|
Identity and authentication answers who is calling. It does not answer how much you are allowed to do once you are inside, and many move forward with each wave of technology
pretending they are the same thing.
They are not, and the gap between them is exactly where
the over-privileged agent lives — the triage bot that
reads your issues, labels them, assigns owners, and holds
a token that could also delete the repository. Who granted
the triage bot it's priveleges, and who and when are
those priveleges audited and updated?
This week we began to see that gap closing, and it did not
close it with a specification. It closed it with products:
consent screens that ask for one task instead of one
account, scopes you can decline, enterprise admins
granting an agent access to a second application on a
user's behalf, and user identity carried intact from
the model all the way down to the artifact store.
|
|
A long row of many narrow individually-lit gates
replacing a single enormous doorway on a dark neon
grid, most of them closed and dark, only two glowing
open, with a stream of small angular light-vessels
sorting itself toward the two that are lit.
|
Consent Grew a Scope Selector
The whole week bends in one direction: from all-or-nothing
access toward the narrowest grant that will still do the
job, as enterprise begin to come up against the challenges
of authentication and authorization in the agentic age.
-
Cloudflare moved from all-or-nothing to task-based
OAuth consent, and the title is the entire argument. Consent has
historically been a question about
an account. Task-based consent makes it a
question about a job. They shipped the
mechanics alongside it — optional OAuth scopes across Cloudflare
Fundamentals on the 20th, and by the 22nd you can choose the OAuth scopes for Wrangler and
the Cloudflare API MCP server specifically. Two days from principle to the MCP
server. That is the fastest I have watched an
access-control idea reach a developer tool.
-
Auth0 published the setup and testing walkthrough
for Enterprise-Managed Authorization on an MCP
server — Cross-App Access, where the enterprise admin, not
the end user clicking through a consent dialog,
decides that this agent may reach that second
application. This is the piece every enterprise MCP
conversation has been missing. Consent-by-user does
not scale to ten thousand employees and it never did.
-
Clerk shipped custom OAuth scopes and Qovery shipped API Policy Tokens with full control
over permissions, built on Open Policy Agent. Different companies,
different stacks, same week, same realization: a token
that can do everything is a liability the moment a
machine is holding it.
-
WorkOS explained RFC 9470, the OAuth step-up
authentication challenge protocol — how a resource server asks
for more authentication mid-flight rather
than demanding maximum assurance up front. Narrow
grants and step-up are the same design: start small,
escalate on evidence.
-
Logto wrote the production token strategy for an
MCP server calling your API on behalf of users, which is the delegation problem stated plainly,
and Vercel showed how v0 authenticates to Snowflake
without ever exposing the user's OAuth token — a real implementation of the thing everyone else
is describing.
-
The propagation story ran through the big clouds
too. AWS Partner Central's agents MCP Server now
supports OAuth with AWS Sign-In, Bedrock AgentCore Gateway got a governance story
for agent tool access, and JFrog documented propagating user identity from AI
agents through AgentCore Gateway into Artifactory. Identity that survives the hop from model to
gateway to artifact store is the whole ballgame for
audit, and almost nobody had it a year ago.
What I like about this cluster is that it is unglamorous.
Nobody named a new protocol. They took OAuth — twenty
years old, boring, universally deployed — and made the
grants smaller. The agent era keeps discovering that the
answer was in the drawer the whole time.
|
|
One massive angular gatehouse straddling a dark neon
grid with a tall card-index tower built into its
side, hundreds of identical glowing tiles slotted
into open racks, streams of light-vessels entering
and each pausing at the tower before continuing
through.
|
MCP Registries Proliferate, and the Protocol Roadmap Comes
Into Focus
The MCP gateway became a product category, and this month
it started absorbing the things that used to sit alongside
it, expanding the MCP surface area, complexity, and
(hopefully) adoption.
-
Zuplo built an MCP server registry directly into
the gateway. The registry has been a separate concern all year —
a directory over here, a proxy over there. Putting the
catalog inside the enforcement point means discovery
and policy finally share a source of truth, which is
the argument I have been making about API catalogs
since roughly 2012.
-
Zuplo also argued MCP gateways should use your
existing authentication services rather than growing their own, which lands in the
same place as the whole first section.
-
Fastly took MCP to the edge, asking what changes when it runs securely in every
POP. Aurascape published a zero-bypass MCP gateway, where the interesting word is bypass — the
category has matured to the point that its failure
mode has a name. MuleSoft went one level up with one control plane to govern any gateway, and Saviynt argued AI agents need three of them.
-
Gravitee put a number on the composite-server
pattern: 67% less agent token burn. Their framing — the cheapest token is the one you
never send — is the first cost argument for gateway
consolidation I have seen that a finance team would
actually read.
-
Apify finished migrating its MCP server to the new
stateless spec, closing out a thread that ran across the network
three weeks ago. The platforms shipped stateless in
days; the individual providers are landing it now.
-
And the protocol itself moved. A new MCP roadmap went up. GitLab disclosed a critical remote code execution
in Serena, a popular MCP coding agent. A roadmap and a CVE in the same week is what
adolescence looks like for a protocol.
-
The sharpest piece of the week came from the Continuous Delivery Foundation: MCP connects tools,
CDEvents provides meaning, and syntactic message
passing is not interoperability. I have been circling this for months without saying
it that cleanly. MCP standardizes how a tool
is called. It standardizes nothing about what
the call means. We have solved the plumbing
and are congratulating ourselves for solving the
semantics.
-
Underneath, the ordinary adoption work kept
grinding: Camunda described three ways it speaks MCP and why
the direction matters, DatoCMS wrote up when to use Skills versus their
MCP server, NowNodes compared Agent Skills, MCP and llms.txt
for building on blockchains, and NVIDIA shipped SkillEvaluator for measuring agent
skill performance. Three different answers to "which surface
should I publish", and no consensus yet.
-
Outside the agent story, the GSMA Open Gateway initiative picked up IBM to push enterprise adoption of network APIs — a
reminder that the slowest-moving standards body in
this research is still moving.
📄 The API Rating Rubric, Explained — I shipped version 0.12 of the score this week and
published the six quality bands behind it, so here is the
whole methodology in the open. What each of the six facets
measures, why it carries the weight it does, what the
rubric deliberately refuses to look at, how to read
someone else's number without being fooled, and a
facet-by-facet playbook for moving your own — cheapest
wins first. Written for two readers: the provider who
wants their number to go up, and the analyst who needs to
defend a citation. ~14 pages. $25
|
|
Three smooth unmarked glowing toll-arches standing
side by side on a dark neon grid, each a different
colour, small angular light-vessels flowing steadily
through all three, while a fourth older arch stands
dark and barricaded with vessels curving away from
it.
|
Agent Payments Narrowed to Three Protocols, and the Front
Door Is Still Locked
I am doing a lot of work to understand what the agentic
front door looks like and adopt the latest standards
across APis.io and API Evangelist to demonstrate how these
payment protocols work, while also showcasing other
providers we have profiled, and the news coming from
across the space.
-
Formance put AP2, x402 and ACP side by side — the first comparison of the agentic payment
protocols I have seen written by someone who has to
actually move money. A year ago this space was one
protocol and a lot of blog posts. It is now three
credible contenders, which is the normal shape of a
standards fight and a healthier place than it sounds.
-
Ramp added x402 AI agent wallets on Solana, giving
70,000+ businesses autonomous payment capability. Whatever you think of the rails, that is the
largest single distribution event 402 has had.
-
NMI made the SaaS-side argument: micropayments could dominate agentic commerce, and
subscription businesses are not priced for it. This is
the same seam I keep finding in the catalog — the APIs
that charge per call and the APIs that let you
rehearse a call for free are two entirely different
sets of companies, and almost nobody has noticed they
are on the wrong side of it.
-
And then the joke wrote itself. Stack Overflow published "Get rid of your
CAPTCHA, the future of the web is bots" — the correct argument, made well. I fetched every
third-party story I shortlisted for this issue with an
ordinary browser user-agent, just to check the links
resolve. Three refused me outright with a 403: the
GSMA's own Open Gateway announcement,
cData's explainer on what an AI gateway is, and
DZone's piece on MCP session persistence. A
fourth, NMI's post on agentic micropayments,
403'd a plain client and only relented for a full
browser string.
Three organizations publishing about how machines should
consume the web, behind bot protection that refuses a
machine reading the web. Nobody chose this — it is a WAF
default nobody revisited. But the agent you are courting
and the bot you are blocking arrive on the same request,
and right now the block is winning. A pattern I keep
coming across.
|
|
A high wide view of an immense dark neon plain
crowded edge to edge with thousands of tiny glowing
light-vessels swarming in every direction, and at
the exact centre one tall unlit obelisk alone inside
a wide empty ring of bare grid that no vessel
enters.
|
Six Thousand Posts, and Not One About the Contract
Here is the week in numbers, pulled from the 6,583 unique
posts that landed across 1,735 provider blogs between
August 15th and 22nd. The last mile buzz starting to fade,
the API foundation still driving discussion, but the
foundational specifications aren't getting the love
that is required.
-
76 of those posts named MCP in the
title.
-
327 of them — five percent — carried
any API-related keyword in the title at all. The other
ninety-five percent is what a network of company blogs
actually publishes: pricing pages, release notes,
hiring posts, industry commentary.
-
Zero third-party posts named OpenAPI,
AsyncAPI, GraphQL, JSON Schema, Arazzo or gRPC in a
title. Not a small number. Zero. The only four such
titles anywhere in the network this week were mirrors
of my own posts.
I want to be careful about what that last number does and
does not show. It measures titles, not bodies, and plenty
of engineering writing describes a contract without naming
the format. The week before it was five, out of 6,549 — so
zero is the floor of a range that was already
indistinguishable from it. The contrast with 76 MCP titles
is not a rounding error.
The industry is writing a great deal about how agents call
things and almost nothing about what those things promise.
That is the CD Foundation's point from the other
direction: we are building an enormous amount of machinery
on top of a description layer nobody is currently talking
about. Tooling built on a contract survives a vendor
change. Tooling built on a protocol integration survives
until the protocol revs — and this one revved twice
already this year.
|
|
Six smooth blank glowing steps of ascending height
rising from an otherwise empty dark neon grid, a
single small angular light-vessel hovering beside
the second step being sized against it, a long quiet
bare plain stretching away behind.
|
From My Desk: I Shipped the Score I Keep Asking Everyone
Else to Live By
-
The rating work landed. Version 0.12 of the Kin Score shipped, along with the six quality bands behind it and the four typical responses I get from providers
when they see their number. Publishing the rubric is the price of publishing
the ranking. Also from the scoring desk: your internal docs need the same scoring discipline
as your public APIs.
-
I did two counting exercises that turned into the most
useful posts of my week. I scored 532 data model standards on whether they
ever modernized, and I counted the Arazzo runners by reading READMEs, because there was no other way to find out how many
implementations actually exist. Adjacent: a format can sink below the waterline and the throwaway API and the foundational API.
-
On the contract-versus-protocol seam that runs through
this whole issue: there is finally an OpenAPI for MCP servers and it
is called mcpdesc, the MCP layer is being built outside the
contract, agents can curl, so why do I need an MCP server, and you can deprecate a listing, you cannot deprecate a
tool.
-
The onboarding series kept finding the same wall. GitHub quietly built the flow everyone else is
missing, Slack can actually mint app credentials from a
script if you survive the bootstrap, and Shopify lets you script the token but not the
app. Which sets up the two posts that pair with this
week's news exactly: your bot protection is refusing the agents you are
courting and a stolen token is useless, a stale one still
works.
-
Two posts on the money seam: seventy-one APIs will let you try a call without
committing it, and the APIs that charge per call and the APIs that let
you rehearse are two different sets. Plus the market read: in Australian banking the API is a commodity,
because CDR made it table stakes, and what the trend work surfaced in the regulatory layer and the standards layer.
-
The Overlays series continued with compliance and redaction profiles and brownfield correction without upstream access. And I wrote up where I am at with forking Spectral, plus two wider ones — APIs are 100x more important than five years ago
and still uncool, Agent Skills as a bridge between engineering and
product, and macro level agentic storytelling.
-
A conversation with Sebastian Loch on verified
nutrition data, building image recognition on top
of LLMs, and a 100x influx of vibe-coding
developers. Sebastian runs business
development at FatSecret, where thirteen years went
into the largest verified nutrition database in the
world — sixty-two markets, twenty-six languages. We
started this conversation in 2024, when he was
genuinely worried the AI rush would strip-mine data
they had spent twenty years verifying. Three years on,
the moat held, and it held because of scale, reach,
and two decades of investment in the API. The part I
did not expect: LLMs made ten years of their own
computer-vision work obsolete
overnight and handed them the image
recognition engine their developers had wanted since
2016.
-
A conversation with Phil Leggetter on webhooks,
event destinations, and building a team as a fleet
of agents. Phil heads product-led growth and
DevRel at Hookdeck. We get into why so much of the
event-driven world is over-architected, and how
packaging durable queueing, filtering and
transformation behind plain HTTP means everyday events
do not require a multi-year Kafka project.
The through-line, if you want one: everything that got
better this week got better by making a grant smaller, a
scope narrower, or a claim more specific. Task-based
consent instead of account access. Composite servers
instead of every tool in the context window. A rubric
published facet by facet instead of a number asserted.
And the one thing that did not move is the contract. Six
thousand five hundred and eighty-three posts, seventy-six
about the protocol, none about the description. We are
getting very good at governing the call and no better at
knowing what the call means.
See you next week.
📄 Publishing a Public MCP Server — Everything in this issue's second section is
downstream of one decision: whether you treat MCP as part
of your API operations or as a weekend science project
bolted on the side. This is the provider's guide to
the first option. Locate yourself in one of three
archetypes, then walk the full lifecycle — build,
authentication, tool curation, hosting, governance,
distribution — grounded in real public servers rather than
the hype, with the anti-patterns I watch for and a
self-assessment to run before you ship. ~24 pages. $25
|
