The Distribution OS — Chapter 2 · AI Trends

▲ Anchored

Plugin = Distribution Channel

Why They're Protected

Strategic Signal

GitHub

Code lives on GitHub. The network, commit graph, CI hooks, team permissions — Claude reads and writes via MCP (112K installs), but cannot be GitHub. Every Claude Code user is now a GitHub API consumer at higher velocity.

Network effect is jurisdictional. Branch protection, Actions pipelines, and audit logs are governed by org policy. Claude is an agent on top, not a replacement below.

Claude amplifies GitHub's surface area. The install base reflects connection, not substitution.

Vercel

Claude does not run servers. Vercel handles deployment, edge functions, domain routing, SSL. The MCP plugin lets Claude trigger deploys and read logs — new capability for Claude, not a threat to Vercel's infrastructure.

Infrastructure is exempt from context absorption. Claude can reason about a deployment; it cannot execute one without Vercel's runtime.

Devs who deploy via Claude prompt are stickier Vercel customers. The plugin is a retention play.

Stripe

Payment rails are regulated infrastructure. Claude can help write integration code — it cannot hold funds, process transactions, or replace the compliance layer Stripe provides under PCI-DSS and global frameworks.

Regulatory moat is the deepest possible protection. The plugin makes devs ship payment features faster, which directly increases Stripe transaction volume. Perfect revenue alignment.

"I set up a payment flow in 12 minutes without once opening the Stripe dashboard. They got a new customer." — X, 18K impressions

Supabase / Firebase

37.4K installs for Supabase. The database is the source of truth — Claude can query, migrate, and scaffold against it, but the data lives in Supabase and is not portable to Claude's session at enterprise scale.

Data sovereignty and cost at scale. Enterprise databases cannot be kept inside a context window. The plugin is a productivity multiplier; the database is the system of record.

Every Claude Code session touching Supabase is a user who never considered switching.

Slack

Slack's value is the human communication network inside an organisation — years of context, decisions, and DMs. Claude's MCP reads and writes to Slack; it does not replace the team's fabric.

Human network effects compound over time. Enterprise IT governance (SOC2, HIPAA, eDiscovery) means Slack isn't being replaced by inference sessions.

Slack gains Claude as a power consumer of its API. New features will likely be MCP-native first.

~ Amplified

Gains Distribution, Faces UI Pressure

The Tension

Strategic Signal

Figma

45.3K installs. Figma as design source of truth — component libraries, brand tokens, design system governance — is irreplaceable at team level. But Figma as the place where individual design decisions get made is under pressure from Frontend Design at 277K installs.

Figma's moat is collaborative design system ownership, not individual creation speed. As long as teams need a shared design source of truth, Figma survives. Individual UI iteration is being absorbed.

Figma's MCP is both a distribution win and a competitive hedge. They are building toward agentic design tools themselves.

Atlassian

32.1K installs. Jira as enterprise system of record for software delivery — audit trails, compliance reporting, legal accountability — is deeply entrenched. But opening Jira to log a ticket is being replaced: "Claude, update that ticket to In Review."

Atlassian's enterprise agreements protect at the org level. Jira's data stays intact; engagement declines. Declining engagement weakens the qualitative case at renewal even when the data layer remains.

Block built 60+ internal MCP servers using Atlassian as a data backend. Jira becomes infrastructure, not UI.

Notion

24.6K installs. Notion as company wiki has more resilience than Notion as task manager. The wiki function requires human curation Claude can assist but not own. The task layer faces near-total pressure for smaller teams.

Notion's vulnerability is its identity: trying to be everything. The wisest move is leaning into being the persistent knowledge layer Claude reasons against — not competing on workflow speed.

Power users are already writing less in Notion and using Claude to surface content from it. Repositioning is visible.

HubSpot / ZoomInfo

CRM and sales intelligence platforms gain distribution via Claude — every sales email and prospect research task flows through Claude's MCP to their data. HubSpot's 200K+ customers and ZoomInfo's data moat (verified mobile numbers, intent signals) are not at existential risk.

The interaction layer (the CRM dashboard, the prospecting UI) is being replaced by prompts while the data stays put. Net-positive for near-term API revenue. Renewal conversations in 2027 will be harder when the champion who lived in the dashboard is gone.

Strengthen at the enterprise data layer while facing SMB seat compression. Pricing shift from per-seat to per-API-call is the adaptation path.

↓ Absorbed

Core Value Prop Replicable by Claude

The Mechanism

What Happens Next

Standalone Code Search

Codebase search and semantic navigation are now native Claude capabilities when combined with Context7 (158K installs) and language server plugins. The category was absorbed. Greptile's co-founder publicly confirmed repositioning around enterprise data compliance.

Claude's context window + full repo + language server semantics = the codebase search product. No separate UI, no separate subscription required.

Repositioning around data compliance, on-prem deployment, and regulated industries — the only escapes from context absorption.

Generic AI Copywriting

AI copywriting tools built on top of language models with no proprietary data, no network effects, no distribution advantage. Claude's base capability exceeds what these tools offered. Jasper raised at $1.5B on a product that is now a prompt.

The model layer was always the product. Once direct access became easy, the wrapper became overhead. New customer pipeline is the leading indicator — not existing ARR.

Category absorbed. Companies may survive as professional services or niche brand-voice tools.

Standup / Status Tools

Automated standup tools whose entire product is a scheduled prompt and a Slack post. Ralph Loop + Slack + Claude replicates this with more context and zero additional subscription cost.

Product is a prompt. No data moat, no infrastructure moat. The most direct examples of workflow-only products in the current ecosystem.

Absorption is already underway. These are sub-$5M ARR products with no structural defence.

↓ Under Pressure

↑ Rising

Integration / Glue Code Engineer

MCP standardises what was a $100K+ role at every mid-size tech company. Writing custom API connectors and webhook handlers is now a plugin install. The engineer who wrote the Linear-to-GitHub sync script now installs an MCP server instead.

Context Engineer

Gartner's designated next vital skill for AI-enabled development. Not prompt engineering — context engineering is the architecture of what an agent knows, when, and in what order. With 9,000+ MCP servers available, the context layer is now critical infrastructure needing dedicated ownership.

Prompt Engineer (standalone role)

The title peaked in 2024. By 2026, prompt engineering has been absorbed into context engineering and AI engineering broadly. Writing a good system prompt is a baseline skill, not a job title.

MCP Server Architect

Block built 60+ internal MCP servers in 2025 alone. Every enterprise building on AI needs someone who understands MCP server design, tool annotation, multi-tenancy patterns, and OAuth 2.1 flows. Demand is visibly outpacing supply.

SaaS UX Designer (PM-tool focus)

If the UI is not being opened, optimising it is a declining investment. Frontend Design at 277K installs signals where this energy flows: AI-generated UI, not crafted UI for a SaaS nobody opens.

Agent Orchestration Engineer

Multiple Claude Code instances in parallel, each with different plugin combinations for specialised tasks. Designing and maintaining these agent fleets is a new engineering discipline. Someone has to build the fleet.

QA Engineer → Agent QA Specialist

Test execution is becoming an agent activity. The QA engineer of 2026 evaluates whether the agent's tests cover the right thing — not writes the test scripts themselves. Playwright MCP at 79.6K installs confirms the direction.

AI Governance / Trust Engineer

Tool poisoning, prompt injection, OAuth token storage risks, and Confused Deputy attacks have all been disclosed in the ecosystem's first year. "Who is accountable for our AI?" is a board-level question. Governance officers are in demand at banks, healthcare organisations, and Fortune 500 companies.

The Acquisition Math

A Slack MCP integration reaching 50,000 installs on Claude is the equivalent of acquiring 50,000 engaged developer users at near-zero marginal cost. In enterprise SaaS, where CAC runs $500–$2,000 per seat in competitive categories, this is a significant arbitrage.

The qualifier: install intent is not revenue intent. A developer installing the Notion plugin is already a Notion user. The distribution play primarily benefits vendors with wide potential market but incomplete penetration.

Infrastructure vendors (Stripe, Supabase, Firebase) see a direct correlation between plugin usage and revenue. For UI-layer vendors, the attribution is murkier — and the long-term data on whether being a plugin increases or decreases subscription retention does not yet exist.

The Revenue Share Reality

Anthropic currently takes zero revenue share from plugin installs and zero commission from the Marketplace at launch. This mirrors the early AWS Marketplace model before tiered pricing tightened.

The platform risk is real: Anthropic controls the registry, the distribution surface, and the context in which vendors appear. They can deprecate a plugin, demote it in recommendations, or build the capability natively — as happened to standalone code search tools.

The strategic implication: become the data layer Claude calls, not the feature Claude ships. Infrastructure vendors with regulated data and network effects are the durable position. UI-layer features are perpetually at risk of being absorbed — either by Anthropic building natively or by community servers undercutting at zero cost.

Vendor Type	Plugin CAC Benefit	Revenue Attribution	Platform Risk	Net Verdict
Stripe / Supabase Infrastructure	Near-zero CAC for new developer onboarding at point of integration decision	Direct — each API call is billable. Plugin usage = measurable revenue event.	Low — Claude does not run payment rails or databases. Regulated moat holds.	Strong Win
GitHub / Vercel Dev Platform	Deepens engagement from existing users; increases API surface area adoption	Indirect but strong — more deployments, more Actions runs, more storage usage.	Low — code and deployment infra cannot be absorbed. Network effect is structural.	Clear Win
Figma / Atlassian Workflow Platform	High distribution to new user segments; top-of-funnel expansion is real	Ambiguous — seat count stable, but UI page views decline. Engagement metrics soften.	Medium — enterprise contracts protect revenue. Individual user engagement erodes quietly.	Net Positive, Monitor
Notion / Linear PM / Knowledge	Meaningful new developer exposure; installs from Claude users who were not customers	Weak — if users never open the UI, retention and expansion suffer despite data use.	High — core interaction (creating/updating tasks) is a pure context operation. Absorbable.	Watch Closely
HubSpot / ZoomInfo CRM / Intelligence	Significant — Claude used for sales tasks; MCP puts vendor's data at point of decision	Mixed — more API calls but UI engagement falls. Stickiness shifts to data quality.	Medium — data moat is real. Headcount compression at customer companies is the mechanism.	Transition Required

AWS in 2012

What It Commoditised

Servers, hosting, and compute — the physical layer of software deployment

The Developer Shift

Devs stopped caring about hardware. AWS became invisible infrastructure every vendor had to support.

The Distribution Moment

AWS Marketplace launched 2012. ISVs flooded in because AWS had the buyer intent and developer density.

Revenue Share Model

AWS charges 3–20% depending on category. This set the template for what platform economics look like once leverage accumulates.

Regulatory Response

Slow. AWS reached $60B revenue before serious antitrust scrutiny materialised.

Open Standards Play

AWS contributed to Kubernetes and OpenContainer as a regulatory hedge and ecosystem lock-in tool simultaneously.

Claude in 2026

What It Commoditises

The workflow and UI layer — the interaction surface of software sitting above infrastructure.

The Developer Shift

Devs stop caring about switching between apps. Claude becomes invisible workflow infrastructure every SaaS must support.

The Distribution Moment

Plugin registry launched Nov 2024. 9,000+ community servers in 16 months. Claude Marketplace launched Mar 6, 2026 at 0% commission.

Revenue Share Model

Currently 0%. No App Store tax. This changes as platform leverage increases. Marketplace launch is the first signal of how Anthropic builds commercial terms with partners.

Regulatory Response

Already accelerating. EU AI Act, Digital Markets Act, and data sovereignty questions are active now — not after $60B revenue. The cycle is 10x faster.

Open Standards Play

MCP donated to Linux Foundation (AAIF) Dec 2025. OpenAI, Google, Microsoft, AWS all co-founders. The regulatory hedge is happening in real time, in public.

Geography / Framework

The Specific Exposure

The Mechanism

Risk Level

EU — GDPR & Digital Markets Act

When a German enterprise uses Claude MCP to query their Notion workspace, EU personal data transits through US inference infrastructure. MCP's OAuth token storage creates GDPR Chapter V transfer risks at every session.

If Claude reaches DMA gatekeeper scale, it faces mandatory interoperability requirements, prohibition on self-preferencing, and data portability obligations. DMA enforcement is actively targeting AI assistants in 2026.

HIGH — Active. DMA designation process accelerating.

EU — AI Act (Aug 2026)

Plugins enabling high-risk AI use cases (hiring decisions, credit scoring, medical diagnosis) require conformity assessments. Most plugin authors have not conducted these. The 9,000+ community servers are in a legal grey zone.

Anthropic must risk-classify every plugin in the official registry under Article 6. The Aug 2026 full-enforcement deadline is four months away.

HIGH — Aug 2026 deadline. Most plugin authors unprepared.

China

Claude is not available in mainland China. Chinese AI vendors are building competing plugin ecosystems that will not be MCP-interoperable. The open standard is Western.

For Western SaaS vendors with China operations, this creates a fork: build for MCP and build separately for Chinese AI platforms. Integration-layer work that was supposed to be write-once now requires two incompatible standards.

MED — Fragmentation risk for global SaaS vendors.

US — Antitrust

The 0% commission model is currently benign from an antitrust perspective. If Anthropic begins to discriminate between first-party and third-party plugins — recommending Claude-native features over vendor plugins — the App Store antitrust template becomes directly applicable.

The Linux Foundation AAIF structure is designed to prevent this. Open governance, vendor-neutral steering committee, no single company with veto power. This mirrors AWS's open source strategy exactly.

LOW currently — revenue share introduction is the trigger to watch.

Hacker NewsDev Discourse

"MCP allows any client to dynamically discover and interact with any resource without custom glue code. Comparing it to local scripts is like calling USB a fad because parallel ports worked for printers. The power is standardisation: write once, support everywhere."

HN · Jan 20263.1K points

"The question isn't whether Claude Code competes with Linear or Notion. It's whether anyone will bother opening those UIs when Claude can do 80% of the job in context, without switching tabs."

HN · Feb 20261.8K points

"We built a codebase search integration. Twelve months later, Claude Code's native search and Context7 ate our primary value proposition. We're repositioning around enterprise data compliance."

HN · Jan 2026Greptile founder — confirmed pivot

"Donating MCP to the Linux Foundation is the single smartest regulatory move Anthropic has made. It's the same reason AWS contributed to Kubernetes. Open governance is an antitrust shield in plain sight."

HN · Dec 20252.6K points

Reddit / XCommunity Pulse

"We used to open five tools. Now we open Claude. The Figma MCP means I haven't switched to the design app in three days. The GitHub MCP means my PR dashboard has cobwebs."

r/ClaudeAI · Feb 20262.4K upvotes

"95% of MCP servers are garbage. The barrier to publishing one is basically zero. The official Claude registry is where the quality lives — but even there, quality varies wildly across 9,000 community servers."

r/mcp · Jan 20261.1K upvotes

"People are spinning up multiple Claude Code instances in parallel — one for frontend with Figma, one for backend migrations, one for security auditing. This is what a dev team looks like now."

X · Feb 202634K impressions

"The Linear MCP is an acquisition risk, not a distribution win. If devs live in Claude all day and never open Linear's UI, what is Linear's product actually selling? A data backend. That's a different business."

X · Dec 202551K impressions

Stack / GitHub / SubstackTechnical Depth

"The S in MCP stands for security. Hundreds of MCP servers online today are misconfigured. Tool poisoning, prompt injection via tool descriptions, OAuth token storage that gives attackers access to your entire stack — this ecosystem shipped fast and secured slowly."

Pomerium security blog · Jun 2025

"Block built 60+ MCP servers internally in 2025. The most important pattern: do not over-privilege your API tokens. One breach in MCP equals access to everything. Design for least privilege from day one."

Block engineering blog · 2025

"The Asana Confused Deputy vulnerability — where their MCP server cached responses without re-verifying tenant context — is the canary for enterprise multi-tenancy. Every SaaS vendor rushing to ship an MCP server is about to discover their auth model was built for direct API calls."

StackOne security analysis · Jun 2025

"Context engineering is the natural progression of prompt engineering. It's not about what you say — it's about everything the model knows when you say it. MCP is the protocol. Context engineering is the discipline."

Anthropic engineering blog · 2025

The Plugin Is the Means. Distribution Is the End.

Vendors are acquiring developer users at near-zero CAC at the exact moment those users are making build decisions. The question is whether the distribution gain outlasts the absorption pressure. For infrastructure vendors, it does. For UI-layer vendors, the math is less clear.

Four Outcomes, Not Two: Strengthened · Compressed · Repositioned · Absorbed

The binary disruption framing is analytically wrong. Strengthened: Stripe, GitHub, Supabase, Vercel, Snowflake, Harvey — infra and data vendors strengthened by Claude distribution. Compressed: Slack, HubSpot, Atlassian — distribution moats hold but SMB seat-count growth stalls and 2027–2028 renewals will be smaller as customer teams shrink. Repositioned: Notion, ReadMe, Outreach. Absorbed: Jasper, Mabl, Standup.ly — workflow-only products with no data moat. Headcount compression at customer companies is the leading indicator. Revenue contraction at renewal is the lagging one.

Context Engineering Is the New Senior Skill

Gartner named it. Anthropic defined it. Block is hiring for it. Context engineering — managing what the agent knows, when, and in what order — is the successor to prompt engineering and the peer of DevOps in organisational importance. Every enterprise with agentic workloads in production will need a context engineering function by 2027.

The Linux Foundation Move Is a Regulatory Hedge

Anthropic donated MCP to the AAIF in December 2025 — the same month the Digital Markets Act began targeting AI assistants for potential gatekeeper designation. Open governance under the Linux Foundation neutralises the antitrust argument and creates a multi-stakeholder defence. AWS did this with Kubernetes. The playbook is confirmed.

Notion and Linear Are the Bellwether

Both are beloved, technically excellent products whose core interaction surface (creating and updating tasks, writing docs) is a pure context operation Claude can perform without their UI. Their install counts suggest engaged power users — but the trend line matters more than the snapshot. Watch churn data, not MRR.

The EU AI Act Deadline Is August 2026

The full EU AI Act comes into effect in four months. Most MCP plugin authors — including vendors shipping official integrations — have not conducted the conformity assessments required for high-risk use cases. The 9,000+ community MCP servers are in a complete legal grey zone. This is the next governance crisis for the plugin economy.

The Security Layer Is Immature at Scale

Tool poisoning, OAuth token storage risks, Confused Deputy multi-tenancy bugs (Asana), and the MCP Inspector RCE vulnerability have all been disclosed in the ecosystem's first year. The speed of adoption has outpaced security practices. AI governance officers are not optional at enterprise scale.

Frontend Design at #1 Is a Category Signal

277K+ installs — more than Context7 (158K), GitHub (112K), and Figma (45.3K) combined. The market voted for AI-native design generation as a primary workflow. The category of standalone AI design generation has moved into Claude's plugin layer. Figma's presence is a hedge, not a counter-move.

The Revenue Share Clock Is Running — But Anthropic's Incentives Are Symbiotic, Not Adversarial

Anthropic takes 0% of plugin-driven revenue and 0% from the Marketplace at launch. This will not hold as platform leverage increases. The constraint: if Claude's commercial model damages HubSpot's unit economics, HubSpot deprioritises its MCP integration, plugin quality degrades, and Anthropic's routing value falls. The platform cannot extract rent from a degraded ecosystem. The likely commercial model is a tiered structure — premium placement, verified integrations, enterprise routing tiers — that taxes margin without breaking vendor unit economics. Vendors without switching costs are most exposed when that model arrives.

TheDistributionOS

The
Distribution
OS