The Agentic Index Brief

The week in one line

Base44 gave automated systems their own service principals, Agno pushed per user isolation down through memory and vector stores, and Boomi shipped a control plane that checks an agent's identity before it acts. A week after application vendors opened a second front door with MCP, the work was deciding whose credential walks through it.

Theme 1: The agent got its own credentials

In last week's issue application vendors published themselves as something another company's assistant could call. This week the same market went back and asked who was calling. Base44 gave enterprise workspaces service principals, so an automated system holds its own identity with credentials an administrator issues and revokes, instead of borrowing the account of whoever happened to build the workflow.

It is the least exciting release of the week and the one the rest depends on. An agent running on a departed employee's token is not an architecture, it is an offboarding ticket that has not been filed yet.

Agno pushed the same idea further down. Its per user data isolation now covers components, entity memory and vector databases rather than sessions alone, which matters because memory is where multi tenancy quietly fails. Session isolation is visible and testable. A shared vector store that has quietly absorbed one customer's documents is neither, until the day it answers a question it should never have been able to answer.

Beam AI came at it from the administration side with role based access control over who can view, create, run or delete a given agent. Three of those four verbs are ordinary software permissions. Run is the one that spends money and touches production.

Then the permission model caught up with the protocol, at four vendors in seven days. Greenhouse opened its MCP server beyond site admins to job admins, coordinators and hiring managers, enforcing each person's existing data permissions rather than granting new ones, and added a read of whether a candidate has opted out of AI talent matching.

Vanta let non admins connect to its MCP server on the permissions they already hold. Relevance AI put user level authentication on its server so a person can only trigger the agents they have access to. Voiceflow made secrets and integrations manageable through its API, CLI and MCP server, with secret values write only and automatically refused if they arrive from an MCP client. Four products, one instinct: the second front door should use the same lock as the first.

Above all of it, the control plane arrived. Boomi launched an Agent Control Plane and AI Gateway that combine MCP and model gateway functions, inspect live traffic, apply identity and rate limits, and hold high risk transactional actions for a human.

Abnormal AI extended its behavioural engine to detect risky AI agent activity in cloud environments, watching human and non human identities together. When a detection vendor starts selling monitoring for the thing you deployed last quarter, the category has finished being a pilot.

Theme 2: The agent got a job title

ServiceNow introduced AI Specialists, and the first one generally available is called the L1 Service Desk AI Specialist. It triages an incident, diagnoses it, applies the fix and talks to the requester, running either in an autonomous Autopilot mode or a Copilot mode that waits for a human before it posts.

The product being sold is not a capability, it is a role with a support tier printed on it. Naming it L1 tells a buyer exactly what it replaces and, more usefully, what it does not.

Serval took Catalyst to general availability and turned it on by default for every organization, where it builds automations out of ticket history, plain language instructions or existing standard operating procedures. The same vendor added scheduled workflows the week before, so daily ticket summaries and hourly service level alerts now run on a clock instead of a trigger.

Enabled by default is the phrase to notice. The distribution question for agent features is being answered the way it was answered for spell check.

Maven AGI handed the support agent a till. Maven Commerce lets an existing support agent check live inventory, price an item and close an order for a product or subscription inside the same conversation, with no transfer to a different tool or a human.

The technical achievement is modest. The organisational one is not, because the refund policy and the discount policy now have to agree with each other in a way they never did when two departments owned them separately.

The same shape turned up in four more categories. Rox gave its agents auto prospecting: describe a buyer in a sentence and the agent builds, scores and sequences the list, replies inside sequences on its own and refreshes its account research weekly. Fireflies launched Voice Agents that take part in the conversation and speak strictly from a supplied knowledge base, which turns a note taker into a participant that can run a screening call.

Vapi brought outbound calling campaigns natively into the dashboard, with a prompt editor that keeps version snapshots, removing the third party dialer from the middle of the operation. Factorial's One agent now schedules its own recurring questions to staff about clock ins, sick leave and spending, and mails the answers back. The common element is not autonomy in the abstract. It is that the agent stopped waiting to be asked.

The same seven days supplied the dial, which is the part worth respecting. ServiceNow shipped Copilot mode alongside Autopilot rather than after it. My AskAI added spam filters so its Echo agent will not reply to automated mail, internal senders or blocked domains, which is the small version of the same problem: the first thing an autonomous responder needs is a list of things it must not respond to.

Theme 3: MCP grew a write path

LangChain 1.4.0 introduced a langchain.mcp namespace and an MCPAdapter that turns any compliant server into a LangChain tool, with cached tool discovery and elicitation interrupts for calls that need a human.

Two things happened there. A protocol that gets its own namespace inside a framework has stopped being an integration and become an import. And the pause for a person is now a protocol level primitive rather than something every team reimplements badly, which is the quieter and more useful half.

Then the direction of travel changed. HubSpot's remote MCP server and Claude connector can now query and create core CRM records, including contacts, companies, deals, tickets, notes, tasks and meetings.

For most of this year an MCP announcement meant a read path, which is a search problem. This is a write path into a system of record, from a chat window, and it is a different review entirely.

The rest of the week filled in the surface. Hebbia put Matrix and Project Intelligence inside Claude, ChatGPT and Cursor through its own server, while its Max agent learned to return audio briefs and interactive dashboards and its custom Skills gained sharing and permission controls. Thomson Reuters added a HighQ MCP connection to CoCounsel so an outside assistant can query matter data, alongside due diligence that flags the documents that are missing rather than only reviewing the ones that are there.

Jasper shipped a Claude connector over MCP with governed product catalogues behind it, so brand and product accuracy are enforced inside Claude rather than only inside Jasper, which is the harder half of that problem. Base44 released an MCP server and sandbox commands that let an external coding agent list, read, search and edit the files of an app in its cloud environment with no local checkout. Clay made the links in its MCP widget results clickable, which is the kind of fix that only gets made once people are genuinely using the thing.

Read together, these vendors are conceding that they no longer own the surface where their product gets used. That is a strategy with an obvious risk attached, and they are shipping it anyway, which tells you what they think the alternative costs. In the interest of disclosure, this index is built on Base44, and it is named here for the same reason it is named on our ranking pages.

Market notes

Three acquisitions closed or were announced in seven days and none of them bought a customer base. SoundHound completed its acquisition of LivePerson, combining voice with digital messaging into one omnichannel platform. Palo Alto Networks acquired Console to put autonomous investigation, prioritisation and remediation inside Cortex. Factorial bought the Berlin talent assessment company Empion to move candidate scoring inside its own platform.

Each one buys a capability the acquirer's roadmap had already named, which is the pattern of a market filling gaps rather than consolidating share.

Model changes arrived with dates attached, and the dates are the point. LivePerson set the cutover for migrating aiStudio custom flows onto Gemini models at September 3 for EMEA brands and September 17 for North America, with freeze periods on either side in which flows cannot be created or edited.

GitHub Copilot took Claude Fable 5.1 to general availability across its IDEs, CLI and app, and the release note carries a line worth reading twice: data retention is on by default for safety classifiers unless zero retention has been negotiated.

Relevance AI added Gemini 3.5 Flash as a selectable model, and Clio shipped a model selector across Claude, GPT and Gemini. Choosing the model is becoming an administrative setting, and the settings screen is where data processing terms go to hide.

One deprecation for the calendar. Zendesk moved its legacy bot builder and intents into maintenance only, with support limited to critical issues and complete removal in December 2026. Anyone still running legacy bot logic is facing a rebuild rather than an upgrade, and the notice period is now measured in weeks per quarter of remaining runway.

Where the agent runs kept moving toward the buyer. Cursor introduced self hosted machines, keeping codebases, build outputs and secrets on internal infrastructure while the agent executes tool calls locally, with dynamic team pools that scale worker capacity on demand and computer use on self hosted Linux and Mac workers.

Mastra 1.64.0 added reusable sandbox templates and warm repository checkouts to cut cold starts, with one working directory configuration honoured across every sandbox provider. Vapi added Azure region pinning for its GPT-5 models. Residency has stopped being a yes or no on a security questionnaire and become a set of build options with different bills attached.

The record keeping releases were unusually strong. Microsoft added de identified row level export to the Copilot and Agent 365 dashboards and put GitHub Copilot credit consumption in the same view, so usage analysis no longer requires a screenshot. IBM took its AgentOps agent for watsonx Orchestrate to general availability with cross platform agent discovery and custom evaluations, which is an admission that the agents worth governing are not all yours.

NICE CXone 26.3 shipped a reporting API returning every state change on a digital interaction inside a seven day window. Torq wired CrowdStrike Falcon telemetry into its context graph for near real time case management. Agno, separately, added per page and per file ingestion controls so a knowledge base can have one document refreshed or removed without rebuilding the whole thing, which is the deletion story every memory feature eventually needs.

In the regulated verticals the differentiator is still the source list. OpenEvidence introduced a family of clinical models named Osler, Sackett and Snow at different depths and speeds, and gave its oncology sub agent a precision oncology knowledge base for genomic interpretation. Clio put Vincent inside Operate so it reasons over live matters and the permissions attached to them, and added Docket Insights across live United States court records.

Harvey added native iManage search, more than 130 legal research sources and client matter governance controls. In work that gets audited, nobody is buying the model. They are buying what it is allowed to read.

And the workhorse releases. Salesforce gave Agentforce Voice custom SIP header support so an inbound call can carry intent or language preference into routing, and let developers pause and resume call recording without handing out a broad permission to do it. cubic extended code review across up to five linked repositories, showing findings inline with citations to the affected files and tracking fixes across companion pull requests.

SoundHound also partnered with Perplexity to give its Chat AI live web results. Clay added industry code filtering and near real time signal tracking. Circleback launched four pricing tiers whose free plan includes unlimited meeting notes plus API and MCP access, which is a deliberate distribution choice, because the free tier is where the agents are.

Kilo Code arrived on the AWS Marketplace so its seats bill against commitments a buyer has already made. And Agno's new advisor tools let a smaller primary model escalate a hard sub task to a frontier model, which is a pricing decision wearing an architecture costume.

Index Answer

How do you keep up with changes to AI agent platforms?

Not from the vendors, and the measurement is unkind about why. The Agentic Index grades 976 platforms and sweeps that roster every week looking for dated, sourced product changes. In the 30 days to September 4 it filed 320 of them across 210 vendors. Over the life of the log, 981 entries name 372 distinct companies.

The number that answers the question is the one left over. 604 of the 976 platforms in the index have never produced a change we could date and source from a public page. Some of that is timing, because a vendor added last month has had less opportunity to appear. Most of it is not.

A large part of this market has no changelog, no release notes and no versioned documentation, and a further slice keeps all three behind a customer login. For those companies there is no feed to subscribe to at any price, and the only account of what changed is the one their account team gives you at renewal.

For the ones that do publish, the problem inverts into volume and location. 320 changes in a month is a reading list, and they do not arrive in one place: a docs changelog here, a release note there, a product update post, a version tag, an admin console banner that never becomes a URL.

Watching a competitor set of thirty vendors properly is a standing job that nobody has been given.

So the practical answer is one maintained log rather than several hundred feeds. Every entry in ours names the vendor, the date, the change type, an impact level and the source it was graded from, and 72 percent are verified against a primary source, with the remainder marked partially verified so a reader can discount them rather than guess. What that buys is not novelty. It is the ability to answer, in public, when a platform changed something you had built a policy on.

The full log is at the Agentic Index change log, filterable by vendor, change type, impact and verification status. This Brief is that log argued rather than listed, once a week.