doesn't mean, and what I'd tell someone building their own. What it is 21 open-source Model Context Protocol servers that let AI agents operate real systems: Kubernetes, OpenShift, Kafka, ClickHouse, Debezium, PostgreSQL (Percona), Grafana, Azure, OCI, Keycloak, GitHub Enterprise, Outlook and Teams, macOS, Android and iOS, plus a RAG server over your own documents. One governance model across all of them The point was never "an agent can touch your cluster". It's "an agent can touch your cluster and you stay in control": Read-only by default. Write and admin tools aren't even registered until you raise the access mode, so the model never sees them. Allowlists and protected resources. Scope to specific namespaces, databases, orgs or projects. Protected ones can be read, never mutated. Destructive ops are double-gated. Admin mode, plus an explicit opt-in flag, plus a typed confirmation, plus a human approval prompt via MCP elicitation. Dry-run, JSON audit log, secret redaction. Optional local risk guard. laya-guard classifies risky commands allow / confirm / block with an on-device model, and can only ever tighten. All 21 are built on one shared library, mcp-core: one audited implementation instead of 21 that slowly drift apart. What "30,000 downloads" actually means Downloads are not users. npm counts every install event, including CI re-installs, registry mirrors and security scanners. I can see the inflation directly in my own data: for mcp-laya on PyPI, excluding mirror traffic cuts the count by roughly 64%. So I treat the ~8,000-a-month trend as a better signal than the cumulative total, and the number of humans is some fraction of either. Three things I'd tell someone building their own Make the safe path the default, not a setting. Almost nobody changes defaults, so the default is your actual security posture. Don't advertise tools the current mode can't run. Hiding them is stronger than refusing them: a tool the model can't see is a tool it can't be talked into using. Check what "published" means on your registry. The newest server, mcp-github-enterprise, hit npm's staged publishing: npm publish reported success, but only a 0.0.0-stage placeholder was public until a maintainer approved the release with 2FA. Patch-bumping doesn't help; npm stage approve does. Try one claude mcp add kubernetes -e K8S_MODE="read-only" -- npx -y @dockndevai/mcp-kubernetes``` Everything is on one page at [dockndevai.github.io](https://dockndevai.github.io), and the code is at [github.com/dockndevai](https://github.com/dockndevai). Feedback and issues very welcome, especially on the governance model.