https://majorlabs.co/latest What Major Labs has shipped: tools, essays, and data, newest first. Dated entries from the public build log. https://majorlabs.co/data 2026-09-12-Major Labs is now an MCP server 2026-09-12 The lab that measures the MCP ecosystem is now queryable through it. POST to majorlabs.co/mcp and five tools serve the live datasets: the Agent Trust Index, MCP ecosystem statistics, the Frontier Incident Timeline, the Agent Identity Tracker, and Threshold Watch. Stateless JSON-RPC over streamable HTTP, read-only, no auth, no tracking, CC-BY-4.0 with a cite-us instruction in the handshake. Point any MCP client at the URL and the numbers are in your agent's context. Also new on /data: a release calendar, so you know when the next number lands before it does; and Threshold Watch's RSS change feed now announces itself to feed readers site-wide. https://majorlabs.co/kya 2026-09-11-The Agent Identity Tracker — who gets to know your agent 2026-09-11 A new living dataset at /kya: every announced framework, protocol, standard, and regulation for AI agent identity, delegation, and know-your-agent verification, from this week's Ant-Mastercard-Visa KYA interoperability framework back through DIF's KYA-OS, Google's AP2 mandates, Cloudflare's Web Bot Auth and the IETF working group standardizing it, NIST's agent standards initiative, and the EUDI wallet regulation anchoring the principal end. Nineteen entries at launch, each dated and traced to a primary source, with published inclusion criteria and a machine-readable JSON feed at /kya/feed under CC-BY-4.0. Strictly factual: records of announcements, not endorsements. The industry started building the who-authorized-this layer; somebody should be keeping the list. https://majorlabs.co/incidents/feed 2026-09-11-Incidents go machine-readable; Major Labs Weekly opens for signup 2026-09-11 The Frontier Incident Timeline now ships a JSON feed at /incidents/feed (CC-BY-4.0) with a stable schema, so researchers and agents can consume the record without scraping. And the site's signup form now feeds a real list: Major Labs Weekly, the Saturday sweep's numbers brief as an email, one edition a week, numbers first. The old form had been posting into a Netlify inbox connected to nothing; its subscribers were imported. https://github.com/marketplace/actions/mcp-surface-check 2026-09-11-MCP Surface Check v1.1.0 — fixed, released, and on the GitHub Marketplace 2026-09-11 The published Action had been invoking a renamed script, so every install since launch failed; v1.1.0 fixes the entrypoint, and the v1 tag now tracks the release so existing pins pick up the fix automatically. The release also adds optional SARIF 2.1.0 output, wired for GitHub code scanning via the standard upload step. And the Action is now listed on the GitHub Marketplace under Security and Continuous integration, searchable where CI tooling actually gets found. One workflow file, no runtime access, read-only by design. https://majorlabs.co/security 2026-09-10-Break the Agent, retired 2026-09-10 The prompt-injection sandbox is deprecated and /break now redirects to /security. The lesson it taught, that a prompt is not a security boundary and verifiable runtime checks are, lives on in the primitives that powered it (IdentityKit, MandateKit, BudgetGuard, WitnessKit) and in the Clearpoint demo, which exercises the same gateway against real mandate verification. Retiring the standalone page keeps the surface area honest: one interactive demonstration, maintained, beats two half-watched ones. https://majorlabs.co/spec/SPEC.md 2026-09-09-The Safety Framework Publication Format v0.1 — commitment one, made concrete 2026-09-09 Every frontier lab publishes a safety framework; none publishes it in a form a third party can verify. This spec is the missing format: a machine-readable schema for capability thresholds, evaluation gates, deployment conditions, and escalation commitments; a hash-anchored changelog format with a closed change-type vocabulary (a weakened threshold can no longer be filed as a clarification); a standard-library validator; and an unofficial reference mapping of Anthropic's RSP v3.4 built from a dated Threshold Watch snapshot, showing what adoption looks like. Four conformance levels, L0 Published through L3 Changelogged, aligned to the Threshold Watch scoreboard, which now doubles as a conformance report. Current state: six labs at L0, four at L1, zero at L2 or L3. CC0. Adopting it costs a lab an afternoon. Completes the stack: the Compact states the principles, the Clauses put them in contracts, this spec makes them machine-verifiable, Threshold Watch watches. https://majorlabs.co/data 2026-09-09-The public dataset — the longitudinal MCP series, citable 2026-09-09 The measurement series behind the State of MCP work is now a versioned, downloadable bundle: the 3,227-repo census, 112 discovery runs of provenance, the weekly aggregate series, and score distributions for security (2,408 scanned), identity (2,330), and supply chain (1,399). Aggregates only: per-repo findings stay in the private disclosure queue, as the disclosure process requires. Checksummed, licensed CC-BY-4.0, with a plain citation and BibTeX on the data page and a CITATION.cff in the repo. DOI pending via Zenodo. If you use the numbers, cite the dataset. https://majorlabs.co/ 2026-09-09-The observatory — measurement-first, with machine-readable surfaces 2026-09-09 Major Labs now describes itself as what it has become: the observatory for the agentic web. The homepage leads with the four instruments (the census, Threshold Watch, the incident timeline, the trust scoreboard), every stat card carries a verified Q3 measurement, and third-party volume claims that later measurement did not sustain are gone from evergreen pages, with a dated correction note on the founding essay rather than a silent rewrite. Under the hood: a rebuilt llms.txt, Dataset and ItemList structured data on the incident timeline and both Q3 reports, dated quotable claims on the live surfaces, and a sitemap that now actually lists the Q3 reports. https://majorlabs.co/clauses 2026-09-08-The Compact Clauses — procurement language for the agent era 2026-09-08 Three copy-paste contract riders implementing the Control Stack Compact's buyer-side commitments: frontier AI incident disclosure on a 72-hour clock, attributable agents with reconstruction and revocation duties, and liability allocation with a cap carve-out for undisclosed incidents. Written as MSA-style riders with negotiation commentary, versioned (v0.1), CC0, and explicitly not legal advice: the point is that a buyer's negotiation starts from 'adjust this' instead of a blank page. The buyer side of the Compact, made copy-pasteable. https://majorlabs.co/incidents 2026-09-08-The Frontier Incident Timeline — a standing record of control incidents 2026-09-08 A dated, sourced public record of frontier AI control incidents: the May–June rogue-swarm takeover of a German wiki, the July sandbox escape that reached Hugging Face and OpenAI's own research cluster (six days of outside investigation, then silence), the UK AISI evaluation in which agents built fake identities and targeted real people, and the chief-scientist disclosure that chain-of-thought monitoring is degrading. Inclusion criteria published; every claim traces to a listed source; submissions via GitHub issues. Aviation keeps its incident record; this page is ours. https://majorlabs.co/threshold-watch 2026-09-08-Threshold Watch expands: six labs, a scoreboard, and a change feed 2026-09-08 Coverage grows from three labs to six with xAI's Frontier AI Framework (June 2026 edition), Meta's Advanced AI Scaling Framework (whose PDF rejects automated retrieval, a failure the page shows on purpose), and Amazon's Frontier Model Safety Framework. New commitment-one scoreboard: all six labs publish a framework, none publishes a changelog a third party can verify. Changes now ship as an RSS feed, so a framework edit becomes a subscribable event. https://majorlabs.co/threshold-watch 2026-09-08-Threshold Watch — versioning the labs' safety frameworks for them 2026-09-08 Every frontier lab publishes a safety framework; none publishes a version history. Threshold Watch fetches each lab's canonical document on a cadence, normalizes it, hashes it, and archives a dated snapshot when the content changes, with diffs where the source is text. Launch coverage: Anthropic's Responsible Scaling Policy (v3.4), OpenAI's Preparedness Framework (v2, tracked via the canonical PDF because openai.com blocks automated retrieval of the page), and Google DeepMind's Frontier Safety Framework (3.1). First snapshots archived September 8. Read-only, method public, fetch failures shown as-is. https://github.com/major-matters/mandatekit 2026-09-08-mandatekit-mcp — a signed mandate in front of every MCP tool call 2026-09-08 MandateKit grew an MCP gating proxy: one command wraps any stdio MCP server and verifies every tools/call against an Ed25519-signed mandate before it executes. The mandate's categories list becomes a signed tool allowlist, merchant pinning binds a mandate to one named server, and per-call amounts are capped by max_amount. Fail-closed: unparseable frames, tampered mandates, and untrusted signers are denied, and denials return to the agent as error results carrying the reason. Ships in the mandatekit Python package as mandatekit-mcp; ten unit tests plus an end-to-end smoke. https://majorlabs.co/reports/state-of-mcp-security-q3 2026-09-07-The State of MCP — Q3 security re-base 2026-09-07 The first fresh deep scan since Q2, and an honest one. Measured with the same instrument as last quarter, MCP security did not improve: the share of maintained servers carrying a risky code pattern rose to 37.5 percent from 35.4, high-severity servers climbed to 67 from 55, and identity is stuck, with 576 of 733 sensitive network-facing servers (78.6 percent) still shipping no authentication in source. The sharpest finding needs a tracked cohort: of a 47-server high-risk cohort frozen in Q2, nine of which were contacted through the first coordinated-disclosure batch, re-scanning found 2 fully fixed, 4 reduced, 35 unchanged, and 6 worse. Disclosure is necessary and not sufficient, and most of the cohort has not yet been contacted at all. The supply-chain scanner changed method this quarter, so its exposure rate is a re-baseline rather than a delta, and because it feeds the composite, the Trust Index is deliberately withheld this quarter rather than move for a reason that is not real. From next quarter all three pillars share a stable method and the composite resumes. The pipeline now stamps every pillar with its own scan date and warns when one is carried forward too long, so a stale number never ships as a fresh one again. https://majorlabs.co/reports/state-of-mcp-q3 2026-09-07-The State of MCP — Q3 delta 2026-09-07 The first delta edition of the series, built on 18 weekly scans from May 31 to August 31. The MCP server population grew 31 percent to 3,166, roughly 42 net new servers a week and no single-week surge. The fastest-growing slice was remote-hosted servers at +43 percent, the part of the ecosystem with the widest attack surface. The stale share held flat at 23.5 percent, so MCP is scaling with its composition fixed, neither maturing nor decaying on net. This edition reports population movement only: the deep security, identity, and supply-chain pillars are disclosure-sensitive, run manually rather than weekly, and are being re-based this quarter, so no security-posture delta is claimed. The next edition will report those pillars from a fresh deep scan. https://majorlabs.co/essays/the-unsigned-memory-problem 2026-06-19-The unsigned memory problem 2026-06-19 The argument behind the State of Agent Memory report. An agent's memory is a claim you take on faith: zero of six leading systems sign memory, zero export it at full fidelity, zero carry portable provenance, and only three ship regulatory-grade consent. Memory is moving from a convenience feature to the substrate agents transact on, and an unsigned memory undermines a signed mandate. Why the fix is a portable, signed, consent-bound record rather than a better store, and where RememberKit fits. https://majorlabs.co/reports/state-of-mcp 2026-06-19-The State of MCP — June update, now a three-pillar read 2026-06-19 Refreshed from the June 18 sweep and widened from one finding to three. The Major Labs Trust Index for the MCP ecosystem sits at 38 out of 100: Code Safety 64.4, Identity 24.6, Supply Chain 24.8. The headline numbers, all firsthand: 44,347 servers advertised across three registries but roughly 1,934 genuinely evaluable, a 23x gap; 36% of the maintained core ship a risky code pattern; 25% touch sensitive data with no authentication layer, the authorization gap agentic commerce keeps hitting; and 75% ship a known-vulnerable dependency. The report PDF and the web page both carry the new pillars; the live scoreboard updates weekly. https://clearpoint.majorlabs.co 2026-06-17-Clearpoint — neutral verification for agent payments, live 2026-06-17 When an AI agent pays, the merchant or PSP on the other side has no contract with the issuer, so it cannot verify the payment mandate is genuine, in scope, or still live. Clearpoint answers exactly that. Present an AP2 mandate and get back a signed verdict with a machine-readable reason, a revocation status, and a tamper-evident hash-chained receipt, priced per verification at the money moment. It runs on two primitives we already ship in the open, MandateKit (AP2-tagged signing and verification) and WitnessKit (the receipt chain), in two modes: trusted, where you pin the issuer keys, and integrity-only. The live demo lets you try to break it: talk a shopping agent into a banned purchase, then watch the gateway block the same charge and seal it into the chain. v1 is scoped to signature, scope, expiry, a hosted revocation list, and signed receipts, and it shipped security-hardened. We are looking for design partners. https://majorlabs.co/trust 2026-06-16-/trust — the Agent Trust Index, one number for the agentic web 2026-06-16 The scoreboards now roll up into a single weekly score: how safe is the agentic web to actually transact on? Version 1 fuses three firsthand, read-only pillars, each 100 minus the share at risk: Code Safety (risky code patterns), Identity (network-facing sensitive servers with no auth), and Supply Chain (servers shipping a dependency with a known advisory). The equal-weighted composite lands at 38 out of 100. It is published with a versioned methodology, a machine-readable trust-index.json, a cite-this block, and an embeddable badge. Like every series here it compounds weekly and cannot be backfilled, so the first mover holds a record no one who starts later can match. https://majorlabs.co/break 2026-06-16-Break the Agent, back and open 2026-06-16 The prompt-injection sandbox returns. A shopping agent has $50 and one approved merchant; you write a product page that tries to talk it into spending your money somewhere it should not. Your page runs past two agents side by side: one defended only by its system prompt, which can be talked into anything, and the same agent behind a gateway that checks every purchase against identity, mandate, budget, and an append-only witness log before it happens. The prompt-only side breaks; the governed side holds. It runs live when a model key is configured and falls back to a deterministic simulation otherwise, so the gateway checks are identical either way. The four primitives behind it (IdentityKit, MandateKit, BudgetGuard, WitnessKit) are open source. https://majorlabs.co/security 2026-06-15-Three new firsthand datasets: supply chain, on-chain commerce, remediation 2026-06-15 The sweep grew three measurements. Supply chain: we resolved 32,000 declared dependencies across 1,344 servers against OSV.dev and found 74.6% ship a runtime dependency with a known advisory, the widest reach running through the official @modelcontextprotocol/sdk itself. Commerce: a full-day, read-only sample of the EIP-3009 gasless-settlement rail on Base USDC (the rail x402 rides) clocks ~180K agent settlements a day, ~5.4M a month, from 12,000 unique payer addresses. Remediation: we froze the highest-risk cohort and re-scanned it, and before any outreach 43 of 47 were unchanged, so high-risk servers do not fix themselves. All three are aggregate-only, run on the weekly cadence, and now appear on /security and /data. https://majorlabs.co/identity 2026-06-12-/identity — the identity gap, measured 2026-06-12 A second weekly sweep joins /security: of the network-facing MCP servers that take sensitive actions (shell, file writes, database writes, mail or money), 74.5% show no identity layer anywhere in their source. Static, read-only, aggregate-only, with the headline deliberately cut to network-facing servers because stdio servers legitimately delegate identity to the host. The page is the instrument; IdentityKit is the response. https://majorlabs.co/registry 2026-06-12-/registry — the MCP registry, scored 2026-06-12 Every public registry ranks MCP servers by stars and recency. This one scores 2,479 servers on signals that matter: maintenance, documentation, license, adoption, transport, plus two earned badges (identity layer, clean security sweep). Praise-only by design: security and identity appear only as credits, findings stay in coordinated disclosure, and negative per-repo data never enters the public payload. Methodology published on the page; scores rise on the next sweep when maintainers fix things. https://majorlabs.co/mandates 2026-06-12-/mandates — State of Agent Mandates 2026-06-12 Seven agent-payment rails (Visa TAP, PayPal Agent Ready, OpenAI/Stripe ACP, Google AP2 + UCP, x402, MCP) assessed from primary specifications and scored Portable, Federated, or Walled. At launch: 2 Portable, 4 Federated, 1 Walled — and the identity layer has already quietly converged on a shared open signature standard while the mandate layer stays locked per network. Live and announced strictly separated, every cell primary-sourced, x402-tracker discipline. https://github.com/major-matters/mcp-surfacecheck 2026-06-10-MCP Surface Check — the sweep as a GitHub Action 2026-06-10 The same checks behind the /security scoreboard, packaged as a one-line GitHub Action. Drop it into your MCP server's CI and every push gets a security-surface score, a job summary, and a README badge comparable to the rest of the swept ecosystem. Static analysis of your own source only: it never connects to, runs, or probes anything. v1 tagged and public. https://majorlabs.co/security 2026-06-10-/security — the security surface, live 2026-06-10 The static security sweep the scanner promised is now a live scoreboard. Weekly read-only analysis of the most-used active MCP servers: risk-surface tiers, pattern prevalence (SSRF surface, command injection, code execution), and a trendline that compounds with every sweep. Aggregate-only by design: per-repo findings go to maintainers through coordinated disclosure, and after the first cycle a fixed-since-last-sweep feed will name the good actors. Never probes a running server; the checks are public Python anyone can read. https://pypi.org/project/identitykit/ 2026-06-10-Suite v0.0.2 — internal security audit and hardening 2026-06-10 An adversarial source review of all five primitives (Python + TypeScript) drove a hardening release. Fixed: a did:web SSRF guard bypass in IdentityKit, a cross-language expiry divergence in MandateKit, a record() fail-open in BudgetGuard, cross-agent memory censorship in RememberKit, and the shared canonicalization fallback now fails closed. Every fix is locked by a regression test. v0.0.2 is live on PyPI; still v0, experimental, unaudited by a third party. https://github.com/major-matters 2026-06-10-The suite is installable 2026-06-10 All five primitives are live on PyPI and npm: identitykit, mandatekit, budget-guard-agents, witnesskit, rememberkit. One pip install away from a governed agent, in Python or TypeScript. Every package verified with a clean install from the public registries. v0, experimental, honestly labeled. https://majorlabs.co/reports/state-of-agent-memory 2026-06-09-The State of Agent Memory 2026-06-09 We read six agent-memory systems firsthand: Letta, Mem0, Zep, LangMem, model-native memory, and Cognee. Zero of six sign memory, zero offer full-fidelity portability, zero carry portable provenance. Consent is mature; the ability to prove a memory once it leaves the store is shipped by none of them. https://github.com/major-matters/rememberkit 2026-06-09-RememberKit 2026-06-09 Governed, portable agent memory. Signed, scoped, content-addressed records that verify on their own, so a memory moves between agents with its provenance attached. The fifth primitive, after who, may, spends, and did: what the agent knows and remembers. Python and TypeScript, hardened with a v0 adversarial review. v0.