The Agentic Index Brief

The week in one line

In five days, seven vendors shipped MCP infrastructure, the protocol dropped session state, and Box reminded everyone that a file can leak without ever moving.

Theme 1: MCP grew up and got a permissions model

For a year, MCP adoption announcements read like integration press releases. This week they started reading like change tickets.

Start with the protocol itself. The MCP specification published a stateless revision dated July 28, and Stacklok shipped support the same day in ToolHive v0.41.0, negotiating between legacy session based clients and the new stateless ones so both generations can run through a single gateway. The release also adds an RFC 8693 OAuth token exchange handler, which lets an organization delegate, scope, and audit the permissions an autonomous agent carries when it acts for a user. Last issue's market notes had Arcade running both protocol generations in parallel. MCP migration now has what all serious infrastructure eventually earns: a calendar invite.

ServiceNow published Action Fabric, and the detail worth noticing is that it ships both halves: an MCP Server Console so external clients can invoke ServiceNow tools, and an MCP Client so ServiceNow agents can call everyone else's systems, plus Agent2Agent support for peer collaboration. Nobody wants to be a tool in someone else's palette. Everyone wants to own the palette.

Ironclad wired its contract repository into Anthropic, OpenAI, and Slack over MCP, putting renewal dates and workflow status inside the chat tools business teams already inhabit. OpenAI shipped Codex CLI 0.146.0 with Agent Plugins 1.0 for portable MCP servers and a remote Code Mode over WebSocket, separating the agent's interface from its execution environment. Visualping added an MCP server so assistants can query page changes and manage tracking directly. The universal adapter phase is proceeding nicely. The universal permissions headache has arrived right on schedule.

Then came the feature that marks a protocol's passage into adulthood: limits. IBM watsonx Orchestrate added rate limiting for MCP tools, capping per minute requests at the tool and tenant level. LiteLLM 1.94.0 added interactive SSO sign in for MCP client credentials, alongside router plugins and a cost optimization dashboard. Nothing says maturity like rate limits, token exchange, and identity controls. These are the features a technology grows when mistakes start appearing on invoices.

Theme 2: Read is the new download

Box rolled out classification based access policies in Box Shield that treat Download and Read as separate decisions for AI agents. The reasoning is simple: a model does not need to download a file to comprehend and exfiltrate what is inside it. That sentence deserves a moment. Two decades of data loss prevention assumed data leaves inside a file. It can now leave inside a helpful answer.

The same principle surfaced at other layers. Charm's Crush 0.88.0 added deny rules that hide tools from the agent completely, which is stronger than refusing a call. A tool the agent cannot see is a tool it cannot be persuaded to use. Goose 1.45.0 lets administrators disable built in skills and run documentation fully air gapped. Linx Security brought third party agents inside Snowflake under the same identity discipline applied to human and system accounts, and Snyk placed Studio directly inside Snowflake's Cortex Code, scanning AI generated code as it is written rather than after it ships.

Key custody moved in the same direction. Celonis shipped Bring Your Own Key for data at rest and OAuth with short lived rotating tokens for Delta Sharing. Monte Carlo added client credentials authentication with dual secret rotation for machine to machine access. Trust is becoming more specific, more temporary, and considerably less sentimental.

For organizations that suspect they no longer know which agents they are running, Wayfound now ingests AI gateway telemetry, discovers agents automatically through their virtual keys, and evaluates their behavior against policy without requiring engineering changes to the agents themselves. Agent inventory has entered its archaeology phase.

Theme 3: The SOC became the autonomy lab

If you want to know how autonomous agents will actually be governed, watch security operations. That is where autonomy stops being a keynote adjective and becomes an incident ticket.

Torq shipped SOC Brain, a memory layer that trains on an organization's own investigation history and analyst decisions, allowing the system to reason from local precedent and refine its judgment with every completed case. Kai launched Auto Remediation with the week's most instructive product boundary: fixes that need no human approval are applied autonomously, while fixes that do need approval get a complete remediation plan staged for a human to execute. Same product, two postures, decided per fix. Reality remains stubbornly granular.

Dropzone AI took its Threat Hunter to general availability with more than 270 hunt packs mapped to MITRE ATT&CK, turning proactive hunting into something a team can run without dedicated specialists. Baz added SAST inside its security review agent, using static analysis to nominate vulnerability hypotheses that the agent then investigates for reachability before raising a finding. Noise control as architecture, not an apology in the release notes.

The most interesting entry belongs to depthfirst, which introduced dfs-large1, a proprietary security model post trained with reinforcement learning inside its own agent harness. Its reward penalizes excessive tool use, putting cost discipline into the weights. Most vendors bolt restraint on from the outside. This is the first entry we have logged where a vendor claims to have trained the model to stop touching everything.

Meanwhile, the defenders started defending the agents. CrowdStrike extended Falcon AIDR to actively protect agents built in Microsoft Copilot Studio and Claude Code, while Cyware partnered with Armis to map threat intelligence onto an organization's actual asset exposure.

Market notes

Tabnine was acquired by Tricentis, which will fold its Enterprise Context Engine into an agentic quality engineering platform. That makes three consecutive issues with a coding tool acquisition: Kilo Code to Anaconda, then Poke to Cognition and Takeoff to Sierra in last week's issue, and now a code assistant becoming an organ of a testing company. The standalone coding assistant is starting to resemble adolescence: real, expensive, and rarely the final form.

OpenAI cut prices on the GPT-5.6 Terra and Luna models and announced that GPT-5.4 and GPT-5.4 mini retire from Codex on August 31. The discount and the eviction notice arrived in the same release note. That is the deprecation tax described in the July 19 issue, operating exactly as advertised.

The cost work moved upstream from routing. Last issue was about choosing a cheaper model per request. This week, vendors shrank the request itself. LangChain's Deep Agents v0.7 removed its own default system prompt and trimmed built in tool descriptions, cutting base input tokens by roughly 65 percent. The framework discovered that the cheapest token is the one it never sends. A modest breakthrough in restraint. camelAI rebuilt its coding agent on Cloudflare Durable Objects and V8 isolates, abandoning per user virtual machines and their fixed costs, while Unikraft detailed 10 millisecond cold starts with stateful scale to zero. Sierra introduced Agency, dedicated sandboxes that preserve state and isolation for agent tasks running hours or days.

Compliance certificates continued their run as market access documents. Automation Anywhere announced HIPAA compliance with business associate agreements, opening claims processing and patient intake. HireVue certified under the US Data Privacy Framework for moving candidate data across the Atlantic. IBM added an AWS London region for UK data residency. None of these change what the software does. All of them change who is allowed to buy it. Procurement remains undefeated.

Model syndication rolled on. Pydantic AI 2.20 added native support for Claude Opus 5 and GPT-5.6 with prompt caching, and Dify quietly switched its OpenAI default from Chat Completions to the Responses API so GPT-5.6 deployments do not break. It is the kind of one line change that prevents a hundred support tickets and receives no applause, as tradition requires. Automation Anywhere also published an enterprise agent evaluation framework alongside benchmark results on the public τ-bench.

Hippocratic AI launched Rapid Response Climate Agents, voice agents that scale instantly during extreme weather to run heat stroke checks and route vulnerable patients to cooling centers. Agent categories are now being created by the forecast.

The action item

If your organization runs Codex, the calendar item is August 31, 2026.

OpenAI retires GPT-5.4 and GPT-5.4 mini from Codex on that date. Workspace defaults, saved model settings, and custom agents must all move to the GPT-5.6 models before the cutoff. The price reduction on the newer tier softens the landing, but the migration is mandatory either way, and configurations nobody remembers setting are precisely the ones that break.

August 31 is becoming a small pileup. It is also the retirement date for the Make Chrome extension covered in the July 19 issue, and the day ControlUp's legacy device registration codes stop working. If your team keeps a deprecation calendar, that day now has three entries. If your team does not keep a deprecation calendar, that is the finding.

Also notable

• GTM data: Clay upgraded TAM sourcing with natural language Search, a Lookalikes engine that continuously finds up to 15,000 similar companies, and a reporting dashboard tying sourced records to pipeline and closed won revenue. The enrichment bill finally gets an ROI column.
• Agent analytics: Monte Carlo launched automatic conversation clustering for Databricks Genie and Snowflake Cortex agents, grouping what users actually ask into named topics with no manual tagging or instrumentation. Users get a taxonomy without being asked to behave like taxonomists.
• Contact centers: Cresta added Real Time Trends, catching conversational anomalies minute by minute, and upgraded its AI Analyst to run multi step research on its own. The queue now has its own junior analyst, mercifully without a calendar.
• Support workspaces: Kustomer rebuilt its agent workspace around sub second page loads with AI context embedded beside the conversation timeline, in early access for all existing users.
• Channels: Intercom put Fin on Telegram natively, and My AskAI now reads customer screenshots in Gorgias and checks live Shopify inventory before recommending products. The support agent can now follow the customer wherever they have chosen to send screenshots.
• Documents: Extend lets teams build document processing workflows in natural language, validate them with code or semantic rules, and deploy them through GitHub. Prose in, GitOps out.
• Self improvement: Distyl AI introduced Canary, which analyzes production outcomes, drafts targeted fixes such as prompt edits and routing changes, and validates them against real evaluation sets before a domain expert approves anything. The agent proposes its own homework, but an adult still signs it.
• Deal memory: Cobl moved from single document generation to deal workspaces where context, brand systems, and analytics carry across every asset in a sale. The deal finally stops forgetting itself between documents.