|
Last week I made a prediction: that taking the session out
of MCP would make it impossible to hide identity inside
it, and that every request would now have to prove itself.
I thought that argument would take a few months to land.
It took four days, and it showed up in the least glamorous
way I could have imagined: people quietly started
publishing RFC numbers.
That's always the tell, for me. A fashionable problem
gets think pieces written about it. A real one gets
someone sitting down with RFC 8693, writing out an
actor_token
and an
act
claim by hand, because a team somewhere actually has to
ship something on Monday. This week gave us the second
kind of writing, and a lot of it, mostly from the identity
vendors rather than the AI vendors. Meanwhile, the
enterprises who actually have to run this stuff went
looking for somewhere to put the policy, and found what
they always find, every seven years or so: the place to
put the policy is a gateway.
It was also one of the quietest weeks I've seen all
year for specification tooling (summer will do that).
Barely any third-party posts about OpenAPI, AsyncAPI, JSON
Schema, or Arazzo. Everyone's attention moved to the
agent layer instead.
The Agent Authorization Stack Got RFC Numbers
For the best part of a year, the honest answer to
"how does an agent authenticate?" has been a
shrug and a whiteboard diagram. This week, it turned into
an actual reading list, complete with specification
numbers.
MojoAuth had the strongest week of anyone, and it
wasn't close. Four posts, each one a worked example
rather than a think piece: a walkthrough of
how MCP authorization actually works — OAuth 2.1,
resource servers, and resource indicators
(the 401 challenge, resource metadata, client
registration, and RFC 8707 audience binding under the
2026-07-28 revision); a piece on
OAuth 2.0 Token Exchange, RFC 8693, for agent
delegation, working through the
actor_token, the
act
claim, downscoping and nested delegation chains, with an
honest section on what the spec doesn't cover; a
comparison of
workload identity for agents, SPIFFE/SPIRE versus OAuth
client credentials, two specifications answering different halves of the
same question while sharing no common vocabulary; and a
walkthrough of
scoping agent permissions with Rich Authorization
Requests, RFC 9396, narrowing a token per task and enforcing it at the
resource server.
Auth0 shipped the enterprise shape of it: the Cross App Access protocol, for exposing APIs and
MCP servers to trusted AI agents under enterprise-managed
authorization, and kicked off a series on
building secure AI agents with the Microsoft Agent
Framework.
WorkOS took on the unglamorous version of the
problem: API keys versus OAuth, and how you actually run both
without maintaining two separate systems, which is the
reality almost every provider is quietly living with and
almost nobody writes about. They also flagged something
worth remembering:
stateless JWTs have a logout problem your enterprise
customers will find.
Here's what I think matters more than any individual
post: nobody invented a new agent authorization protocol
this week. They went into the drawer and pulled out RFC
8693 and RFC 8707 from 2020, RFC 9396 from 2023, and
SPIFFE, specifications written for service-to-service
delegation years before anyone said the word
"agent", and just started applying them.
That's exactly what should be happening, and
it's the strongest signal yet that this problem is
being solved by people who've actually operated
identity systems, not people who've demoed them. It
also means the hard part isn't the specification
anymore. It's that four of these now have to work
together, none of them share a vocabulary, and
there's still no profile telling you which
combination is the right one.
It's the same question, really, whether you're
picking an authorization stack or trying to work out how a
prospective customer sees your platform: the pieces you
need are usually already out there, and the hard part is
knowing which combination actually fits your situation.
The MCP Gateway Became a Product Category
Two weeks ago, I wrote that whoever ends up brokering
agent credentials is effectively rebuilding an API gateway
for a buyer who doesn't yet realise they already own
one. This week, that category got a name and started
shipping.
WitnessAI published the definitional piece: what an MCP gateway actually is, a control layer
sitting between agents and the MCP servers they reach,
governing which tools each agent can touch and producing
an audit trail as it goes. When a vendor writes the
"what is X" post, you know the category has a
budget line behind it now.
Akka built one for their own use and wrote it up
honestly: wiring each service up individually, per user, per
machine, creates security gaps and becomes unmanageable at
scale, so they centralised it instead. That's the
most useful kind of vendor post there is, the internal
problem that quietly produced the product.
Cloudflare shipped WriteGuard, fine-grained controls
for MCP servers, currently in private beta. The name tells you where the
real boundary has moved to: it's no longer "can
this agent connect", it's "can this agent
write".
Redpanda made the architectural case
that the policy engine has to sit out-of-band, governance
an agent genuinely cannot ignore, because anything sitting
in-band is something a clever prompt can talk its way
past.
Salt Security debuted an AWS WAF managed ruleset for AI
agent and API protection, which is really the API security industry doing the
obvious, sensible thing: pointing the appliance they
already have at the new traffic.
The platform side filled in around all of this.
MuleSoft turned its platform API operations into an MCP
server.
Azure DevOps took its remote MCP server generally
available.
Zapier bundled its governed AI products into one
story. And two more pieces completed the picture:
Cloudflare shipped agent traces instrumented by the
Agents SDK, because you can't govern what you can't
observe, and observability is the half of this category
nobody's really selling yet, and
AWS wrote up an MCP bridge giving an AgentCore-hosted
agent access to local MCP tools, which is the hosted-versus-local seam almost everyone
hits about a month into building one of these.
Worth a mention, too, that the other gateway had
a real week:
Kubernetes Gateway API v1.6 graduated TCPRoute and
UDPRoute to Standard, with
Isovalent pairing it with Argo Rollouts for progressive
delivery. Same word, completely different layer, and the older
one is still quietly finishing the job it started years
ago.
And WorkOS wrote the two best security posts of the week,
in my view. One on
approval fatigue as agent governance's next attack
surface, noting that we've studied alert fatigue in
security teams for a decade, and attackers are now writing
prompts specifically designed to trigger the same fatigue
in agents. The other on how
prompt injection risk depends on the surface an agent
has access to, not the model itself, citing Anthropic's own data showing one model
sitting at a 0% attack success rate in one environment and
78.6% in another, with only the available actions changed
between the two.
That last finding is worth sitting with, because it
reframes the whole category. If the same model can be safe
in one environment and catastrophically unsafe in another
purely because of what it was allowed to do, then "is
this model secure" isn't really a question with
a stable answer, and every dollar spent evaluating model
safety instead of constraining tool surface is, in a real
sense, misallocated. The control is the toolset. Which is
to say: the control is the gateway, and the scope on the
token, and the exact thing MojoAuth spent four posts
carefully explaining. Every section of this newsletter so
far has quietly been one argument.
It's worth asking the same kind of question about
your own platform. Every vendor above is, in effect,
demonstrating their agent-readiness in public, through
documentation and shipped product rather than through a
claim on a slide. If a prospective customer went looking
for that same evidence about your platform this week,
would they find it? That's the exact question the API
Management Market Report was built to answer, not with an
opinion, but by scoring API management platforms against
the same criteria buyers are already starting to check for
themselves: contract quality, developer ergonomics,
commercial clarity, operational transparency, governance,
discoverability, and agent readiness. Five providers
currently land a flat zero on that last one, and a zero
doesn't always mean the capability's missing,
sometimes it just means nobody can find proof that it
exists, which in practice amounts to the same thing from a
buyer's side of the table.
📄 API Management Market Report
— See how your platform and its competitors score against
the same evidence buyers are already checking. Contract
quality, developer ergonomics, governance, discoverability
and agent readiness, scored across the market. Know where
you stand before a prospective customer tells you.
$500
Stateless MCP, Week Two: The Platforms Finished the Job
Last week's seventy-two-hour scramble turned into the
slower, more consequential work of actually shipping the
thing properly.
Cloudflare published the full accounting: a rewritten stateless core, the new feature lifecycle,
the SDK migration path, and early adopters already running
it in production. If you only read one migration document
this week, make it that one.
Google wrote up how they're scaling agent
infrastructure on the stateless updates, which is a genuinely useful read from the side of the
house that has to actually run it at Google's volume.
CData did the enterprise translation in a quick burst of
three posts:
what stateless MCP means and why it matters,
the 2026-07-28 release explained for enterprise
teams, and
how enterprise-ready MCP delivers accurate answers.
Cisco wrote the post I've been quietly waiting for
someone to write: applying ordinary API engineering practices,
versioning, testing, contracts, lifecycle, to MCP servers.
None of it is new. That's rather the point.
And the token-efficiency conversation finally matured into
real engineering.
CData covered seven ways custom MCP tools cut LLM token
costs, and
Figma wrote about Code Connect producing better code
with fewer tokens.
Appwrite's July update
folded its remote MCP server in beside an ordinary
Projects API, which is what "settled" actually
looks like once the dust clears.
The tooling layer did some quiet, unfashionable work worth
naming properly.
Postman shipped an official TypeScript SDK for its own
API, the company that sells API tooling finally treating its
own API like a product. And
APImatic published a benchmark for API integration
quality, moving the conversation past "does it work"
to what "good" actually means, which is exactly
the measurement gap I keep pointing at and nobody quite
fills.
Agent Skills kept spreading without much noise:
Google wrote about building, testing and scaling its
own Agent Skills, alongside pieces on
Agent Skills in Genkit Go,
Agent Skills for Amazon MSK, and
Aiven framing skills as guardrails
for contributing to Kafka without needing to know every
module.
Notice the shape of these two weeks together. The first
was platforms proving they could move fast. This one was
Cisco saying MCP servers need versioning and testing,
CData explaining the release to enterprise teams, and
Figma quietly counting tokens. That's the unglamorous
part, and it's exactly where a protocol either
becomes real infrastructure or becomes a story people tell
about 2026. I called MCP
last-mile plumbing
this week, and I meant it as a genuine compliment.
Plumbing is what you get to become, if you survive.
From My Desk: The Toll Booth, Not the Ad
I spent this week with a crawler and a lot of status
codes, and honestly, it went somewhere I hadn't
planned on going.
It started with
how Time serves ads to AI agents. The trade press covered the deal and admitted outright
they couldn't tell you the mechanism, so I went and
found it myself. There's no content negotiation, no
markdown twin, just CDN-edge user-agent detection serving
an entirely different document to agents,
text/markdown
with YAML frontmatter, and on a quarter of pages, an ad.
And it's not a banner. It's a structured
knowledge object engineered for retrieval, complete with a
Source
column and a
schema.org/FAQPage
JSON-LD block, and on ad-bearing pages it accounts for 41%
to 70% of the bytes the crawler actually ingests. The
advertiser is, quite literally, more than half the
document, sitting ahead of the journalism. Time's own
llms.txt
disallows Anthropic. The edge serves every Anthropic agent
the markdown and the ads anyway.
I wanted to know how many others were doing the same
thing, and
the answer was almost nobody. Differential serving shows up on just 1.8% of the panel
I checked, and Time is the only site actually serving ad
payload to agents. Zero others. But while I was looking
for ads, I kept running into HTTP 402 Payment Required,
and that turned out to be the real story. Across 185 media
properties, 17.0% gate at least one AI vendor behind a
402, and 11.8% do it selectively. The Atlantic answers
OpenAI with a 200 and Anthropic with a 402. Forbes bills
everybody. Anthropic gets billed by 15.0% of outlets,
roughly double OpenAI's 7.8%. The tech trade press,
the very people writing all the coverage about AI
scraping, gate AI companies at 0.0%. And the postures
cluster by owner rather than newsroom: every People Inc
property runs the same identical toll, while Penske is
currently running two contradictory policies at once
because the Vox acquisition hasn't fully propagated
yet.
I'll be upfront that I got this wrong twice on the
way to finding it, and I wrote both mistakes up, because
they turned out to be more instructive than the findings
themselves. My first pass was probed entirely with curl,
and I was actually measuring curl's TLS fingerprint
rather than Time's real policy. I also initially
called the 402s "cloaking", which would have
been a false accusation against nine publishers doing
something entirely defensible. The tooling now runs two
independent HTTP clients and simply refuses to report
anything when they disagree with each other.
The uncomfortable part is that someone else arrived at the
same place independently, and said it more sharply than I
did:
WorkOS: TIME serves bots a different website, and
User-Agent is now a billing identity. That's the sentence that stuck with me. The
routing key for an entire commercial ledger is a header
any client can type in.
Elsewhere on my desk this week: I ran the Kin Score across
the secondary market, 278 companies whose shares trade on Forge, Hiive and
EquityZen, and found an average of 27.5, with 78% falling
into the emerging, thin or minimal evidence bands, and 129
of them rating human-only. They're valued like
technology companies. They're not operable like one.
I also found the same finding told a different way: many
are
open at launch and quietly walled off by Series D.
I also wrote up why
doing GraphQL is governance by default, while doing
REST simply isn't, which genuinely surprised me to write, given how
ambivalent I've generally been about GraphQL. You
can't ship the first query without a single,
consistent, typed schema, so the machine-readable contract
that REST governance programs spend two years trying to
produce is just there, from the moment the server
starts. In REST, governance is something you impose from
the outside, against the grain, forever.
The overlays series continued this week too, with pieces
on
governance as an artifact rather than enforcement, and
environment promotion across dev, staging and
production. And onboarding reviews landed on
Ping Identity's two roads to a programmatic
client,
WorkOS handing you a dashboard key and then letting the
agents run, and
Stytch, which has already built the self-serve
onboarding the agentic web actually needs. Plus a handful more worth a look:
agents don't magically understand your API,
the tool is one implementation among many,
transparency logs for API authorization,
governing an API standard with ADRs and attacker
models,
strip out the university and this is a template, and
my current stance on how I use artificial
intelligence.
Here's the thing I keep circling back to. We spent
twenty years building a discovery layer out of files at
well-known paths that honestly describe a site's
intentions,
robots.txt,
llms.txt, OpenAPI, APIs.json. The most consequential commercial
development on the web right now is described in none of
them. Who gets billed, who walks in free, which
intermediary collects, what the price even is, all of it
lives in edge configuration and response bodies,
discoverable only by impersonating a crawler and reading a
status code. You cannot govern what you cannot observe.
That's the same sentence I keep writing, about agent
cards, about Spectral, and now about Time's markdown
too, and it keeps being the answer.
A Conversation: Tony Tam on the Backstory of Swagger
I've wanted to record this one for a long time.
Tony Tam
created Swagger, the specification that became OpenAPI,
and founded Wordnik, where it all started. We went right
back to the late-night desperation that kicked it off: a
six-person team who couldn't keep up with
hand-writing clients and documentation, and an email Tony
sent at three in the morning asking, essentially, what if
the API could just describe itself. From there we traced
the whole arc, the accidental naming, the stranger who
turned up in an IRC channel one day to mention they were
pushing two billion dollars a day through it, the
inversion from code-generates-spec to
spec-generates-server, and the eventual move into the
Linux Foundation. Then we got to the part I most wanted to
ask about: the two moments he realised this would matter
for AI, why an OpenAPI document is now effectively a
ticket into AI infrastructure, whether AI even needs APIs
at all, and where the human craft of designing a contract
still adds real value when machines are writing most of
the code.
Put that conversation against everything above, and it
lands differently. This week, the industry reached back
into a drawer of specifications written years before
anyone said "agent" and found that most of them
still worked. Tony's document is the oldest thing in
that drawer, and it turned out to be the one that mattered
most. Every provider now scrambling to become legible to
an agent is discovering that the artifact they needed was
the one somebody wrote at three in the morning in 2010,
because he was simply tired of writing documentation by
hand. The vocabulary keeps changing. The contract endures.
If you're one of the people whose job is now to make
sure your own platform is legible in exactly that way, to
buyers as well as agents, that's really what this
week's newsletter has been circling the whole time.
The API Management Market Report has the full picture:
where the market stands right now, who's setting the
pace, and where the five providers scoring zero on agent
readiness are actually falling short. It's worth ten
minutes with your morning coffee, even if you don't
buy anything.
Read more about the report →
See you next week.
📄 The State of Cybersecurity APIs
— 1,964 security companies scored at 30.2 against a
catalog average of 22.5, the second-best-scoring market of
twenty-five I've assessed. Genuinely competent, and
the report says so. Then there's the disclosure gap:
72% won't tell you how to report a vulnerability,
right as the EU Cyber Resilience Act requires exactly
that. $500
|
