YC startups are skipping the API and shipping an MCP server

Key findings

1. 43 of the 119 sampled YC companies with an MCP server (36.1%) show no public API we could find.
2. 36.2% of the 1,261 YC companies in the 2025 and 2026 batches serve an llms.txt, up from 23.3% of the 909 companies in the 2012 to 2017 batches.
3. The public API share barely moves across batches: 22.0% of a 2012-17 sample and 22.7% of a 2025-26 sample, with a high of 28.7% in 2022-23.
4. MCP servers go from 10.7% of the 2012-17 sample to 16.0% of the 2025-26 sample, close to the 22.7% of the same sample with a public API.
5. 81 of the 5,630 reachable YC domains (1.4%) are listed in the official MCP registry. Only 18 of the 119 sampled MCP servers are listed there.

We expected the newest companies to lead on all three. Most of them build on language models and sell to developers, so a public API seemed the obvious first step and llms.txt and MCP the later ones. The llms.txt column does rise with every batch group. The API column does not. In the newest batches an llms.txt is more common than an API, and an MCP server is nearly as common.

By batch group

The llms.txt and registry columns cover every reachable domain in the group. The API and MCP columns come from a random sample of 150 per group, so each of those cells carries about 6 points of error either way. Read the batch to batch steps in those two columns as noise. The one gap that holds up is pooled: 10.4% of the 450 sampled companies from 2012 to 2021 have an MCP server, against 16.0% of the 450 from 2022 to 2026.

Generated files fall with batch age: 4.6% of 2012-17 domains serve an llms.txt written by Yoast, Shopify, Wix or another tool, against 1.1% of 2025-26 domains.

MCP servers without an API

Of the 203 sampled companies with a public API, 37.4% also run an MCP server. Of the 697 without one, 6.2% do. That second group surprised us. Pave, Storylane, WayUp and Instrumentl answer on an MCP endpoint or document one, and we found no public API docs for any of them. 70.6% of the MCP companies also serve an llms.txt, against 22.2% of the rest.

Among the best-known YC companies, Supabase, PostHog, Zapier, Amplitude, Webflow, Mux and Exa list servers in the official registry, and Deepgram, Flexport and Lattice document one on their own sites. Zepto, Human Interest, Stoke Space, Orange Health Labs and Papa showed no public API in our checks. All five sell to consumers, employers or launch customers, where an API would be unusual.

Data funnel

How we counted

llms.txt presence comes from the 2026-09-04 crawl behind our llms.txt report, with one change: 32 files that open with Wix's template line now count as generated. A company has a public API if its homepage links to /api, /developers, /docs/api or an API reference, or if a docs., developers., developer. or api. subdomain, or /docs, serves a page on its own host with API reference markers (API keys, endpoints, curl, OpenAPI). A company has an MCP server if an mcp. subdomain or /mcp answers with JSON-RPC or an MCP page, if /.well-known/mcp returns JSON, if its homepage, docs or llms.txt names its MCP server, or if the official MCP registry lists a server under its domain. We fetched the subdomains and paths on 2026-09-23 through a rotating proxy. 17 sampled sites whose only MCP evidence was a Wix or Shopify template line are counted as having none. We hand-checked 20 random positives and 20 negatives for each flag, fixed each rule that failed, and drew again. MCP took three draws: the first two caught a help-center page and a customer portal on mcp. subdomains, a JSON error at /.well-known/mcp.json, an llms.txt telling readers not to assume an MCP server, a product that connects to other people's servers, and blog headlines about MCP security. The third draw had no errors. The first API draw had one false positive and the second had none.

Limits: every flag is a floor. We miss API docs hosted off the company domain, such as on GitHub Pages or a vendor portal, and docs sites that render only in JavaScript; Formance is one we know we missed. The API and MCP numbers are from samples, and one crawl on one day tells us what is live, not when it went up.

Dataset

data.csv has one row per domain with batch, flags and the evidence behind each positive; README.md and METHOD.md sit next to it. Data: CC BY 4.0, Installmap, 2026-09-23. Next to any number here, cite: Source: Installmap, September 2026.