The Agentic Index Brief
September 5 to September 19, 2026 · Published September 19, 2026
The week in one line
Oracle put a governed gateway in front of MCP, UnderDefense and Fiddler put OAuth on theirs, and OpenAI put a fingerprint check on a tool call in Codex. Fifteen vendors published an MCP server in two weeks, and the interesting ones shipped with a guest list. Meanwhile Base44 and Hex took the confirmation click off the agent, and Sourcegraph started charging only for the changes a human agreed to merge.
This issue covers two weeks, September 5 to 19: 98 entries across 83 vendors, 67 Verified against a primary source and 31 Partially Verified. It is the largest issue this log has produced, and fifteen of the entries are MCP servers, which is the most of any single type after plain agent capability. Funding rounds, valuations and awards are not logged, here or anywhere on this index.
MCP got a gateway, and the gateway got a guest list
In the August 30 issue application vendors published themselves as something another company's assistant could call. On September 5 the market went back and asked who was calling. This fortnight it built the door frame.
Oracle shipped an Integration MCP Gateway in its 26.10 release, a single governed pathway through which MCP clients reach Oracle Integration and a list of approved third party servers. The word doing the work is approved. A gateway with an allow list is the first MCP release in this log that looks like network security rather than a developer feature.
UnderDefense launched MAXI MCP, which connects SIEM, EDR and SOC data to Claude, ChatGPT and Cursor over OAuth 2.1 with read only access. Fiddler put OAuth 2.0 on its own server for clients such as Claude Code. Intezer rebuilt its server around 66 tools across the case lifecycle. And OpenAI added Touch ID verification for MCP requests in Codex 0.155.0, which means a tool call can now require a fingerprint before it runs.
The routing layer caught up in the same fortnight. LiteLLM v1.101.0 added semantic search over MCP tools and restricted agent and vector store listings for non admin users to what they have been granted. Aisera lets a tenant register external MCP tools once and use them across Webchat, Copilot, Slack and WebEx. The protocol now has a directory and a permissions table, which is what every protocol gets about a year after everyone adopts it.
Then the application servers kept coming. Fieldguide put audit engagement data inside Claude, Microsoft Copilot and ChatGPT. Zocdoc opened its search, availability and booking infrastructure to partners through a server in its new Care Access Network.
Gainsight shipped headless integrations into Salesforce Agentforce and Slack over MCP connectors. Celonis expanded its Agent Toolkit through MCP, Botify and UserGems put their command centres inside ChatGPT and Claude, Hatchet bundled a local server into its CLI so coding agents can trigger runs, and Ada let an assistant connected over MCP create a knowledge source and file its own articles into it.
Our read: a month ago an MCP server was a second front door. This fortnight the door got a frame, a lock, a guest list and, at OpenAI, a fingerprint reader. The vendors have stopped announcing that the door exists and started announcing who may walk through it, which is the difference between a protocol demo and a product an auditor can look at. The read only servers are the tell. A vendor that ships MCP read only has thought about the write path and decided not yet.
Buyer question this week: for every MCP server touching a system you care about, ask three things. Which gateway does the call pass through, if any. What credential does it carry, and does it expire. And is the server read only, or can it write, and if it can, does the write appear in that system's own audit log under the agent's name or the user's.
The confirmation click came off
Base44 released Superagent, and the line to read is that agents can now execute record changes without a secondary confirmation step. Recorded Partially Verified. In the interest of disclosure, this index is built on Base44, and it is named here for the same reason it is named on our ranking pages.
Hex added an option to skip agent approvals in the same release that lets teams publish and version evaluation suites measuring agent performance. Read those two features as one design decision. The click comes off, and an evaluation suite with a version number is what stands where it stood.
Sourcegraph took Agentic Batch Changes to general availability, an agent that plans, generates and executes large code changes across many repositories at once. Two days later it priced the feature per changeset successfully merged. That is the other thing that can stand where the click stood: a meter that only runs when a human accepted the result.
Kilo gave its subagents a way to message each other, called Swarm, and gave the agent a browser. Salesforce introduced seven job ready Agentforce agents, six generally available now and one, Hunter for outbound sales, in pilot on a new long horizon runtime with memory, durable execution and what Salesforce calls dynamic steering. Steering is the word that admits a long running agent needs a wheel.
Skyvern's 3.0 engine, in beta, is the one to read slowly. It adds a persistent tool loop, marked up screenshot fallbacks, and native handling for hCaptcha, TOTP and emailed one time codes, with logins managed through a searchable credential picker.
An agent that completes a two factor challenge on its own is exactly the thing two factor authentication was designed to stop. Skyvern is not wrong to build it, because the workflows that need it are real. It does mean the credential picker is now a security boundary, and it belongs in the same review as the vault.
The counterweights shipped in the same fortnight. PolyAI's Wren analyses production conversations in a six step loop and presents fixes for a person to approve or dismiss. Chatbase gave administrators the ability to pause any active conversation. And Netlify's Agent Runners now watch their own remaining credit budget and finish in progress work in a working state when it runs low, rather than stopping mid task and leaving the project on the floor.
Our read: three weeks ago this Brief said approval had stopped meaning stop. This fortnight the click became a setting you can turn off, and the interesting question is what each vendor put in its place. Hex put an evaluation suite. Sourcegraph put a meter. Chatbase put a pause button. PolyAI kept the click and moved it to the end. Those are four different answers to the same question, and a buyer should be able to say which one their agent runs on.
Buyer question this week: list the agents in production that can act without a confirmation, and for each one name what replaced the confirmation. An evaluation gate, a pause control and an audit record is a governance design. Nothing is a default that somebody flipped.
The agent got a row in the inventory
LangChain introduced Connections in LangSmith, which gives Managed Deep Agents managed credentials and per caller identity. An agent can use a shared secret it owns, or an OAuth flow owned by the user, so it acts with the permissions of the person who called it rather than the person who built it.
That is the release the September 5 issue was waiting for. A service principal says which system acted. Per caller identity says on whose behalf, and that is the line an access review can actually read.
IBM's mid month watsonx Orchestrate update added agent identity through IBM Verify and Microsoft Entra, alongside gateway connections for Gemini and Azure AI Foundry and new content guardrails. Ramp's audit log now carries an agent_name field whenever an agent acts on a user's behalf, which is a small change to a schema and a large change to what an auditor can prove.
Airrived launched agent observability that traces behaviour from the integration an agent used to the outcome it produced, including who created it and what permissions it holds. TrueFoundry added a unified agent registry and a new identity and access experience. Beam AI shipped role based control over agent permissions, dedicated United States infrastructure, and monitoring that alerts Slack, Teams or email when an agent's status, evaluation scores or failure counts cross a rule.
ServiceNow added an AI Asset Inventory with domain separation to AI Control Tower. Box gave administrators control over which models the Box Agent may use. Exaforce added agentless security at runtime, watching agents and agentic apps from endpoint to cloud, including the skills and model APIs they call. Lasso introduced guardrails that run on CPUs and are built to evaluate complex agentic workflows.
Two defaults changed. Netlify made every new site and app private until someone makes it public, which reverses a decade of web deployment habit in one setting. And Sierra achieved AIUC-1 certification after an independent audit by Schellman and testing by the Artificial Intelligence Underwriting Company. That is a certificate a customer service agent vendor can hand a procurement team, and it is the first one of its kind in this log.
Our read: identity arrived on September 5. This fortnight the inventory, the attribution and the certificate arrived behind it. An agent is now a row in the asset inventory, a name in the audit log and, at one vendor, a document a third party signed. That is the full paper trail a human employee has, assembled in about six weeks, and it is the part of this market that will still matter after the model names change.
Buyer question this week: pull one audit log from a system your agents touch and check whether an agent's action is distinguishable from the user it acted for. Then check whether the agent appears in your asset inventory at all. Two noes means the agent exists in production and nowhere else.
The price became the outcome, and the agent learned to budget
Sourcegraph's outcome pricing deserves its own entry. Customers pay per changeset successfully merged, not for compute, tokens or seats. Every agent meter this log has recorded since July charged for the attempt. This one charges for the acceptance, and it hands the definition of success to the human reviewer who clicks merge.
Outcraft AI moved its AI SDR to per lead pricing, a flat monthly rate for the leads the agent engages, starting at $300 for up to 100. Temporal introduced pay as you go for Temporal Cloud with no spend minimums. Workable took its four recruiting agents to general availability on pay as you go credits.
The free tier became a capacity statement. Blitzy opened a sandbox in which eligible organisations can reverse engineer up to a million lines of code and generate 25,000 at no cost. StackBlitz introduced Bolt Forge, an agent on open source models that gives Pro users up to fifty times more usage at no extra charge. And LiteLLM added off peak pricing, which means inference now has a night rate, like electricity, and for the same reason.
Three model housekeeping items carry dates. OpenAI will retire GPT-5.5 from Codex on October 14, and anyone signed in through ChatGPT needs to move saved model settings, custom agents and scheduled tasks before then. Kiro raised the context window for GPT-5.6 Sol, Terra and Luna to one million tokens. Claude Code moved the default model for seat based Enterprise subscriptions to Opus 5 and added gateway pricing parity, so an organisation can manage rates through gateway settings.
And one retention change that will surprise someone in a quarter. LangSmith SaaS now caps extended trace retention at 180 days, and existing settings above that are reduced automatically for new traces. A trace you were relying on for a year long audit now expires in six months unless you self host.
Our read: per merged changeset is the first agent meter that only runs when a person said yes. It is a better deal for the buyer and a braver one for the vendor, because it prices the agent on the reviewer's standards rather than the vendor's. The rest of the fortnight is the market feeling its way toward the same idea from the cheap end: no minimums, night rates, sandboxes with a ceiling. What it has not done yet is publish the rate. Outcome pricing is still mostly a positioning claim with one purchasable exception.
Market notes
The coding agents had a busy fortnight. GitHub Copilot added Jira integration to the Copilot app, adaptive model orchestration in the CLI under the name HydraFusion, VS Code agent sessions in its usage metrics, and a code review agent that can now resolve its own findings rather than only report them.
Cline released a native desktop app with open weight models, scheduled runs, web search, voice input and a hub for agent plugins. Kilo put cloud agents, VS Code sessions and pull request review on a phone. Codex 0.155.0 added experimental voice conversations and live reasoning summaries. A coding agent you talk to from your phone while it reviews a pull request is either the future of software or the end of weekends, and the log records both possibilities.
The vertical agents kept moving into the record. Abridge launched pre bill review that checks inpatient claims against the clinical record before submission, with the coding team deciding what to hold or release. Latent Health introduced clinical agents that evaluate eligibility for specialty therapies such as GLP-1 medications and gather the evidence for approval. Assort Health's agents now book directly into NextGen Enterprise.
Harvey let users hand any Review Table action to its agent, including a privilege review, and added more than 150 legal research sources.
Leah launched an agentic contract lifecycle system on its Maestro orchestration layer across legal, procurement and sales. Zendesk introduced Industry Agents and Custom Agents built around a specific business context. Demandbase launched Mojo, a marketing agent that builds audiences and runs campaigns across channels, and Unify turned its whole interface into one prompt that searches 1.1 billion contacts and launches the campaign.
Smaller vertical entries, each one a job title. Kenmei's agents resolve telecom network issues from the data rather than the dashboard. MarvelX processes insurance policy amendments without the underwriting team re keying them. Consio's voice agents send a tracking link by text during the call. Actively AI feeds a company's own website intent into its account research.
Magnitude launched a CISO Staff Agent that reasons across thousands of vendors and their downstream dependencies. Sardine put all of its agents, including Doc KYC and OSINT Search, in one hub with context available to investigators mid case. Conveyor rebuilt its security questionnaire engine on sub agents that plan, retrieve and iterate, with an MCP connector for trust centre visitors.
Security operations industrialised further. Tuskira launched Vector, an autonomous red teaming agent that simulates external attacks and validates the exploitable surface against internal data. Horizon3 pushes validated pentest findings into CrowdStrike Falcon. RunSybil pushes its findings into Linear and GitHub. Noma Security can be switched on from inside AWS Security Hub.
UnderDefense also launched an on premise version of its agentic SOC for air gapped environments, six agents and 400 tools that never send telemetry outside the perimeter. Swimlane Turbine 26.4 added structured JSON outputs from its AI actions and replay for package imports.
The infrastructure layer shipped state and memory. Traversal introduced Knowledge Bank 2.0, a workspace of wiki, skills, documentation and memories that feed its production world model, and then put its SRE agent into Microsoft Teams connected to the same model. Trigger.dev 4.6.0 stores chat agent transcripts in row or document stores.
Mastra added filesystem search and reusable skills for workspaces. Komodor launched an operations platform that orchestrates more than 50 Kubernetes agents under one governance framework. Atlassian opened early access to Skills for Rovo Agents, packaged inside Forge apps.
The model and voice layer filled in. Jina AI released a 3.4 billion parameter vision language model that converts document pages to Markdown in one pass on low budget GPUs. Prime Intellect took Lab, its training platform for self improving agents, out of beta. Pydantic AI added image generation.
Deepgram released Nova-3 Pharma, a speech model trained on drug names for healthcare voice agents, and put new voice agent controls into its SDKs. Smallest AI integrated with Pipecat and shipped MCP tools that report latency and prompt cache hit rates. Vapi's Composer can now generate simulation scenarios, tester personalities and whole test suites automatically, and its assistants can fall back to another Anthropic model on Bedrock. Dataiku launched Cobuild on Snowflake, pairing Cortex AI's model access with Dataiku's orchestration.
And the release process kept thickening. Paragon introduced versioned releases that summarise every change and warn about breaking ones. Kustomer added version history to its assistant editor. PagerDuty put incident communications into Slack and gave its SRE agent a GitHub code tool. ControlUp launched Pulse AI Insights over workplace telemetry.
Chatbase shipped iOS and Android SDKs alongside its guardrails. Default launched version 2.0 of its inbound orchestration platform, and Thread took Voice AI to general availability for phone support.
What the fortnight says about the category
Ninety eight entries, and the shape is a market building the second half of what it shipped in August. August was the door: MCP servers, agents that act without asking, identities for the things doing the acting. September is the frame around the door: the gateway, the guest list, the audit row, the inventory entry, the pause button, the certificate.
None of that is a capability a demo can show. All of it is what a buyer will be asked about in a security review, and for the first time the answers are shipping as product features rather than as promises in a deck. The click coming off is not the story. The story is what four different vendors chose to put in its place, and the fact that a buyer can now tell them apart.
Which AI agent platforms support Model Context Protocol tools?
About half say so in writing, and the answer gets less impressive the closer you look. Of the 557 platforms the Agentic Index grades across its four horizontal lanes, 289 document MCP support and extensibility in full. That is the number a vendor list would give you.
The number a buyer needs is smaller. 432 platforms document tool calling into real systems in full, and 188 of those do not document MCP at all. Nearly half the agents that can call a tool cannot show they speak the protocol.
Then the third capability, which is where the story turns. Only 151 platforms document model flexibility in full, meaning you can bring your own model or key, or route between providers, rather than accept the one the vendor picked. Of the 178 platforms sitting exactly one capability short of the full interoperability bar, 145 are short on model flexibility alone.
Read that pair together. The tool layer opened and the model layer did not. MCP is sold as the end of integration lock in, and the platforms that speak it mostly still choose your model for you. Portability of tools without portability of the model is a shorter leash, not a longer one.
This fortnight adds the part the census cannot see yet. The servers arriving now carry gateways, OAuth, per tenant registration and a fingerprint check on the request. The protocol question is settling. The question moving in behind it is which door the call came through and what it was allowed to carry, and that is the axis the index will be grading next.
The bar, the method and the 108 platforms that clear all three, 19.4 percent of the field, are on the Agentic Index MCP platforms page.
The Agentic Index Brief is published weekly by Agentic Index, the verified directory of 969 agentic AI vendors. Compare platforms by capability at agenticindex.io/compare. Methodology at agenticindex.io/methodology.