What we've shipped

The argument behind the State of Agent Memory report. An agent's memory is a claim you take on faith: zero of six leading systems sign memory, zero export it at full fidelity, zero carry portable provenance, and only three ship regulatory-grade consent. Memory is moving from a convenience feature to the substrate agents transact on, and an unsigned memory undermines a signed mandate. Why the fix is a portable, signed, consent-bound record rather than a better store, and where RememberKit fits.

Refreshed from the June 18 sweep and widened from one finding to three. The Major Labs Trust Index for the MCP ecosystem sits at 38 out of 100: Code Safety 64.4, Identity 24.6, Supply Chain 24.8. The headline numbers, all firsthand: 44,347 servers advertised across three registries but roughly 1,934 genuinely evaluable, a 23x gap; 36% of the maintained core ship a risky code pattern; 25% touch sensitive data with no authentication layer, the authorization gap agentic commerce keeps hitting; and 75% ship a known-vulnerable dependency. The report PDF and the web page both carry the new pillars; the live scoreboard updates weekly.

When an AI agent pays, the merchant or PSP on the other side has no contract with the issuer, so it cannot verify the payment mandate is genuine, in scope, or still live. Clearpoint answers exactly that. Present an AP2 mandate and get back a signed verdict with a machine-readable reason, a revocation status, and a tamper-evident hash-chained receipt, priced per verification at the money moment. It runs on two primitives we already ship in the open, MandateKit (AP2-tagged signing and verification) and WitnessKit (the receipt chain), in two modes: trusted, where you pin the issuer keys, and integrity-only. The live demo lets you try to break it: talk a shopping agent into a banned purchase, then watch the gateway block the same charge and seal it into the chain. v1 is scoped to signature, scope, expiry, a hosted revocation list, and signed receipts, and it shipped security-hardened. We are looking for design partners.

The scoreboards now roll up into a single weekly score: how safe is the agentic web to actually transact on? Version 1 fuses three firsthand, read-only pillars, each 100 minus the share at risk: Code Safety (risky code patterns), Identity (network-facing sensitive servers with no auth), and Supply Chain (servers shipping a dependency with a known advisory). The equal-weighted composite lands at 38 out of 100. It is published with a versioned methodology, a machine-readable trust-index.json, a cite-this block, and an embeddable badge. Like every series here it compounds weekly and cannot be backfilled, so the first mover holds a record no one who starts later can match.

The prompt-injection sandbox returns. A shopping agent has $50 and one approved merchant; you write a product page that tries to talk it into spending your money somewhere it should not. Your page runs past two agents side by side: one defended only by its system prompt, which can be talked into anything, and the same agent behind a gateway that checks every purchase against identity, mandate, budget, and an append-only witness log before it happens. The prompt-only side breaks; the governed side holds. It runs live when a model key is configured and falls back to a deterministic simulation otherwise, so the gateway checks are identical either way. The four primitives behind it (IdentityKit, MandateKit, BudgetGuard, WitnessKit) are open source.

The sweep grew three measurements. Supply chain: we resolved 32,000 declared dependencies across 1,344 servers against OSV.dev and found 74.6% ship a runtime dependency with a known advisory, the widest reach running through the official @modelcontextprotocol/sdk itself. Commerce: a full-day, read-only sample of the EIP-3009 gasless-settlement rail on Base USDC (the rail x402 rides) clocks ~180K agent settlements a day, ~5.4M a month, from 12,000 unique payer addresses. Remediation: we froze the highest-risk cohort and re-scanned it, and before any outreach 43 of 47 were unchanged, so high-risk servers do not fix themselves. All three are aggregate-only, run on the weekly cadence, and now appear on /security and /data.

A second weekly sweep joins /security: of the network-facing MCP servers that take sensitive actions (shell, file writes, database writes, mail or money), 74.5% show no identity layer anywhere in their source. Static, read-only, aggregate-only, with the headline deliberately cut to network-facing servers because stdio servers legitimately delegate identity to the host. The page is the instrument; IdentityKit is the response.

Every public registry ranks MCP servers by stars and recency. This one scores 2,479 servers on signals that matter: maintenance, documentation, license, adoption, transport, plus two earned badges (identity layer, clean security sweep). Praise-only by design: security and identity appear only as credits, findings stay in coordinated disclosure, and negative per-repo data never enters the public payload. Methodology published on the page; scores rise on the next sweep when maintainers fix things.

Seven agent-payment rails (Visa TAP, PayPal Agent Ready, OpenAI/Stripe ACP, Google AP2 + UCP, x402, MCP) assessed from primary specifications and scored Portable, Federated, or Walled. At launch: 2 Portable, 4 Federated, 1 Walled — and the identity layer has already quietly converged on a shared open signature standard while the mandate layer stays locked per network. Live and announced strictly separated, every cell primary-sourced, x402-tracker discipline.

The same checks behind the /security scoreboard, packaged as a one-line GitHub Action. Drop it into your MCP server's CI and every push gets a security-surface score, a job summary, and a README badge comparable to the rest of the swept ecosystem. Static analysis of your own source only: it never connects to, runs, or probes anything. v1 tagged and public.

The static security sweep the scanner promised is now a live scoreboard. Weekly read-only analysis of the most-used active MCP servers: risk-surface tiers, pattern prevalence (SSRF surface, command injection, code execution), and a trendline that compounds with every sweep. Aggregate-only by design: per-repo findings go to maintainers through coordinated disclosure, and after the first cycle a fixed-since-last-sweep feed will name the good actors. Never probes a running server; the checks are public Python anyone can read.

An adversarial source review of all five primitives (Python + TypeScript) drove a hardening release. Fixed: a did:web SSRF guard bypass in IdentityKit, a cross-language expiry divergence in MandateKit, a record() fail-open in BudgetGuard, cross-agent memory censorship in RememberKit, and the shared canonicalization fallback now fails closed. Every fix is locked by a regression test. v0.0.2 is live on PyPI; still v0, experimental, unaudited by a third party.

All five primitives are live on PyPI and npm: identitykit, mandatekit, budget-guard-agents, witnesskit, rememberkit. One pip install away from a governed agent, in Python or TypeScript. Every package verified with a clean install from the public registries. v0, experimental, honestly labeled.

We read six agent-memory systems firsthand: Letta, Mem0, Zep, LangMem, model-native memory, and Cognee. Zero of six sign memory, zero offer full-fidelity portability, zero carry portable provenance. Consent is mature; the ability to prove a memory once it leaves the store is shipped by none of them.

Governed, portable agent memory. Signed, scoped, content-addressed records that verify on their own, so a memory moves between agents with its provenance attached. The fifth primitive, after who, may, spends, and did: what the agent knows and remembers. Python and TypeScript, hardened with a v0 adversarial review. v0.

Ask four AI answer engines the same question and they cite the same source only 16% of the time. A firsthand read of how ChatGPT, Claude, Perplexity, and Gemini distribute citations: YouTube the most-cited, a 546-domain long tail, and a distinct personality per engine. The method is open.

See which answer engines cite your URLs across Claude, Perplexity, ChatGPT, and Gemini. Read-only, bring-your-own-keys, stored as a series so you can watch citation rates move. The last roadmap item; the whole roadmap is now shipped.

Portable, signed, resolvable agent identity (did:key + did:web) with the cross-walk onto DID, FIDO, AP2, and EUDI. The fourth primitive: who the agent is. Python and TypeScript. v0.

The full report. The population is inflated tenfold, usage is concentrated, and more than a third of the 500 most-used servers ship a risky code pattern. Firsthand, read-only, open data and method.

Identity, Mandate, Budget, and Witness wired into one governed agent. A reference integration showing the four primitives bound, denied, and audited together in about fifty lines.

A static, read-only read of the source for the 500 most-used servers, added to the open dataset. Aggregate signals only; no live server is probed and per-repo findings are held for the maintainers.

Per-task budget, loop detection, and kill-switch middleware for any LLM call. Deterministic, dependency-free, fail-closed. The third primitive: what the agent spends. v0.

Tamper-evident audit trails for AI agents. Every action is signed and hash-chained, so any tamper is detected and located. Python and TypeScript. v0.

The read-only scanner and the structured dataset behind the State of MCP numbers. If you publish figures, hand people the code to check you.

Sign and verify what an AI agent is allowed to spend on. A plain-language rule becomes a signed mandate, checked against every transaction. v0.

The final essay in the five-layer series. The DID/FIDO/EUDI cross-walk, portable agent credentials, and why identity ships last.

Around 2,400 MCP servers scanned firsthand. The real numbers behind the repeated “10,000+ servers” claim: roughly 1,200 are genuinely evaluable.

The thesis, the five-layer essay series, and the MCP discovery tools (picker and registry tracker).