What an independent lab should measure next

Major Labs measures the public surface of the agentic web once a week. The MCP sweep reads the source of every public server it can find and asks the same fixed questions: does it declare authentication, does it take sensitive actions without one, does the code carry a pattern that has caused trouble before. The merchant-readiness index runs six read-only probes against the 92 largest US retailers. The Agent Identity Tracker records who is issuing agents a credential of their own and who is making the customer liable instead. The incident timeline records frontier control failures with sources. The x402 tracker reads settlement counts off a public chain. Hunch runs the merchant probes on demand against any store, and the Bench puts agents under a signed mandate and records what they did.

Every one of those datasets keeps returning the same finding in different clothes.

The record of what an agent was allowed to do, and what it then did, has to live outside the agent.

A server that declares no authentication has no record of who called it. A bank that makes the customer solely responsible for their agent has decided where the record lives: with the customer, who does not have one. A memory store that does not sign its entries hands out a record nobody can check. The Bench exists because an agent's own summary of a job and the harness's record of that job disagree often enough to be worth measuring.

The newest dataset says it from another angle. The first closed-loop remediation report, dated October 25, asks a question the sweep's own history can answer: of the servers flagged for a risky code pattern, how many were clean 30, 60 and 90 days later. The finding, as written in the report:

Ninety days after a weekly sweep flags an MCP server for a risky code pattern, about one in 10 has been cleaned up, roughly seven in 10 still carry the pattern, and the rest, close to one in five, have gone unmaintained or disappeared. The identity gap closes at the same pace: about 10 percent of servers taking sensitive actions with no visible auth layer had added one, or dropped the sensitive code, three months on. Abandonment is removing flagged servers from the ecosystem nearly twice as fast as maintainers are fixing them.

That is the state of the public record. It is also where the lab's view ends, and I want to be exact about the three places it ends.

Rules that change at the border

The identity tracker records frameworks as they are announced. It does not tell you that an agent acting for a customer in Frankfurt and paying a merchant in Singapore sits under two liability regimes that disagree. An agent crosses jurisdictions inside a single session, and a tracker of announcements is not a map of conflicts.

What I will build is a regulation watch. A weekly job fetches a fixed list of primary pages (the OCC, FDIC, Federal Reserve and Treasury; the EBA and ECB; the FCA; the Bank of England; the CFPB; the Bundesbank's agentic payments work; the BIS Innovation Hub), hashes the body text, and files a dated diff row when a page changes, with the opening of the changed passage. A human reads the diff and promotes it, or not, to a tracker entry. The diffs become a second feed beside the identity tracker's existing JSON feed.

What I will not claim is real time. Regulation does not move in real time, and a lab that said it tracked rules that way would be performing rather than measuring. Nor will I claim that hashing pages is legal analysis. The honest version of cross-border coverage is a conflict matrix: for each agent-identity framework, which jurisdictions' liability rules it does and does not satisfy, maintained by hand with sources and dates. That is a research essay before it is a dataset, and it needs counsel in each jurisdiction to check it.

The economy the sweep cannot see

A large share of agent commerce passes through nothing public. Agents negotiate API to API over closed messaging; one model hands off to another inside a vendor's pipeline. The sweep reads public code and public endpoints, so by definition it sees none of that.

What I will build is more of the visible edge, and a count of it. The merchant probe already reads robots.txt, llms.txt, UCP profiles and A2A cards. It will extend to every well-known descriptor the commerce protocols publish, counted weekly. This is where a three-tier discovery rule matters. Anything the probes fetch and do not recognize goes into a discovered table. A shape that appears on enough hosts for three consecutive sweeps becomes a candidate, with its own page and its own start date. Only after eight sweeps with a stable definition does a candidate become a measured probe, and then as a dated method change. Nothing in the first two tiers touches a scoreboard or a badge. A weekly section will list the shapes the scanner does not yet measure: the lab publishing what it cannot see yet.

Second, Hunch's playground run records in aggregate: how many runs, which traps caught agents, which checkout rules fired. That would be the first public dataset of agent-to-merchant behavior that is not self-reported by a vendor. Third, a weekly count of public A2A agent cards and MCP registries, the one visible seam of the agent-to-agent layer.

What I will not claim is coverage of closed traffic, by inference or by sampling. The methodology page will say plainly that private negotiation between agents is invisible from outside. The only honest routes in are instrumentation the parties choose to install, or protocol-level public ledgers, of which x402 is the one the lab can read. Scraping private traffic is not legal and it is not this lab.

Behind the perimeter

The third gap is the one that matters most. Enterprises run agent swarms and internal pipelines that no public sweep will ever touch. The number everyone wants, how many agents are acting under what controls inside real companies, does not exist, and nobody can produce it from outside.

What I will build is a telemetry mode for WitnessKit. The kit already produces a signed record of what an agent did; MandateKit produces a signed statement of what it was allowed to do; BudgetGuard enforces a cap. Together they are an attestation layer in all but packaging. The telemetry mode is an opt-in flag that emits only aggregate, non-identifying counters: actions per mandate, refusals, mandate-exceeded events, mismatches between the record and the agent's summary. Each batch is signed by the installing party and sent to an endpoint whose schema the lab publishes. No prompts, no tool names, no hostnames leave the perimeter. The Bench and Hunch will be the first two reporters, so the schema is proven on the lab's own traffic before anyone else is asked to trust it.

What I will not claim is zero knowledge, which is a cryptographic term with a meaning this does not meet. The right description is aggregate, signed, non-identifying. I also will not run an anonymous incident channel. A one-person lab cannot technically keep an anonymity promise, and a promise it cannot keep is worse than none. The incident timeline accepts submissions with sources and will stay that way.

What needs partners or standards: attesting to posture (prompt-injection defenses, sandboxing) needs something to attest against. The IETF WIMSE work and Web Bot Auth are the candidates. The tracker follows them, and the telemetry schema will align with them rather than invent a fourth. Distributed sweep nodes, where partners run the sweep and submit signed checksums, are attractive and premature: federation breaks the series unless every node runs the identical pinned container and the registry rejects divergent results. The prerequisite is a signed manifest for every sweep, which needs no partner. The second node comes after, run by a named partner, not an open call.

The instrument itself

Two more items concern the instrument rather than any blind spot. The next State of MCP is due January 4, 2027. Before data collection starts I will publish the method, the scripts and the evaluation matrix on a method page with a hash, so the analysis is preregistered and the results cannot quietly fit the story. The remediation report becomes monthly, with a per-pattern false-positive ledger that uses maintainer disclosures as ground truth.

Then the matcher. The sweep matches strings today, which is why 345 findings in the remediation report could not be classified from a single stored line. Matching on syntax trees would do better for Python and TypeScript servers. It is also a method change, so it will run as a candidate measure beside the string matcher for eight sweeps and be promoted, if it is promoted, with a dated re-base. Never swapped silently.

Why any of this is worth reading

None of the above deserves attention unless the rules behind it hold. Those rules are on the governance page, and the short form is this. A measure's definition is immutable once published; a changed question is a new measure with a new start date. A composite is withheld when its components do not share a method, as the Trust Index is today. A degraded sweep is never published. Per-server findings go to maintainers, never to a list. Weights and thresholds change by dated commit and a line in the build log. The operator has a full-time job in payments; that employer has no role in the lab, funds nothing, sees nothing before publication, and is neither scored nor described here. If any page on this site implies coverage the lab does not have, that is an error under the charter and I want to hear about it.

The through-line is the finding itself. The record has to live outside the agent. The lab's own records have to live outside the operator too. Preregistration, signed manifests, DOIs and a public charter are how that is done.

Commitments, dated

• DoneOctober 25, 2026. The governance page, and the first closed-loop remediation run.
• Q4 2026The discoveries table and a weekly "shapes the scanner does not yet measure" section. A preregistered method page for State of MCP Q1 2027, hashed before data collection. The regulation-watch feed. A signed manifest for every sweep. The remediation report monthly from November.
• Q1 2027State of MCP on January 4, run against the preregistered method. WitnessKit telemetry mode, with the Bench and Hunch reporting. The syntax-tree matcher running as a candidate measure beside the string matcher. Automated DOI deposit of the census history, the incident feed and the identity feed at the quarterly cycle.
• Q2 2027And after, with partners: the promotion decision on the syntax-tree matcher after eight sweeps. A second sweep node run by a named partner. The telemetry schema aligned with WIMSE and Web Bot Auth. The cross-border conflict matrix, reviewed by counsel in each jurisdiction.

Each item lands as a dated line in the build log, or it has not landed.

What you can do

Run Hunch on a store you care about. Point an agent at the playground and compare its summary with the run record. Send an incident with a source to hello@majorlabs.co; sourced submissions are reviewed within a week. Run the scanner on a server you maintain, before the sweep does.