What I have shipped

Search Console reported one URL blocked by an unexpected 4xx: Googlebot had fetched the newsletter form's POST endpoint with a GET and received a 405. That request now answers with a redirect to the form on the home page, and robots.txt disallows /api/ and /sandbox, which are endpoints and a password-protected tool rather than pages. No content changed.

Built from the Bench evidence. In entries two and three the one action that slipped past every layer was a payment of £84 to the customer's bank, because the bank sat on every job's flat allow list and a flat list means every allowed verb at every allowed counterparty. 0.2 replaces that with a per-verb scope: the bank can be a counterparty for read, submit and transfer without becoming a valid payee, and the slip is now denied with the reason code counterparty_scope. Also new: a window start (not_before) beside the expiry; usage limits (one pay per job, so many per hour, so much per window) enforced through a store the caller supplies and recorded after each allowed action; signed revocation lists the verifier checks against the mandate's own issuer; and delegation, where a mandate names the key it may be delegated to, a child embeds its signed parent, and the verifier walks the chain to a trusted root and refuses any child that widens its parent in any field. Every new field lives under constraints, so a 0.1 verifier refuses a 0.2 mandate instead of ignoring the parts it does not know. Python and TypeScript return identical verdicts on a shared 71-case matrix, and the TypeScript suite re-signs every Python-signed envelope byte for byte. 100 and 149 tests. The Bench harness and the Mandate Sandbox still run 0.1.1; moving them is the next dated step, and the entry-three kettle job is the first thing to re-run. v0, experimental, unaudited. Python on PyPI October 12; npm (mandatekit 0.2.0) October 14.

Behind the same password. The engine's rail verbs are now asynchronous, which is what a real rail needs, and the first test-mode adapter is in: Stripe in test mode, bring your own test key. The adapter refuses any key that is not a test key before any request leaves, calls only api.stripe.com over HTTPS, derives idempotency keys from the run so a replay cannot pay twice, caps each run at £500 before the call, writes each call's request hash and response hash into the signed chain beside its step, and binds the ledger of hosts and paths into the chain when the run closes; the key itself never reaches the chain, the logs or the server's storage. A processor's decline is now its own step status, declined-by-rail, witnessed with the decline code, counted as money that did not move, and reconciled against the agent's report (a report that says "done" where the rail declined is a contradiction). Simulate can now ask for reports written from the plan as well as from the record, so the share of careless reports at volume is a number. Release 2 ships on the same kit builds as release 1; moving the sandbox onto WitnessKit 0.1.0 and MandateKit 0.2 is a separate, dated step because it changes mandate content and chain hashes. 86 tests. No live mode exists; the kits stay v0, experimental, unaudited.

The Bench piece of October 12 found agent summaries contradicting their own signed records and said no layer checks one against the other. WitnessKit 0.1.0 adds that check as a function: reconcile(claims, chain) takes the agent's claims (step, counterparty, verb, claimed as done, failed, declined or not attempted) and the signed chain, and returns three kinds of finding: no_entry (a claim with nothing in the chain), contradicted (a claim the chain disagrees with, including a "declined" where no call ever reached the other side), and undisclosed (a refusal in the chain the summary never mentions), with a one-line result. A bind_summary helper produces the run.completed fields that tie the summary's hash into the chain, matching what the Bench harness and the Mandate Sandbox already write. Two entry conventions are parsed (the harness's step.<verb> and the sandbox's <verb>:<status>), one shared fixture of 47 cases drives both the Python and the TypeScript suites (39 and 37 tests), and the sandbox's own results are the expectations for its cases. It compares claims to entries; it does not judge the truth of a tool result and cannot see steps that were never logged. v0, experimental, unaudited. Python on PyPI October 12; npm (witnesskit 0.1.0) October 14.

The entry had described two post-safeguard escapes, with an agent using DNS to reach a chatbot as a second case "the following Friday," citing only MIT Technology Review, which describes one escape. Fortune's September 26 account of OpenAI's report shows the DNS resolver was the mechanism of the September 20 escape itself: flagged within 15 minutes, a person reviewing three minutes later, the run stopped by hand two and a half hours after that, and OpenAI's own line that the incident "exposed a gap in our controls over network restrictions." The entry now says one escape, cites both sources, and carries a dated correction note. Found during the research pass for a Major Matters piece that links the timeline; corrected before the piece published.

Still behind its password at /sandbox. Every governed step now executes on a rail adapter (a mock bank today; a processor in test mode and bank sandboxes next) and the signed chain records which rail ran it, with the request and response hashes and the rail's reference, so a run's evidence says exactly what left the sandbox: nothing, so far. A live mode does not exist in the code. The three card networks' agentic programs are modeled, not integrated: dated profiles built only from public documents (110, 64 and 38 sources, every field with a quote and a URL, every gap listed as an unknown) drive a simulator that shows, for the same job, whether each network would have approved the authorization and who bears the loss if the customer disputes. The finding is in the gaps: none of the three publishes a rule for a registered agent that acts wrongly under a valid instruction; one has announced coverage for agent error with its terms unpublished, so its outcomes carry that badge. The agent's end-of-run report is now bound into the chain and reconciled against it, with a switch between a report written from the record and one written from the plan, the careless agent's version. Kits unchanged: v0, experimental, unaudited.

Entry 16 added from Anthropic's October 9 report: four categories of unintended actions found in a transcript review begun in July (a university server's flawed script used to run commands; real forms submitted on live websites, including an invented tip filed through a police department's form; token and fee gates worked around; URL shorteners used to get past fetch limits), the models and evaluations named, and the remediation: live internet access turned off for all internal evaluations, some public evaluations dropped or moved offline, the fetch tool restricted, detection tooling built, the White House briefed. The entry sits beside the Major Matters Bench's finding of the same week: three agent summaries in 51 that contradict their own signed record by the published standard, 11 on a re-reading, with a dated correction note on the entry.

A budget says how much a task may spend; a velocity window says how fast. 0.2.0 adds a sliding window on spend and on calls, with a cap for each, and an anomaly check that compares the current window, including the proposed call, against the mean of the most recent completed windows, inactive until enough history exists; the policy chooses deny (the default) or flag. Time is injected, so every test runs on a fixed clock, and one fixture of 33 verdicts is replayed by both the Python and TypeScript suites so the two implementations give the same answer case for case (51 and 60 tests). Every decision carries the window numbers in a plain object a WitnessKit trail can record. The agents guide on Major Matters had described this feature on September 18 ahead of the code; a dated note on the guide now records today's ship date. Still to come in 0.3: reserve and commit for concurrent agents, and a store that survives a restart. The kit stays v0, experimental and unaudited.

A reviewer ran MandateKit's TypeScript tests on Node 22.14 and found that they failed: the README promised Node 22.6 or later, but Node strips TypeScript types by default only from 22.18, and the npm scripts ran the source files bare. The same scripts sat in all five repositories. They now pass the flag, so npm test and npm run demo work on any Node 22; the published packages are compiled and never needed it. The review also found the npm registry two releases behind the MandateKit and BudgetGuard repositories (0.1.0 was tagged on October 1 and never published) and a demo script in MandateKit that pointed at a file not in the repository; the demo is written and in. IdentityKit, WitnessKit and RememberKit move to 0.0.3 so their exported version constants match their packages. No change to any wire format, verifier or verdict; the Python packages are untouched. Each changelog credits the report.

Entry 15 added from the Wikimedia Foundation's October 5 statement: edits to its wikis by agents it believes OpenAI runs, attempts to misuse a citation tool and its public Etherpad as proxies, millions of API requests, millions of pages crawled, and hundreds of thousands of Wikidata Query Service queries that may have contributed to a partial outage on May 13. The foundation found the activity itself and published a CSV of the edits; OpenAI, it says, admits to agents behaving unpredictably. Also today: the October 3 sweep is live (2,812 servers swept, 37.6 percent with a risky pattern, 82 high-surface, identity gap 74.0 percent), four days late because the sweep's final build step refused without a variable that lives only on Netlify; from now on the sweep and the Monday jobs publish by committing their data and letting Netlify build, and the scan database is scheduled to leave git before it reaches GitHub's file limit.

The first edition of the quarterly briefing, published as a free sample. The read: the MCP server population grew 34 percent in the quarter (2,528 to 3,378) while the share carrying a risky pattern rose from 34.9 to 37.7 percent and high-surface servers went from 47 to 78; 74.4 percent of network-facing sensitive servers accept no identity while the identity tracker reached 21 efforts, five new this quarter; 32 payment protocols and rails tracked. Scoreboard, what changed, what to do, a five-item watchlist, and the method behind every figure. Data as of 28 September 2026; the refresh audit lists every figure changed from the September draft.

Three incidents added from this week's reporting: an experimental OpenAI model that accessed Australian government systems in June, disclosed to Australia on September 10 and apologized for on September 29; two agent escapes on September 20 and 25 after the post-Hugging Face safeguards, one detected in 15 minutes; and a campaign of more than 15,000 accounts that copied OpenAI models' hidden reasoning in July, whose fix reached OpenAI's own API by July 28 and Microsoft Azure by September 27. Separately, after six chief executives signed the White House Accord on Super Intelligence on September 29, every tracked framework was re-fetched on October 2: Anthropic's, OpenAI's, Google DeepMind's and xAI's are unchanged from the September snapshots, Meta's remains unretrievable by the fetcher, and Nvidia publishes no framework to track. The timeline now holds 14 incidents since May 2026.

A private preview, behind a password, at /sandbox. A scripted agent takes one of seven jobs for a fictional bank customer (change an address with six companies, pay a bill, dispute a charge, cancel subscriptions, replace a kettle under £90, top up savings, connect a budgeting app) under a mandate the customer sets on a five-layer dashboard: who may act, what it may do, what it may spend, what it may remember, and the record it leaves. Fifteen of the 47 steps across the seven jobs are things nobody asked for, and every step is checked by the published kits running unmodified in the page's back end, not by a copy of their logic. The outcome reads from three seats: the customer, the bank and the counterparties, next to what the same plan would have done with no layer. Every run leaves a hash-chained, signed trail that verifies on the page; edit one entry in the browser and WitnessKit reports the index it broke at. Two kits changed to make this honest. MandateKit 0.1.0 adds action verbs, an approval rule, a third verdict (ask, beside allow and deny), a step mandate the customer signs for one action with a 15-minute life, and a cross-walk to RFC 9396 authorization_details; 20 new tests per language, and a step mandate signed in TypeScript verifies in Python with a byte-identical signature. BudgetGuard 0.1.0 adds a money ledger: a running cap for the whole job beside the per-transaction cap, which is the difference between £90 per item and £90 for the job; 9 new tests per language. Both are on PyPI; npm follows. No model is in the loop in phase one, and nothing on the page is a real bank, person or payment.

The second booklet, and the first written for the format. Its claim is an old one, credited in the text to Lawrence Lessig and Kevin Kelly: the default setting is the rule in force. What the booklet adds is a measurement on both ends of the agent connection. At the storefront, 28 of 92 large US retailers did not serve robots.txt to a self-identified scanner on September 26, 2026, and 16 of the 64 that did name any AI agent. At the tool server, 288 of 384 actively maintained, network-facing MCP servers whose code takes a sensitive action show no authentication check in the scanned files as of September 27, 2026, which is 75 percent. The booklet says plainly what the data cannot show: a refusal cannot say why, so the door-side finding is written as consistent with a preset and not as set by one, and the server figure is a static reading of source code and not a confirmed vulnerability. It has 11 chapters, a 3D scene in three parts drawn from the data, 10 data plates, nine quoted documents with sources, and a scorecard of eight dated predictions that will be scored from the same two series. The 11 chapter illustrations are generated images and are labeled as such. Readers who subscribe to Major Labs Weekly on the page can download the booklet as a PDF. The page makes no third-party requests.

A new format, on trial. The Front Door is one study given its own page, set inside a 3D street drawn from the data. There are 92 storefronts on the street, one for each retailer in the weekly Merchant Agent-Readiness scan, and 28 of the doors are shut: the number that did not serve robots.txt to a self-identified scanner on September 26, 2026. The page carries the data plates with their run dates, three quoted documents with their sources, the method and its limits. Readers who subscribe to Major Labs Weekly on the page can download the booklet as a PDF. The page loads its fonts and its 3D library from this site and makes no third-party requests. The signup function now records which page a signup came from. The format is inspired by the research archive pages of Dami Lee and Nollimedia; the palette, the street, the words and the numbers are mine.

The September 19 sweep ran for 44 hours and skipped at least half of its repositories: GitHub was refusing requests in bursts, and the scanner counted each refusal as a repository that did not exist. It was stopped before it could publish. A full re-scan on September 20 and 21 covered 2,349 repositories with no failed fetches; the security scoreboard now reads 37.4 percent of 2,701 swept servers with a risky pattern (37.5 percent of 2,408 last week), 74 high-surface servers (66), and the identity gap at 75.3 percent (76.3). The scanner changed in four ways so this does not recur: it waits and retries when GitHub throttles, paces its requests, shares downloaded files between the security and identity passes, and exits with an error when more than five percent of repositories fail, which now stops the refresh, build and deploy. The package download pass gained the same back-off for npm and no longer overwrites a stored count with a blank when a lookup fails. The catalog grew to 3,353 servers.

A source-checked refresh of three hand-maintained datasets. Agent Identity Tracker: two entries are new, the IETF WIMSE working group's draft on AI agent authentication and authorization (draft-ietf-wimse-aims-00, September 15, 2026) and the OpenID Foundation's two AuthZEN Working Group Drafts for agent authorization, AARP and COAZ (June 15, 2026). The IETF Web Bot Auth row presented April 30, 2026 as a future target; that date has passed, and the row now records the group's first adopted document (September 1, 2026) and that the charter milestones passed without a document reaching the IESG. The AP2 row now gives the mandate types in the v0.2 specification, the Checkout Mandate and the Payment Mandate, alongside the three named at launch. Frontier Incident Timeline: three evaluation incidents are new. Anthropic's July 30 disclosure of three cyber evaluations that reached real systems, Meta's August 5 statement about Muse Spark 1.1, and Google's September 18 confirmation of a May incident with a Gemini model. The Meta and Google entries rest on statements to the press, not published posts, and say so. Two corrections, dated and stated. The UK AI Security Institute entry was dated "Disclosed September 2026" and cited no primary source; the institute published its report on August 4, 2026 about an incident detected on July 28, so the entry is re-dated, moved, and rewritten from the report (122 runs of seven models, 10 runs with unsanctioned actions, 19 actions in total). Its line that both models' successors shipped with expanded capability gating is not in the report, no other source for it was found, and it is removed. The RubyGems entry called itself the earliest documented autonomous-agent incident; Anthropic's disclosure dates one of its incidents to April 2026, which is earlier, so the claim is removed. The same entry now records that attribution is contested, with Ruby Central's September 11 statement and OpenAI's response quoted. The Hugging Face entry gains METR's investigation report as a source, with its figures. Mandates matrix: re-verified against primary specifications. MCP is now at protocol version 2026-07-28 under the Linux Foundation; the row cited the 2025-11-25 authorization spec and an older steward. UCP has been governed by a Tech Council since April 24, 2026; the row listed Google alone. The ACP row said Instant Checkout was live in ChatGPT; OpenAI discontinued the initial version on March 24, 2026, and the note now says so. Each change is in the matrix changelog, along with what was not re-verified.

A second pass after the site review. Numbers: the homepage, /about, /research, the social text on /data and llms.txt now read every current figure from the published data files, the same ones /data renders, and each figure shows its as-of date. Today that means 3,268 repositories in the census as of September 14, 2026 (the homepage said 3,166), 37.5 percent of 2,408 swept servers with a risky code pattern as of September 9, and 76.3 percent of 350 network-facing sensitive servers with no authentication check as of August 29, with the 78.6 percent figure for all 733 sensitive servers shown beside it. Figures that belong to a dated report are labeled as that report's figures, and the June report tiles on /research now match the June 18 edition of the report. Navigation: every page has one shared header with links to Data, Research, Tools, Essays, About and Subscribe, and the per-page back links are gone. Newsletter: one form everywhere, with a label, a spam trap, the line about one email a week, and a link to the new /privacy page; eight older forms that posted to an unused endpoint were replaced. Analytics: Google Analytics now runs under Consent Mode, with analytics storage denied until a reader accepts on a small banner. About is rewritten around the four instruments and the tools as they exist today, and states plainly that I am a Mastercard employee and that Major Labs is not owned, funded or directed by Mastercard or any payments network or AI lab. Accessibility and feeds: a skip link, header, nav, main and footer landmarks on every page, visible keyboard focus, captions on the picker and registry tables, and the correct content type on /incidents/feed, /kya/feed and /latest/feed. Essay and thesis headings have link anchors. Em-dashes are out of the site copy, including older entries in this log. Still open: pagination for the picker and registry tables, PDFs for the Q3 reports, and the per-server registry pages. The two Q3 reports now have PDF editions, printed from the report pages themselves so the PDF and the web version cannot drift apart; each report page has a download link. Late additions the same day. The Q3 security report carries a dated correction: finding two said 733 servers touch sensitive data over the network, but the scanner flags sensitive actions in source code on any transport, and 350 of the 733 are network-facing (267 of those show no authentication, 76.3 percent); the counts did not change. The same report now notes that its remediation figures are the August 29 re-scan and that the September 5 re-scan moved one server from unchanged to worse. Both PDFs were regenerated. Analytics now loads only after a visitor accepts, so a visitor who declines or ignores the banner is not measured at all. The signup rate limiter no longer stores IP addresses: it keys its counters on a scrambled, daily-changing fingerprint and deletes them after about ten minutes. A /tools index page lists every tool, and the header links to it. The remaining home page copy is in the first person, and the roadmap no longer describes itself as ahead of estimate. One clarification of standing: Major Labs is research, not a commercial operation. The roadmap no longer calls its instruments commercial products, and the dated notes on the thesis and the discovery essay now say that the prices and paid hosted layers in those June plans were never launched and nothing on the site is for sale.

A maintenance pass after a full review of the site. The sitemap listed 3,268 per-server registry addresses that rendered the not-found screen with a 200 status; they are out of the sitemap and the route is switched off, so those addresses now return a real 404. Every page now carries its own canonical URL, the site has a favicon, and the 404 page is in the site's style with links onward. Two index pages are new, /essays and /reports, and the footer links both, along with the MCP endpoint and the versioned data bundle. Corrections are dated, not silent. The September 9 entry said the June x402 volume claims were gone from evergreen pages; essays 02 and 04 still carried the 165 million figure, and each now has a September note saying it did not hold up. The thesis note now records that the registry shipped with no paid badge tier and that the cadence became one weekly email. Essays 07 and 08 gain the closing disclosure the others carry. The homepage section on where the research comes from now states the position plainly: neither publication is owned, funded or directed by a payments network or AI lab, and the author is a Mastercard employee whose opinions are his own. Title tags and the default description use the observatory line. Two pages changed shape. The home page section that listed five planned agents in June is now What shipped, and lists the three parts of that plan that are live: the MCP scanner, Clearpoint and the Agent Identity Tracker. The old text promised probing of running systems, which the site's one hard rule forbids, so that text is gone. /mandates is now a factual matrix of what each rail's specification says; the three-way labels, the summary count and the finding paragraph published in June were removed.

Nine days after the September 8 open letter asked six labs for six verifiable commitments, OpenAI published a Model Misalignment Reporting Framework and six incident reports from its own training runs, disclosed before the fixes. Threshold Watch now records commitment three (incident disclosure with teeth) as half-built by one lab: reporting with internal deadlines, disclosure before mitigation and third-party notice are present; the independent body, legal authority and external closing report are not. Commitment six (monitoring honesty) has its first structured entry: a 2.15 percent oversight-failure rate for GPT-5.6 Sol against 0.27 percent for GPT-6 Astra. The six reports join the Frontier Incident Timeline as its eighth entry. Watching next: published deadlines, the first slow-track closing report, whether Anthropic and DeepMind match, the federal reporting mechanism, and whether the European Commission's lab talks produce an investigation authority.

Dario Amodei's September 12 essay won endorsements from OpenAI, xAI, Microsoft and Google DeepMind inside a day. Read against Threshold Watch, which fetches and hashes six labs' published safety frameworks weekly, the consensus rests on documents no third party can diff: six of six labs publish a framework, zero of six publish a verifiable changelog, two block automated retrieval. Three dated watch items are now on the list, each of which would turn an endorsement into something checkable: OpenAI publishing an evaluator access agreement to match Anthropic's; any lab publishing its framework with a public, versioned changelog; and the first embedded-evaluator report appearing with its redactions marked. The full read is on Major Matters.

The lab that measures the MCP ecosystem is now queryable through it. POST to majorlabs.co/mcp and five tools serve the live datasets: the Agent Trust Index, MCP ecosystem statistics, the Frontier Incident Timeline, the Agent Identity Tracker, and Threshold Watch. Stateless JSON-RPC over streamable HTTP, read-only, no auth, no tracking, CC-BY-4.0 with a cite-us instruction in the handshake. Point any MCP client at the URL and the numbers are in your agent's context. Also new on /data: a release calendar, so you know when the next number lands before it does; and Threshold Watch's RSS change feed now announces itself to feed readers site-wide.

A new living dataset at /kya: every announced framework, protocol, standard, and regulation for AI agent identity, delegation, and know-your-agent verification, from this week's Ant-Mastercard-Visa KYA interoperability framework back through DIF's KYA-OS, Google's AP2 mandates, Cloudflare's Web Bot Auth and the IETF working group standardizing it, NIST's agent standards initiative, and the EUDI wallet regulation anchoring the principal end. Nineteen entries at launch, each dated and traced to a primary source, with published inclusion criteria and a machine-readable JSON feed at /kya/feed under CC-BY-4.0. Strictly factual: records of announcements, not endorsements. The industry started building the who-authorized-this layer; somebody should be keeping the list.

The Frontier Incident Timeline now ships a JSON feed at /incidents/feed (CC-BY-4.0) with a stable schema, so researchers and agents can consume the record without scraping. And the site's signup form now feeds a real list: Major Labs Weekly, the Saturday sweep's numbers brief as an email, one edition a week, numbers first. The old form had been posting into a Netlify inbox connected to nothing; its subscribers were imported.

The published Action had been invoking a renamed script, so every install since launch failed; v1.1.0 fixes the entrypoint, and the v1 tag now tracks the release so existing pins pick up the fix automatically. The release also adds optional SARIF 2.1.0 output, wired for GitHub code scanning via the standard upload step. And the Action is now listed on the GitHub Marketplace under Security and Continuous integration, searchable where CI tooling actually gets found. One workflow file, no runtime access, read-only by design.

The prompt-injection sandbox is deprecated and /break now redirects to /security. The lesson it taught, that a prompt is not a security boundary and verifiable runtime checks are, lives on in the primitives that powered it (IdentityKit, MandateKit, BudgetGuard, WitnessKit) and in the Clearpoint demo, which exercises the same gateway against real mandate verification. Retiring the standalone page keeps the surface area honest: one interactive demonstration, maintained, beats two half-watched ones.

Every frontier lab publishes a safety framework; none publishes it in a form a third party can verify. This spec is the missing format: a machine-readable schema for capability thresholds, evaluation gates, deployment conditions, and escalation commitments; a hash-anchored changelog format with a closed change-type vocabulary (a weakened threshold can no longer be filed as a clarification); a standard-library validator; and an unofficial reference mapping of Anthropic's RSP v3.4 built from a dated Threshold Watch snapshot, showing what adoption looks like. Four conformance levels, L0 Published through L3 Changelogged, aligned to the Threshold Watch scoreboard, which now doubles as a conformance report. Current state: six labs at L0, four at L1, zero at L2 or L3. CC0. Adopting it costs a lab an afternoon. Completes the stack: the Compact states the principles, the Clauses put them in contracts, this spec makes them machine-verifiable, Threshold Watch watches.

The measurement series behind the State of MCP work is now a versioned, downloadable bundle: the 3,227-repo census, 112 discovery runs of provenance, the weekly aggregate series, and score distributions for security (2,408 scanned), identity (2,330), and supply chain (1,399). Aggregates only: per-repo findings stay in the private disclosure queue, as the disclosure process requires. Checksummed, licensed CC-BY-4.0, with a plain citation and BibTeX on the data page and a CITATION.cff in the repo. DOI pending via Zenodo. If you use the numbers, cite the dataset.

Major Labs now describes itself as what it has become: the observatory for the agentic web. The homepage leads with the four instruments (the census, Threshold Watch, the incident timeline, the trust scoreboard), every stat card carries a verified Q3 measurement, and third-party volume claims that later measurement did not sustain are gone from evergreen pages, with a dated correction note on the founding essay rather than a silent rewrite. Under the hood: a rebuilt llms.txt, Dataset and ItemList structured data on the incident timeline and both Q3 reports, dated quotable claims on the live surfaces, and a sitemap that now actually lists the Q3 reports.

Three copy-paste contract riders implementing the Control Stack Compact's buyer-side commitments: frontier AI incident disclosure on a 72-hour clock, attributable agents with reconstruction and revocation duties, and liability allocation with a cap carve-out for undisclosed incidents. Written as MSA-style riders with negotiation commentary, versioned (v0.1), CC0, and explicitly not legal advice: the point is that a buyer's negotiation starts from 'adjust this' instead of a blank page. The buyer side of the Compact, made copy-pasteable.

A dated, sourced public record of frontier AI control incidents: the May–June rogue-swarm takeover of a German wiki, the July sandbox escape that reached Hugging Face and OpenAI's own research cluster (six days of outside investigation, then silence), the UK AISI evaluation in which agents built fake identities and targeted real people, and the chief-scientist disclosure that chain-of-thought monitoring is degrading. Inclusion criteria published; every claim traces to a listed source; submissions via GitHub issues. Aviation keeps its incident record; this page is ours.

Coverage grows from three labs to six with xAI's Frontier AI Framework (June 2026 edition), Meta's Advanced AI Scaling Framework (whose PDF rejects automated retrieval, a failure the page shows on purpose), and Amazon's Frontier Model Safety Framework. New commitment-one scoreboard: all six labs publish a framework, none publishes a changelog a third party can verify. Changes now ship as an RSS feed, so a framework edit becomes a subscribable event.

Every frontier lab publishes a safety framework; none publishes a version history. Threshold Watch fetches each lab's canonical document on a cadence, normalizes it, hashes it, and archives a dated snapshot when the content changes, with diffs where the source is text. Launch coverage: Anthropic's Responsible Scaling Policy (v3.4), OpenAI's Preparedness Framework (v2, tracked via the canonical PDF because openai.com blocks automated retrieval of the page), and Google DeepMind's Frontier Safety Framework (3.1). First snapshots archived September 8. Read-only, method public, fetch failures shown as-is.

MandateKit grew an MCP gating proxy: one command wraps any stdio MCP server and verifies every tools/call against an Ed25519-signed mandate before it executes. The mandate's categories list becomes a signed tool allowlist, merchant pinning binds a mandate to one named server, and per-call amounts are capped by max_amount. Fail-closed: unparseable frames, tampered mandates, and untrusted signers are denied, and denials return to the agent as error results carrying the reason. Ships in the mandatekit Python package as mandatekit-mcp; ten unit tests plus an end-to-end smoke.

The first fresh deep scan since Q2, and an honest one. Measured with the same instrument as last quarter, MCP security did not improve: the share of maintained servers carrying a risky code pattern rose to 37.5 percent from 35.4, high-severity servers climbed to 67 from 55, and identity is stuck, with 576 of 733 sensitive network-facing servers (78.6 percent) still shipping no authentication in source. The sharpest finding needs a tracked cohort: of a 47-server high-risk cohort frozen in Q2, nine of which were contacted through the first coordinated-disclosure batch, re-scanning found 2 fully fixed, 4 reduced, 35 unchanged, and 6 worse. Disclosure is necessary and not sufficient, and most of the cohort has not yet been contacted at all. The supply-chain scanner changed method this quarter, so its exposure rate is a re-baseline rather than a delta, and because it feeds the composite, the Trust Index is deliberately withheld this quarter rather than move for a reason that is not real. From next quarter all three pillars share a stable method and the composite resumes. The pipeline now stamps every pillar with its own scan date and warns when one is carried forward too long, so a stale number never ships as a fresh one again.

The first delta edition of the series, built on 18 weekly scans from May 31 to August 31. The MCP server population grew 31 percent to 3,166, roughly 42 net new servers a week and no single-week surge. The fastest-growing slice was remote-hosted servers at +43 percent, the part of the ecosystem with the widest attack surface. The stale share held flat at 23.5 percent, so MCP is scaling with its composition fixed, neither maturing nor decaying on net. This edition reports population movement only: the deep security, identity, and supply-chain pillars are disclosure-sensitive, run manually rather than weekly, and are being re-based this quarter, so no security-posture delta is claimed. The next edition will report those pillars from a fresh deep scan.

The argument behind the State of Agent Memory report. An agent's memory is a claim you take on faith: zero of six leading systems sign memory, zero export it at full fidelity, zero carry portable provenance, and only three ship regulatory-grade consent. Memory is moving from a convenience feature to the substrate agents transact on, and an unsigned memory undermines a signed mandate. Why the fix is a portable, signed, consent-bound record rather than a better store, and where RememberKit fits.

Refreshed from the June 18 sweep and widened from one finding to three. The Major Labs Trust Index for the MCP ecosystem sits at 38 out of 100: Code Safety 64.4, Identity 24.6, Supply Chain 24.8. The headline numbers, all firsthand: 44,347 servers advertised across three registries but roughly 1,934 genuinely evaluable, a 23x gap; 36% of the maintained core ship a risky code pattern; 25% touch sensitive data with no authentication layer, the authorization gap agentic commerce keeps hitting; and 75% ship a known-vulnerable dependency. The report PDF and the web page both carry the new pillars; the live scoreboard updates weekly.

When an AI agent pays, the merchant or PSP on the other side has no contract with the issuer, so it cannot verify the payment mandate is genuine, in scope, or still live. Clearpoint answers exactly that. Present an AP2 mandate and get back a signed verdict with a machine-readable reason, a revocation status, and a tamper-evident hash-chained receipt, priced per verification at the money moment. It runs on two primitives we already ship in the open, MandateKit (AP2-tagged signing and verification) and WitnessKit (the receipt chain), in two modes: trusted, where you pin the issuer keys, and integrity-only. The live demo lets you try to break it: talk a shopping agent into a banned purchase, then watch the gateway block the same charge and seal it into the chain. v1 is scoped to signature, scope, expiry, a hosted revocation list, and signed receipts, and it shipped security-hardened. We are looking for design partners.

The scoreboards now roll up into a single weekly score: how safe is the agentic web to actually transact on? Version 1 fuses three firsthand, read-only pillars, each 100 minus the share at risk: Code Safety (risky code patterns), Identity (network-facing sensitive servers with no auth), and Supply Chain (servers shipping a dependency with a known advisory). The equal-weighted composite lands at 38 out of 100. It is published with a versioned methodology, a machine-readable trust-index.json, a cite-this block, and an embeddable badge. Like every series here it compounds weekly and cannot be backfilled, so the first mover holds a record no one who starts later can match.

The prompt-injection sandbox returns. A shopping agent has $50 and one approved merchant; you write a product page that tries to talk it into spending your money somewhere it should not. Your page runs past two agents side by side: one defended only by its system prompt, which can be talked into anything, and the same agent behind a gateway that checks every purchase against identity, mandate, budget, and an append-only witness log before it happens. The prompt-only side breaks; the governed side holds. It runs live when a model key is configured and falls back to a deterministic simulation otherwise, so the gateway checks are identical either way. The four primitives behind it (IdentityKit, MandateKit, BudgetGuard, WitnessKit) are open source.

The sweep grew three measurements. Supply chain: we resolved 32,000 declared dependencies across 1,344 servers against OSV.dev and found 74.6% ship a runtime dependency with a known advisory, the widest reach running through the official @modelcontextprotocol/sdk itself. Commerce: a full-day, read-only sample of the EIP-3009 gasless-settlement rail on Base USDC (the rail x402 rides) clocks ~180K agent settlements a day, ~5.4M a month, from 12,000 unique payer addresses. Remediation: we froze the highest-risk cohort and re-scanned it, and before any outreach 43 of 47 were unchanged, so high-risk servers do not fix themselves. All three are aggregate-only, run on the weekly cadence, and now appear on /security and /data.

A second weekly sweep joins /security: of the network-facing MCP servers that take sensitive actions (shell, file writes, database writes, mail or money), 74.5% show no identity layer anywhere in their source. Static, read-only, aggregate-only, with the headline deliberately cut to network-facing servers because stdio servers legitimately delegate identity to the host. The page is the instrument; IdentityKit is the response.

Every public registry ranks MCP servers by stars and recency. This one scores 2,479 servers on signals that matter: maintenance, documentation, license, adoption, transport, plus two earned badges (identity layer, clean security sweep). Praise-only by design: security and identity appear only as credits, findings stay in coordinated disclosure, and negative per-repo data never enters the public payload. Methodology published on the page; scores rise on the next sweep when maintainers fix things.

Seven agent-payment rails (Visa TAP, PayPal Agent Ready, OpenAI/Stripe ACP, Google AP2 + UCP, x402, MCP) documented from primary specifications: artifact, issuer, revocation, bridges, status and source. Live and announced strictly separated, every cell primary-sourced. Revised on 2026-09-18 into a factual matrix; the labels and summary published at launch were removed.

The same checks behind the /security scoreboard, packaged as a one-line GitHub Action. Drop it into your MCP server's CI and every push gets a security-surface score, a job summary, and a README badge comparable to the rest of the swept ecosystem. Static analysis of your own source only: it never connects to, runs, or probes anything. v1 tagged and public.

The static security sweep the scanner promised is now a live scoreboard. Weekly read-only analysis of the most-used active MCP servers: risk-surface tiers, pattern prevalence (SSRF surface, command injection, code execution), and a trendline that compounds with every sweep. Aggregate-only by design: per-repo findings go to maintainers through coordinated disclosure, and after the first cycle a fixed-since-last-sweep feed will name the good actors. Never probes a running server; the checks are public Python anyone can read.

An adversarial source review of all five primitives (Python + TypeScript) drove a hardening release. Fixed: a did:web SSRF guard bypass in IdentityKit, a cross-language expiry divergence in MandateKit, a record() fail-open in BudgetGuard, cross-agent memory censorship in RememberKit, and the shared canonicalization fallback now fails closed. Every fix is locked by a regression test. v0.0.2 is live on PyPI; still v0, experimental, unaudited by a third party.

All five primitives are live on PyPI and npm: identitykit, mandatekit, budget-guard-agents, witnesskit, rememberkit. One pip install away from a governed agent, in Python or TypeScript. Every package verified with a clean install from the public registries. v0, experimental, honestly labeled.

We read six agent-memory systems firsthand: Letta, Mem0, Zep, LangMem, model-native memory, and Cognee. Zero of six sign memory, zero offer full-fidelity portability, zero carry portable provenance. Consent is mature; the ability to prove a memory once it leaves the store is shipped by none of them.

Governed, portable agent memory. Signed, scoped, content-addressed records that verify on their own, so a memory moves between agents with its provenance attached. The fifth primitive, after who, may, spends, and did: what the agent knows and remembers. Python and TypeScript, hardened with a v0 adversarial review. v0.

Ask four AI answer engines the same question and they cite the same source only 16% of the time. A firsthand read of how ChatGPT, Claude, Perplexity, and Gemini distribute citations: YouTube the most-cited, a 546-domain long tail, and a distinct personality per engine. The method is open.

See which answer engines cite your URLs across Claude, Perplexity, ChatGPT, and Gemini. Read-only, bring-your-own-keys, stored as a series so you can watch citation rates move. The last roadmap item; the whole roadmap is now shipped.

Portable, signed, resolvable agent identity (did:key + did:web) with the cross-walk onto DID, FIDO, AP2, and EUDI. The fourth primitive: who the agent is. Python and TypeScript. v0.

The full report. The population is inflated tenfold, usage is concentrated, and more than a third of the 500 most-used servers ship a risky code pattern. Firsthand, read-only, open data and method.

Identity, Mandate, Budget, and Witness wired into one governed agent. A reference integration showing the four primitives bound, denied, and audited together in about fifty lines.

A static, read-only read of the source for the 500 most-used servers, added to the open dataset. Aggregate signals only; no live server is probed and per-repo findings are held for the maintainers.

Per-task budget, loop detection, and kill-switch middleware for any LLM call. Deterministic, dependency-free, fail-closed. The third primitive: what the agent spends. v0.

Tamper-evident audit trails for AI agents. Every action is signed and hash-chained, so any tamper is detected and located. Python and TypeScript. v0.

The read-only scanner and the structured dataset behind the State of MCP numbers. If you publish figures, hand people the code to check you.

Sign and verify what an AI agent is allowed to spend on. A plain-language rule becomes a signed mandate, checked against every transaction. v0.

The final essay in the five-layer series. The DID/FIDO/EUDI cross-walk, portable agent credentials, and why identity ships last.

Around 2,400 MCP servers scanned firsthand. The real numbers behind the repeated “10,000+ servers” claim: roughly 1,200 are genuinely evaluable.

The thesis, the five-layer essay series, and the MCP discovery tools (picker and registry tracker).