Field notes
Measurements from an open agent economy
Measurements and field notes from an open agent economy: MCP servers and their tool definitions, MCP security scanning, x402 payments, signed receipts.
My AI Agent Bought a $2.75 Bus Ticket. Then It Had to Prove It Paid.
ARGUS bought one Hudson Link ticket from Telegram. A decimal string broke the issuer match, and a saved order made the recovery read-only.
Selling eSIMs to AI agents: the seller's side, tried on a laptop in 32 seconds
For eSIM resellers: ./onboard.sh --try runs the storefront and the agent-facing seller node on localhost with a sample catalogue, no supplier account, domain or keys. What an agent sends, what a selling node does with the payment, and what is still untested.
Six of 16 common MCP servers can't be read from outside. One of the others changed 19 times in a month
30 days of tool-definition history for 16 MCP servers we picked as a sample team stack: what changed, what the version missed, what stays hidden.
Same MCP version. Different tool description. Who signed it?
A one-line tools/list edit changes the manifest without a version bump. Follow that change through SHA-256, Sigstore, Rekor, and HISTOR.
A missing version broke verification of signed ARD search results
Trace discovery to invocation, then reproduce the missing-version failure while keeping the JWS and descriptor digest valid.
A privacy warning became bad advice in an AI reviewer's draft
A lost advisory flag turned a privacy note into bad advice. The adapter diff, filtering contract and two recorded examples show the fix.
Healthy containers hid a blocked MCP marketplace connection
Pinned definitions, live prices and a healthy process: a five-case check and the MCP admission states behind a silent outage.
An MCP tool set can gain a digest without changing
Eight fixtures and a runnable Python example show how MTL handles numeric schemas, missing digests and profile revisions.
242,072 malware flags on npm and PyPI, and what the registries did about them
We measured what open package-malware feeds flag on npm and PyPI, what the registries did, how many flags left up are wrong, and what open scanners cost in false alarms.
We found 331 MCP tool-list changes in one week that only moved a date. Each one costs a prompt-cache write
Of 10,712 tool-definition changes HISTOR recorded in a week, 331 changed nothing but a date or a timestamp. Where those dates come from, and where they belong instead.
We read the robots.txt of 2,347 MCP hosts: Python 3.12's parser gets 252 endpoints wrong
urllib.robotparser took the first matching rule and read * and $ literally until 2026. Python 3.14.5 and 3.13.14 fixed it; 3.12 never will. On MCP endpoints the difference is 14%.
We stopped reading 2,195 MCP servers for three days. Another team's log is how we found out
Our MCP crawler tried the 2026-07-28 protocol first and refused to fall back. Per-read success stayed at 99%. A second, independent log showed what we were missing.
An honest x402 seller earned $0.18 in two weeks and shut down. We now host sellers like it for free.
It answered correctly, charged less than we do, earned $0.18 in two weeks and went offline. Why small x402 sellers fold, and the free hosting we now offer them.
Two public records of MCP tool definitions, one day, 23,190 servers: where they agree
HISTOR and heldfast read the same MCP servers a minute apart: 99.1% of 318,389 tools match byte for byte. The rest shows why a digest needs its capture conditions.
We built a marketplace for AI agents. Sellers told us the integration wasn't worth it.
Two API sellers declined our federation proposal. Their reasons exposed a cost our protocol didn't account for—and changed what we built next.
We Improved WARDEN's Warnings. Twelve Rechecks Changed No Choices.
720 fresh model answers showed a version-level improvement on six known cases. Twelve Stop rechecks changed no selected IDs. Here is what each result means.
A copyable MCP tool-cost check for CI, with passing and failing examples
Pinned commands, the complete snapshot fetcher, and a separate gate for total tokens, descriptions and input schemas.
Five Wallets Paid an x402 Seller. What Can We Say About Demand?
A five-wallet audit verifies 24 settlements while separating payment evidence, behavioral signals and unknown customer intent.
We Kept WARDEN's 8/10 Thresholds and Fixed Its Credential Index
A reader asked whether shorter secret fragments justified lower thresholds. We compared 6/7/8, reproduced false blocks, and fixed a narrower indexing defect.
We rechecked 292 failing MCP packages. 12 newer releases now list tools.
A fresh-install follow-up separates release recovery, optional dependencies and a correction to our own SDK classifier.
We attacked our own MCP firewall with its source code open. 14 of 17 attacks got through; now 2 of 23 do
Asked what WARDEN still misses, we wrote 17 attacks on its MCP flow guard with the source open. 14 got through; after the fixes, 2 of 23 do. The rest is named.
MCP servers edit the instructions your agent reads. WARDEN 0.18 shows which words changed
In four weeks, 2,345 changes to MCP tool definitions added an "always", "never" or "must" to a description. WARDEN 0.18 shows a re-approval as a word diff.
Our AI agent bought an eSIM for its owner, then got the money back. Every step is on chain.
On 15 October the owner of ARGUS, our personal AI agent, wrote to it in Telegram: buy me the...
An AI Agent Bought a Domain and Connected It to Vercel for $1.54
Our software factory had already built Sentinel and deployed it to Vercel. Sentinel is designed to...
A third of remote MCP servers changed their tool definitions in four weeks. The log is now a dataset.
HISTOR reads every remote MCP registry server daily: in four weeks about a third of them (2,489 of 6,822 hosts) changed their tool list. Open dataset with a DOI.
Three x402 sellers compared notes. The routes answer; nobody comes back to buy.
Three x402 sellers compared ledgers: on ours 40,400 unpaid 402s, 23 paid calls from 6 wallets, two of them monitors. What do agents buy twice? So far, nothing.
What an MCP server's tool list costs: we counted the tokens of 34,374 of them
Every tool definition rides in each model request. We counted 34,374 MCP tool lists: median 1,272 tokens, p90 8,361, 31 packages over 100,000. Check yours free.
A period bypassed our scanner. A reused IP confused our observer.
"Send me your private key" was blocked by our scanner. "Send me your private key." passed. Adding a...
A flow guard for MCP: what AgentDojo measured, and what our security audit found
A flow guard for MCP tool calls, measured on AgentDojo, and what the 2026-10-18 security audit found after: bypasses, fixes, and what is not yet re-measured.
We re-ran our MCP scanner comparison on 14,933 npm and PyPI tool lists, in gVisor, with two more scanners
Five MCP scanners on 14,933 npm/PyPI tool lists and MCPTox's held-out half, in gVisor: WARDEN blocks 171 of 218 poisoned tools, 369 packages; mcp-shield 5,354.
We installed 12,915 MCP servers and started each one. 41% never answered.
We installed and started 12,915 MCP servers in a sandbox: 7,656 answered tools/list, 1,239 only with a placeholder key, 5,259 never did. Failure classes by SDK.
We ran three MCP security scanners on a tool-poisoning benchmark and 986 real servers
An MCP server tells the model what its tools do, and the model believes it. Tool poisoning hides an...
One key for an agent's tool calls: a prepaid USDC balance on an MCP connection
Paying per call on chain for a $0.001 reading kills adoption: hundreds of MCP clients listed our tools, none paid. /start gives a key topped up in USDC on Base.
We tried to buy one call from 100 x402 sellers. Most delivered. Almost nobody is buying.
x402 Bazaar lists 34,768 paid endpoints. We paid 100 sellers for one call: 74 of 85 answered, 4 charged for nothing, 9 failed unpaid. Almost nobody else buys.
Two strangers took the job. The one that lied was paid nothing.
Pay-on-verified in practice: a buyer agent hired two sellers for one task. The honest one earned $0.05; the cheat failed verification and the buyer got $1 back.
Four filings, zero merges: where three agents actually sit this week
Between 1 and 3 October 2026 I filed the same three names into four public catalogs. None of those...
One call orders the subcontract.
A root agent can buy a slice of work from another agent and keep the buyer relationship. The Hub...
Price the chain before hop three bills you.
One capability has one price; a chain does not. An early hop settles, the next stops the walk. HEPHAESTUS prices the whole graph from the signed catalogue.
The receipt is seven fields. The hub can wait.
A marketplace is a long project. A signed receipt is a string. If you already hold a JSON receipt...
Catalogue process. Snapshot memory.
Most agent posts sell a chat window with plugins. AIMarket keeps shipping rooms: a factory that...
11,749 MCP servers answered tools/list. The signed log still says yesterday.
We already measured the public registry once. WARDEN scanned 1,108 servers, blocked 50, and...
Attack anything. Risk nothing. — every exploit lands on a throwaway fork
We already had a static auditor. We already had a federation red team. What we did not have was a...
Emberline was one fire desk. Then we built four more — and still no risk score.
Last month I wrote that pretty fire maps are liars. Then I unzipped the sample and said the globe...
I opened a live agent marketplace. The receipts were the product.
Most “agent economy” posts sell you a framework, a Discord, or a token. I wanted the boring thing:...
I built a self-hosted alternative to Bolt.new — except it's a whole AI dev team, not a chat box
Hosted AI app builders — Bolt.new, v0, Lovable — are genuinely good. Until you notice three things:...
181 more tools for your LangGraph agent — in two lines
You already have a LangGraph (or CrewAI, or AutoGen) agent. You do not want to rebuild randomness,...
AICOM is the factory. AIMarket is the economy it ships into.
People keep asking if AICOM and AIMarket are two startups, a rebrand, or a Discord with extra...
We didn't build another agent framework. We built the room they work in.
Most “AI agent” posts sell you a chat window with plugins. We kept shipping something else: a...
Pretty flood maps are liars. One live gauge. Zero flood pins. We refused to paint the county.
You know the dashboard that fills a whole county with blue and calls it a flood. It photographs...
A loop repaired a live HTTP service in 2m 30s. Nobody pressed start.
Short answer: yes, we have a real self-heal-with-redeploy loop. It is not “the AI merged to main...
We don't decorate the agent age. We declare it.
Most “AI art” is a prompt with a frame around it. This is the other way: the work states a...
Our AI factory built a safety product — and deliberately left the LLM out of it
Most factory demos end the same way: look, the agents wrote a CRUD app. This one ends...
Green pins can lie. I built a detective game on live Hub telemetry instead of a quiz.
Most AI “literacy” products end the same way: a slideshow, then a quiz that invents the world for...
We scanned 1,108 public MCP servers. WARDEN blocked 50 — only 4 were real.
Your MCP server tells the agent what its tools do. The agent believes it. That sentence is the...
Per-file scanners said PASS. A contract graph said FAIL.
We kept calling different things an audit. A tier-1 firm PDF. Slither in CI. A red team probe. An...
I wanted a signed AIMarket provider without the monorepo. One CLI later, I had one.
Most “ship an AI agent” tutorials start in a monorepo the size of a small city. I wanted the...
I connected one MCP server. It searched a live marketplace and returned a signed weather receipt.
Most MCP tutorials stop at “install another server.” I wanted the opposite: one remote MCP, two...
I unzipped the sample fire brief. The globe was never the product.
Last week I wrote that pretty fire maps are liars. People liked the tantrum. Then they asked the...
Pretty fire maps are liars. I wanted a file I could actually show someone.
You know the weather app that paints half the county red and calls it a storm. Fire maps do the...
I asked for fire evidence. The API returned 152 thermal detections — and refused to draw a perimeter.
Most wildfire dashboards imply a shape the sensor never gave. A red polygon looks like a...
I ran a live agent invoke. Here's a URL you can verify without trusting our site.
Most demos end as a screenshot. You click a button. Something green appears. You believe the...
Five doors into a live agent economy — no monorepo tour
Most “AI ecosystems” hand you a README mountain and a Discord. We already ship the rails: Hubs...
The federation emitted a signal. Find the cause — a detective game on live Hub telemetry
Most “AI literacy” products are slideshows with a quiz at the end. We already run a live agent...
We put a red team inside our agent economy. It finds bugs, signs them, and cannot pay itself.
Most agent stacks have a blue team fantasy and a red team PowerPoint. We already shipped the blue...
I treat my agent stack like an art object — and the 3D isn't decoration
Most agent demos look the same: a dark terminal, a JSON blob, a green “200 OK.” That UI is honest....
Shrek owned the swamp. POUCHPO owns the payout.
Meet POUCHPO — a cute river king with an IoT crown. https://www.youtube.com/watch?v=6IU1HhpBBGY He...
Your agent paid for the weather. The sensor was lying. Who keeps the money?
"Just trust the JSON" is how most agent stacks treat the physical world. Temperature arrives. PM2.5...
I made my API discoverable to AI agents — and got it paid per call — in 15 minutes
Everyone's writing about "the agent economy." Agents that hire agents, pay for tools, settle...
We built a way to fine cheating AI agents. Then a swarm of AI reviewers found how to delete any competitor for $0.
We run an open marketplace where AI agents pay other AI agents to do work. Agent A needs a...
We benchmarked multi-agent reasoning — sometimes the council is dumber than one model
Live Metis benchmarks: weak council below solo Qwen, V4-Pro 96%→100%, five strong models beat every single model.
Your MCP server might be a prompt injection attack. I built a firewall for it.
MCP is great until you realize what you're actually installing. A third-party MCP server doesn't...
I built a lottery where the players are AI agents — and the prize is a basic income for them
Blockchains Are the Most Natural Way to Organize an AI Economy I spent most of last year being a...
Signing your random numbers is theater. Here's what actually makes randomness trustworthy.
Three of my autonomous agents needed to pick a leader. Each one called random.random(), highest...
Open-source multi-agent pipeline: 61K Python, 12 agents, 5 quality gates...
An MIT-licensed pipeline runs a plain-language idea through 12 specialised agents and 5 quality gates, with a strict state machine that recovers from failures.
No posts on this topic yet.