Foundational Adoption

Weight: 10%

Sources verified Dec 22

Why It Matters

You can't improve what you don't use. But adoption alone doesn't indicate maturity - it's table stakes. With 82-89% industry adoption in 2025, this dimension has decreased in weight. Gartner predicts 90% of enterprise software engineers will use AI assistants by 2028.

✓ Google DORA: 89% of organizations prioritizing AI integration; 76% rely on AI daily ⓘ

×

State of AI-Assisted Software Development 2025

Google DORA

The 2025 DORA report introduces the 'AI Capabilities Model' identifying seven practices that amplify AI benefits. The core insight is that AI is an 'amplifier' - it magnifies existing organizational strengths AND weaknesses. Key stats: 89% of orgs prioritizing AI, 76% of devs using daily, but 39% have low trust. The trust research is critical: developers who trust AI more are more productive, but trust must be earned through organizational support (policies, training time, addressing concerns). The 451% adoption increase from acceptable-use policies is remarkable - clarity enables adoption.

Key Findings:

• 89% of organizations prioritizing AI integration into applications
• 76% of technologists rely on AI for parts of their daily work
• 75% of developers report positive productivity impact from AI

Credibility: high

View Source ↗

✓ Qodo: 82% of developers use AI coding tools daily or weekly ⓘ

×

State of AI Code Quality 2025

Qodo

This is the most comprehensive 2025 survey on AI code quality (609 developers). The key insight is the 'Confidence Flywheel' - context-rich suggestions reduce hallucinations, which improves quality, which builds trust. The finding that 80% of PRs don't receive human review when AI tools are enabled is critical for our agentic_supervision dimension. NOTE: The previously cited 1.7x issue rate and 41% commit stats were not found in the current report.

Key Findings:

• 82% of developers use AI coding tools daily or weekly
• 65% of developers say at least a quarter of each commit is AI-generated
• 59% say AI has improved code quality

Credibility: high

View Source ↗

✓ JetBrains: 85% of developers regularly use AI tools for coding ⓘ

×

The State of Developer Ecosystem 2025

JetBrains

The 2025 JetBrains survey of 24,534 developers shows AI tools have become mainstream (85% regular usage). The 68% expecting AI proficiency to become a job requirement is critical for skill development. The finding that 19% save 8+ hours/week (up from 9% in 2024) shows productivity gains are real for power users. Key insight: developers want AI for mundane tasks but want control of creative/complex work.

Key Findings:

• 85% of developers regularly use AI tools for coding and development
• 62% use at least one AI coding assistant, agent, or code editor
• 68% expect AI proficiency will become a job requirement

Credibility: high

View Source ↗

✓ Gartner: 90% of enterprise engineers will use AI assistants by 2028 ⓘ

×

Gartner Magic Quadrant for AI Code Assistants 2025

Gartner

Gartner's 2025 evaluation positions GitHub Copilot, Amazon Q Developer, and GitLab Duo as Leaders. The 90% enterprise adoption by 2028 prediction is critical for our adoption dimension. The multi-vendor landscape supports our model_routing recommendations.

Key Findings:

• Leaders: GitHub Copilot, Amazon Q Developer, GitLab Duo
• Visionaries: Qodo, Tabnine
• By 2028, 90% of enterprise software engineers will use AI code assistants (up from <14% in 2024)

Credibility: high

View Source ↗

2025 Context

With agent mode now available across VS Code, JetBrains, Xcode, and Eclipse, adoption should include agentic interfaces, not just autocomplete.

Assessment Questions (6)

Maximum possible score: 26 points

○ Q1 single choice 4 pts

How many days per week do you typically use GitHub Copilot?

[0] Never / I don't have access

[1] Less than once a week

[2] 1-2 days per week

[3] 3-4 days per week

[4] 5+ days per week

✓ Google DORA: 76% of technologists rely on AI for parts of their daily work ⓘ

×

State of AI-Assisted Software Development 2025

Google DORA

The 2025 DORA report introduces the 'AI Capabilities Model' identifying seven practices that amplify AI benefits. The core insight is that AI is an 'amplifier' - it magnifies existing organizational strengths AND weaknesses. Key stats: 89% of orgs prioritizing AI, 76% of devs using daily, but 39% have low trust. The trust research is critical: developers who trust AI more are more productive, but trust must be earned through organizational support (policies, training time, addressing concerns). The 451% adoption increase from acceptable-use policies is remarkable - clarity enables adoption.

Key Findings:

• 89% of organizations prioritizing AI integration into applications
• 76% of technologists rely on AI for parts of their daily work
• 75% of developers report positive productivity impact from AI

Credibility: high

View Source ↗

✓ Qodo: 82% of developers use AI coding tools daily or weekly ⓘ

×

State of AI Code Quality 2025

Qodo

This is the most comprehensive 2025 survey on AI code quality (609 developers). The key insight is the 'Confidence Flywheel' - context-rich suggestions reduce hallucinations, which improves quality, which builds trust. The finding that 80% of PRs don't receive human review when AI tools are enabled is critical for our agentic_supervision dimension. NOTE: The previously cited 1.7x issue rate and 41% commit stats were not found in the current report.

Key Findings:

• 82% of developers use AI coding tools daily or weekly
• 65% of developers say at least a quarter of each commit is AI-generated
• 59% say AI has improved code quality

Credibility: high

View Source ↗

○ Q2 multi select 7 pts

Which Copilot interfaces do you actively use?

[1] Inline autocomplete suggestions

[1] Copilot Chat (IDE or GitHub.com)

[2] Agent mode (multi-file autonomous edits)

[2] Copilot Coding Agent (background autonomous tasks)

[1] Copilot CLI

Note: Agentic interfaces score higher as they represent the 2025 paradigm shift

✓ GitHub: Agent mode represents the 2025 paradigm shift ⓘ

×

GitHub Copilot Agent Mode Documentation

GitHub

GitHub Copilot's agent mode enables autonomous multi-file editing, allowing AI to plan and execute complex changes across a codebase without step-by-step human approval. This capability requires careful supervision practices since agents can introduce cascading errors across multiple files. Critical for agentic_supervision dimension - assessing how organizations manage autonomous AI coding.

Key Findings:

• Agent mode can edit multiple files autonomously
• Supervision best practices

Credibility: high

View Source ↗

✓ GitHub: Copilot CLI enables terminal-native agentic development ⓘ

×

GitHub Copilot CLI Documentation

GitHub

Copilot CLI brings agentic capabilities to the terminal, enabling natural language interaction with GitHub and code. Similar to Claude Code but with GitHub-native integration. Represents the shift toward terminal-based AI development workflows. Key for advanced workflow maturity assessment.

Key Findings:

• Terminal-native agentic development
• GitHub integration (repos, issues, PRs) via natural language
• Preview every action before execution

Credibility: high

View Source ↗

○ Q3 single choice 3 pts

When you use Copilot, how much of your coding session involves it?

[1] Rarely - only for specific stuck moments

[2] Some of the time - maybe 25%

[3] About half the time

[3] Most of the time - 75%+

Note: 75%+ usage no longer scores higher than 50% - excessive reliance can indicate over-trust

✓ METR: Excessive AI reliance may indicate over-trust ⓘ

×

Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity

METR

This is the most rigorous 2025 study on AI coding productivity. The RCT methodology (16 experienced developers, 246 tasks, $150/hr compensation) makes this highly credible. The 39-44 percentage point gap between perceived and actual productivity is the key insight for our trust_calibration dimension. This directly supports recommendations about not over-trusting AI suggestions and maintaining verification practices.

Key Findings:

• Experienced developers were 19% slower with AI
• Developers perceived 20% speedup (39-44 percentage point gap)
• Self-reported productivity may not reflect reality

Credibility: high

View Source ↗

○ Q4 single choice 3 pts

How many different AI coding tools does your team use?

[0] None

[2] One tool only (e.g., just Copilot)

[3] Two tools (e.g., Copilot + Cursor)

[2] Three or more tools

[1] No standardization - individual choice

Note: ~50% of teams use 2+ tools. Some diversity is healthy; too many creates inconsistency.

✓ Stack Overflow: Developers explore multiple AI coding tools rather than committing to one ⓘ

×

2025 Stack Overflow Developer Survey

Stack Overflow

2025 Stack Overflow survey shows continued adoption (84%) but declining trust (60% positive, down from 70%+). Key insight: developers are using AI more but trusting it less. 35% use Stack Overflow as fallback when AI fails.

Key Findings:

• 84% of respondents using or planning to use AI tools (up from 76% in 2024)
• 51% of professional developers use AI tools daily
• Positive sentiment dropped from 70%+ (2023-2024) to 60% (2025)

Credibility: high

View Source ↗

○ Q5 single choice 5 pts

Do you use MCP (Model Context Protocol) servers to connect AI tools to external data sources?

[0] Not aware of MCP

[1] Aware but don't use it

[3] Use standard MCP servers (databases, APIs)

[4] Use MCP with security review process

[4] Custom MCP servers for our workflows

[5] Use MCP with context optimization (disable unused servers to preserve context)

Note: MCP became industry standard in late 2025 (Linux Foundation/AAIF). Security review is critical. Context optimization (disabling unused servers) is a power user technique - MCP tools consume context on every request.

✓ Anthropic / Linux Foundation AAIF: MCP became industry standard in late 2025 under Linux Foundation AAIF ⓘ

×

Model Context Protocol Specification

Anthropic / Linux Foundation AAIF

Model Context Protocol (MCP) is an open-source standard providing a 'USB-C port for AI applications' - a standardized protocol for connecting AI systems to external data sources, tools, and workflows. MCP became an industry standard in late 2025, enabling composable, interoperable AI systems. Foundational for advanced AI development maturity - assessing MCP adoption indicates sophistication in AI tool integration.

Key Findings:

• MCP became industry standard in late 2025
• Protocol for connecting AI tools to external data

Credibility: high

View Source ↗

✓ Arthur Pro: MCP tools consume context on every request; disable unused servers ⓘ

×

Claude Code: Keep the Context Clean

Explains the hidden context cost of MCP integrations. Each MCP server's tools are injected into every prompt, consuming context window. Power users should disable unused servers and trim exposed tools to maximize available context for actual work.

Key Findings:

• MCP tools are injected into prompt on every request
• A couple MCP servers can eat 50% of context window before you type
• Disable MCP servers you don't use frequently

Credibility: medium

View Source ↗

○ Q6 single choice 4 pts

If you use MCP: Are you aware of MCP security risks (prompt injection, tool poisoning)?

[0] No - didn't know there were risks

[1] Vaguely aware

[3] Yes - we review MCP servers before use

[4] Yes - we have security policies for MCP

Note: April 2025 security research identified tool poisoning, cross-server shadowing, and prompt injection as MCP attack vectors.

✓ arXiv: 2025 security research identified MCP attack vectors ⓘ

×

Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions

arXiv

First systematic academic study of MCP security risks. Identifies attack vectors including tool poisoning, puppet attacks, rug pull attacks. 43% of tested implementations had command injection flaws. Critical for adoption dimension's MCP security awareness questions.

Key Findings:

• Systematic security analysis of MCP lifecycle (creation, deployment, operation, maintenance)
• 16 key activities identified with security implications
• Four major attacker types: malicious developers, external attackers, malicious users, others

Credibility: high

View Source ↗

✓ arXiv: Users struggle to identify malicious MCP servers ⓘ

×

Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem

arXiv

End-to-end empirical evaluation of MCP attack vectors. User study demonstrates that even experienced developers struggle to identify malicious MCP servers. Critical CVE with CVSS 9.6 shows real-world risk.

Key Findings:

• Four categories of attacks: Tool Poisoning, Puppet Attacks, Rug Pull Attacks, Exploitation via Malicious External Resources
• User study with 20 participants showed users struggle to identify malicious MCP servers
• Users often unknowingly install malicious servers from aggregator platforms

Credibility: high

View Source ↗