Agentic web daily · 2026-10-20
OASIS opens 30-day public review of MCP over AMQP 1.0 transport binding
The OASIS AMQP TC put two Committee Specification Drafts out for public review: one carries JSON-RPC 2.0 over AMQP 1.0, the other defines an AMQP 1.0 transport for MCP. Comments close 18 Nov. In payments, Mastercard opened early access to an x402-based agent payment system, and Visa, BILL and Billtrust started a live pilot built on Visa's Trusted Agent Protocol.
Stories
1. OASIS public review: JSON-RPC 2.0 over AMQP 1.0 and MCP over AMQP 1.0 binding specs
governance Model Context Protocol
OASIS and its AMQP TC opened public review of two Committee Specification Draft 01 documents. JSON-RPC 2.0 over AMQP 1.0 covers message bodies, request and reply properties, notifications, batches and correlation. MCP over AMQP 1.0 builds on it to define a transport for MCP version 2026-07-28. It covers message exchange, link topology, cancellation and ordering for direct, brokered and routed connections. The 30-day review started 19 Oct and ends 18 Nov. After the ballots closed, the TC chair merged one further change.
Why it matters: Teams running MCP through message brokers now have a draft standard transport to evaluate. The draft targets MCP version 2026-07-28, so check your protocol version first. Comments must be filed by 18 Nov.
- Invitation to comment on JSON-RPC 2.0 over AMQP 1.0 and MCP over AMQP 1.0 CSD01, ends 18 Nov - OASIS Open · oasis-open.org · 2026-10-20 REPORTED
2. Mastercard opens early access to Agent Pay for Machines, built on x402
launch x402
According to CoinMarketCap, Mastercard opened early access to Agent Pay for Machines. The program gives developers the first version of buyer- and seller-side APIs, a toolkit, a sandbox and documentation. Mastercard says the system builds on x402 and was piloted end to end with Cloudflare, Ant International, AIsa, Base, BVNK, Coinbase and Hype. In the pilot, Coinbase Developer Platform supplied wallet infrastructure, Base handled on-chain settlement, and BVNK acted as the agent wallet, settling in fiat or stablecoins.
Why it matters: A card network is now offering x402 seller-side APIs and a sandbox, giving x402 implementers another counterparty to test against. Early access is the first version, so expect the interfaces to change.
- Mastercard Opens AI Agent Payments to Developers After Coinbase, Base Pilots | CoinMarketCap · coinmarketcap.com · 2026-10-20 REPORTED
3. Visa, BILL and Billtrust start live pilot of agent invoice payments using Trusted Agent Protocol
adoption Visa Trusted Agent Protocol
Visa, BILL and Billtrust announced what they call the first live pilot in which AI agents pay approved buyer invoices end to end through supplier portals. According to the companies, the BILL Payment Agent is registered with Visa's Trusted Agent Protocol and Agentic Directory and pays with tokenized credentials. Billtrust uses Trusted Agent Protocol to recognize, authenticate and grant portal access to the authorized agent, so the agent does not need shared logins.
Why it matters: This is a vendor-announced production use of Trusted Agent Protocol for authenticating agents to credentialed portals. Portal operators weighing agent access can compare it with signature-based bot identification.
- Visa, BILL and Billtrust Launch First Live Pilot for Trusted AI Agent Payments Between Buyer and Supplier Platforms · usa.visa.com · 2026-10-20 REPORTED
- AI Agents for Payments: Visa, BILL & Billtrust Partnership · billtrust.com · 2026-10-20 REPORTED
4. OX Security: MCP STDIO transport runs commands verbatim; Anthropic says this is by design
security Model Context Protocol
According to Forkast and AI Matter, OX Security scanned 15,465 public MCP servers across five registries and found about 0.45% running on personal or home machines, often exposed through tunnels such as ngrok. The report says Anthropic's MCP SDKs for Python, TypeScript, Java, and Rust execute the STDIO 'command' parameter verbatim without sanitization. Anthropic reportedly confirmed this is by design and declined protocol-level changes.
Why it matters: If your host launches MCP servers from a command parameter, you are responsible for sanitizing that input. Do not expose locally tunneled servers unless they need external access.
- Your Home MCP Server Is Probably Unsecured — And the Protocol’s Own Maker Calls the Flaw ‘By Design’ · forkast.news · 2026-10-18 REPORTED
- Anthropic will not change MCP command execution, OX Security finds · AI Matter · aimatter.in · 2026-10-18 REPORTED
5. Web Bot Auth: stricter RFC 9421 checks in Cloudflare's repo; behavior-based trust bands for Verified bots
security Web Bot Auth HTTP Message Signatures, HTTP Message Signatures
Crawler Policy reports two changes to Cloudflare's Web Bot Auth repository. The first rejects signatures that repeat a component identifier in Signature-Input, per RFC 9421 Section 2.5. The second requires any alg parameter to name a registered algorithm that matches the resolved key. Separately, write-ups by Innflows and remio say Cloudflare introduced continuous accountability for Verified bots on October 16. The system scores observed behavior, such as respect for robots.txt and response to rate-limiting, into a trust band.
Why it matters: Verifiers should apply the same duplicate-identifier and alg-matching checks, or signatures may verify inconsistently across implementations. Bot operators should expect robots.txt and HTTP 429 compliance to affect verified status.
- The AI × web ecosystem · Crawler Policy · crawlerpolicy.com · 2026-10-19 REPORTED
- Web Bot Auth and Crawler Trust Bands: What Changes for Sites · innflows.com · 2026-10-19 REPORTED
- Cloudflare’s Continuous Accountability for Verified Bots Turns Identity Into an Ongoing Test · remio.ai · 2026-10-20 REPORTED
6. Cloudflare API MCP server adds step-up authorization
adoption Model Context Protocol
Cloudflare says its API MCP server now supports step-up authorization. Users can grant minimal scopes at connect time and approve more when a task needs them. When a tool call needs an ungranted scope, the server returns an insufficient_scope challenge naming it, and the MCP client asks the user to approve. Scopes already granted are kept.
Why it matters: This is a working server-side example of incremental scope consent in MCP. Client developers should confirm they handle insufficient_scope challenges, since the feature only works in clients that support step-up.
- Cloudflare API MCP server now supports step-up authorization · Changelog · developers.cloudflare.com · 2026-10-19 REPORTED
7. AG-UI 1.0 published with a normative spec, interrupts and subagents
spec Agent-User Interaction Protocol
According to a Habr article by an AG2 engineer, AG-UI released 1.0.0 packages. The release adds interrupts, where an agent pauses a run to wait for a human, along with subagents, reasoning, usage reporting, run cancellation and multimodal tool results. The author says the protocol is now versioned, its behavior is specified normatively with MUST/SHOULD language, and SDKs are generated from a JSON Schema.
Why it matters: Frontends that built custom approval or pause handling can map it onto the standard interrupt events. Teams on pre-1.0 SDKs should review the stricter normative behavior before upgrading.
- AG‑UI 1.0: у протокола наконец появилась спецификация. Разбираем, что изменилось, на связке AG2 + CopilotKit / Хабр · habr.com · 2026-10-19 REPORTED
8. Circle and Proof to demo x401 identity paired with x402 USDC payment
launch x401: HTTP Proof Requirement Protocol, x402
Circle and Proof announced a collaboration. At Money20/20 in Las Vegas, they plan to demo an agent completing an identity-gated purchase. The agent presents a verified Proof credential over x401 and pays in USDC over x402 using a Circle Agent Wallet. Per the press release, x401 uses the HTTP 401 response to state the identity proof required, while x402 uses HTTP 402 to state the payment.
Why it matters: Merchants that need both proof of authorization and payment can see how the two HTTP challenge patterns compose in one flow. So far this is a demo, not a shipped integration.
- Circle teams with Proof to pair verified AI agent identity (x401)... · marketchameleon.com · 2026-10-20 REPORTED
9. Crawls: soft 404s inflate llms.txt counts; 13.6% of top sites block GPTBot
research llms.txt, AI Crawler User-Agent Tokens in robots.txt
Technical SEO News reports an EU crawl by machinewitness.eu. A check for a 200 at /llms.txt counted 20,804 domains (16.2%), but only 7.04% of 128,315 domains served a file whose first line is a Markdown heading. Another 10,138 returned HTML, mostly error pages. Separately, ContextFetch reports that 13.6% of top sites with readable robots.txt block GPTBot site-wide. It also found that 11.6% of 7,462 sites answering /llms.txt serve one.
Why it matters: When auditing llms.txt, check the content type and confirm the first line is a Markdown heading. A status code alone is not enough. The same soft-404 issue can affect any well-known file check.
- Nearly half of llms.txt files a status check finds are error pages · technicalseonews.com · 2026-10-18 REPORTED
- Who blocks AI crawlers: the top 10,000 sites, checked | ContextFetch · contextfetch.dev · 2026-10-19 REPORTED
10. OpenA2A decoy MCP servers log 420 tool calls as connection events fall
security Model Context Protocol
According to AI.info, OpenA2A's decoy MCP servers received 420 tool calls in the 30-day window ending October 19, up from nine in the previous window. Over the same period, connection events fell. The calls came from 19 distinct fingerprints and requested tools including shell execution, secret retrieval and file reads. OpenA2A also recorded 34 resource reads.
Why it matters: The report recommends alerting on tool calls to servers expected to be idle rather than on connection volume. Operators can apply this directly to their MCP monitoring.
- OpenA2A Records 420 Calls to Decoy MCP Servers | AI.info · ai.info · 2026-10-19 REPORTED
The numbers
We re-check a fixed panel of 219 domains every day through the same /check/ report anyone can run. 218 answered today (1 could not be checked and are left out of every comparison). This is the first snapshot, so there is nothing to compare yet.
| A+ | A | B | C | D | F |
|---|---|---|---|---|---|
| 10 | 21 | 76 | 70 | 6 | 35 |
Adoption across the panel
| Standard | Domains | Change |
|---|---|---|
| AI Crawler User-Agent Tokens in robots.txt | 173 / 218 | – |
| llms.txt | 105 / 218 | – |
| Content Signals Policy | 36 / 218 | – |
| api-catalog: A Well-Known URI and Link Relation to Help Discovery of APIs | 19 / 218 | – |
| OAuth Protected Resource and Authorization Server Metadata (as used for agent authorization) | 19 / 218 | – |
| AI Catalog well-known file | 17 / 218 | – |
| AGENTS.md | 14 / 218 | – |
| Agent2Agent Protocol | 13 / 218 | – |
| OAuth Client ID Metadata Document | 13 / 218 | – |
| Model Context Protocol | 7 / 218 | – |
| MCP Server Cards (SEP-2127) | 7 / 218 | – |
| agents.txt | 6 / 218 | – |
| Agentic Resource Discovery | 6 / 218 | – |
| auth.md | 6 / 218 | – |
| Really Simple Licensing | 3 / 218 | – |
| Text and Data Mining Reservation Protocol | 3 / 218 | – |
| Web Bot Auth HTTP Message Signatures | 3 / 218 | – |
| Identity Assertion JWT Authorization Grant | 2 / 218 | – |
| Agent Directory Service | 1 / 218 | – |
| agent-permissions.json | 1 / 218 | – |
| agents.json | 1 / 218 | – |
| Agora Protocol | 1 / 218 | – |
| Universal Commerce Protocol | 1 / 218 | – |
Official MCP Registry: 1708 servers (3000 versions) published or updated since 2026-10-19.
How this digest was made
Items are written only from the cited sources and our own measurements; every number in an item appears in a source it cites. VERIFIED = fetched from the standard's issuer or a standards body; REPORTED = a claim by press or a third party.
Sources searched: feeds 0, datatracker 0, hn 0, arxiv 12, exa 107, parallel 5, tips 19. 143 candidates, 130 new, 49 kept by triage (claude-haiku-5-5), 30 facts given to the writer (claude-opus-5-5).
Window 2026-10-18T18:00:00Z to 2026-10-20T21:30:57Z. Generated 2026-10-20T21:57:07Z. Licence CC BY 4.0.