Charlie Major, and what I am doing about AI agents
I have spent 15 years in payments, 10 of them leading product. In December 2025 I started writing about what happens when software begins to act and pay on people's behalf, and in 2026 I started measuring it. Major Matters is where I write. Major Labs is where I count, and where the data and the code live.
Who I am
I am a product leader in payments and AI, based in the UK. I started on the support desk for payment terminals, which is still the best education I have had in how money actually moves and where it gets stuck. From there I ran product for a point-of-sale platform across Europe, including the first compliant PIN-on-glass acceptance in the region and the profit and loss for the business, and then led product and technology at a retail software company. I am a Mastercard employee. Major Labs is not owned, funded or directed by Mastercard or any payments network or AI lab, and the opinions here are my own.
Why one person runs a measurement project: I started counting because nobody else was publishing the count. The claims about AI agents were loud and the numbers were missing, so I built the instruments and put the method next to every figure.
Support team lead for payment terminals, after two years of contract technical support on the same estate.
Product analyst, then product manager for EMEA. Owned the Clover EMEA P&L and shipped Europe's first compliant PIN-on-glass acceptance.
Chief product and technology officer at a retail software company.
A publication on payments, AI and commerce. Articles, frameworks, courses and weekly trackers, written in the first person and sourced to primary documents.
An independent, non-commercial research studio for the agentic web: open data, open method, open code.
What I have built, with dates
More than 240 articles on payments, AI and commerce; the frameworks (the Trust Layer Model, the Liability Gap, the agentic commerce stack maps); 20 courses; weekly trackers on agent payment protocols, programmable money and merchant agent-readiness; and answer pages written to be quoted correctly.
A count of public Model Context Protocol server repositories, refreshed by scan and published at /data. As of October 12, 2026: 3,502 repositories, 2,599 pushed in the last 180 days, 27 weekly readings since May 31, 2026.
Static analysis of public source code on the same rubric every week. Security: 37.7 percent of 2,883 swept servers carry at least one risky code pattern as of October 10, 2026. Identity: 74.5 percent of 420 network-facing servers that take sensitive actions show no authentication check in source as of October 10, 2026. A remediation cohort of 47 servers is re-read after disclosure: 3 fixed, 5 reduced, 31 unchanged, 7 worse as of October 10, 2026.
The MCP scanner behind the census; MCP Surface Check as a GitHub Action; and five agent-safety primitives on PyPI and npm (IdentityKit, MandateKit, BudgetGuard, WitnessKit, RememberKit), labeled v0, experimental and unaudited. Each answers one question: who the agent is, what it may do, what it spends, what it did, what it remembers. See /tools.
A mandate verification service built on MandateKit and WitnessKit, hosted and experimental, at clearpoint.majorlabs.co.
Dated, hashed snapshots of the published safety frameworks of 6 frontier labs with a diff when the text changes (/threshold-watch), and a sourced record of 16 frontier control incidents since May 2026 with published inclusion criteria (/incidents).
Two studies given their own pages, each drawn from the weekly series: The Front Door and Rule by Default.
How far it reaches
I would rather point at things you can check than at numbers you have to take on trust.
- A citable dataset. The data bundle carries a DOI (10.5281/zenodo.22674847), a SHA-256 manifest and a citation block, and is licensed CC BY 4.0. See /data.
- Code people can install. The scanner, Surface Check and the five kits are MIT licensed on GitHub and published on PyPI and npm.
- Machine-readable everything. RSS and JSON feeds for the build log, the incidents, the identity tracker and Threshold Watch; a read-only MCP endpoint at /mcp so any agent can query the datasets.
- Readers in the industry. Major Matters is read by people who work in payments, banking and AI, and its figures are picked up by the answer engines it was written to be quoted by. I describe the audience in words because engagement numbers are easy to inflate and I do not want mine taken on faith either.
How I work
Current figures on the homepage, this page, /research and the data pages are read from the published data files and carry an as-of date. Figures from a dated report are labeled as that report's figures.
The scanner is readable Python, the dataset is public, and the methodology is on the page. I would rather you argue with the method than take a number on faith.
I never connect to, run, install, probe, or exploit a running MCP server or any other running system. I read public source code and published documents. A finding is a pattern, not an exploit.
Per-repository findings go privately to the people who can fix them, through coordinated disclosure. I publish the aggregate and never a target list.
When a number or a claim does not hold up, the page gets a dated note and /latest records the change. The proof that the rules hold: the sweep of September 19, 2026 skipped half its repositories when GitHub throttled it, so it was stopped and re-run rather than published, and the scanner now refuses to publish a degraded run.
Who pays
Nobody. Nothing on this site is for sale. There is no fundraising, no vendor sponsorship, no advisory work for hire, no paid placement in the data. The newsletter is free, the data is CC BY 4.0, the code is MIT. Major Matters and Major Labs share one author and nothing else: Major Matters is where the analysis is published, Major Labs is where the data and the code live, and neither pays the other.
Contact and corrections
Building on the data, fixing a finding, or want the method picked apart? hello@majormatters.co. I answer verification requests from reporters first. Code and issues: github.com/major-matters. Updates: @majorlabsresear.