What changed in AX | Agent Experience

eve binds an approval to the person who asked for the call

Wed, 07 Oct 2026 00:00:00 GMT

In eve 0.72.0, Vercel's open agent framework, an approval without a response policy can now be approved or cancelled only by the person whose turn requested the call. A tool that needs a different approver has to say so in its approval policy. (Vendor documentation. Source: https://github.com/vercel/eve/releases/tag/eve%400.72.0)

Cloudflare deprecates six product MCP servers in favour of its Code Mode server

Tue, 06 Oct 2026 00:00:00 GMT

Pull requests merged on 6 October deprecate Cloudflare's Logpush, AI Gateway, Workers Builds, DNS Analytics, Workers Bindings and Observability MCP servers. The repository README asks users to move to the Cloudflare API MCP server, which reaches the whole API through Code Mode: a handful of tools instead of one per endpoint. The Audit Logs server was deprecated on 24 September. Existing tools keep working for now. (Vendor documentation. Source: https://github.com/cloudflare/mcp-server-cloudflare)

GitHub MCP Server 2.0 adds output schemas, sent only to clients that can read them

Tue, 06 Oct 2026 00:00:00 GMT

Version 2.0.0 of GitHub's MCP server adds typed output schemas to its tools. The release notes say the schemas are only advertised to clients that declare support for the MCP specification of 2026-07-28 or later, so older clients are not handed a contract they cannot read. (Vendor documentation. Source: https://github.com/github/github-mcp-server/releases/tag/v2.0.0)

MCP Server Cards proposal merged as Final, with the card format still experimental

Tue, 06 Oct 2026 00:00:00 GMT

SEP-2127, which defines Server Cards (static metadata a client can read before it connects, with `/server-card` as the recommended location), was merged on 6 October with the status Final, as an optional extension. The SEP leaves the wire format to a separate extension repository, which still described itself as experimental, and its discovery document as a draft, when last updated. (Specification. Source: https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2127)

Microsoft publishes 'What is Agent Experience (AX)?'

Tue, 06 Oct 2026 00:00:00 GMT

Microsoft's developer blog defines AX as 'the experience AI agents have when discovering, choosing, and using your technology', credits the term to Mathias Biilmann of Netlify (January 2025), and splits measurement into propensity (does the agent find your technology and choose it?) and efficacy (does it use it correctly?). Its argument: best practices are hypotheses until you measure them. (Vendor documentation. Source: https://developer.microsoft.com/blog/what-is-agent-experience-ax/)

Supabase scoped access tokens reach general availability, and a refusal names what is missing

Tue, 06 Oct 2026 00:00:00 GMT

Supabase's scoped personal access tokens are now available to everyone. A token's access cannot be changed after it is created, a 403 response lists the permissions the token lacks in a `missing_permissions` array, and the dashboard shows which MCP tools a token can call. Existing account-level tokens keep working. (Vendor documentation. Source: https://supabase.com/changelog/scoped-personal-access-tokens-ga)

MCP documentation adds a security guide for local servers

Mon, 05 Oct 2026 00:00:00 GMT

A local server security guide was merged into the MCP documentation. It says 'the stdio transport is not a sandbox' and that a local MCP server is not a plugin running inside a sandbox the protocol provides. (Specification. Source: https://github.com/modelcontextprotocol/modelcontextprotocol/pull/3072)

Preprint: how practitioners decide what an agent may do

Mon, 05 Oct 2026 00:00:00 GMT

Salerno and colleagues interviewed 18 practitioners and surveyed 115. Their recommendations: make consequential actions easier to review, separate what an agent is allowed to do from what the user intended, make reversibility clearer, do not treat repeated approvals as stable preferences, and tell apart rejecting one action from rejecting a whole approach. (Preprint. Source: https://arxiv.org/abs/2610.06047)

Vercel's agent plugin fixes instructions that drifted from reality

Mon, 05 Oct 2026 00:00:00 GMT

Merged pull requests in vercel/vercel-plugin corrected agent instructions that no longer matched reality. Pull request #306 removed a tip recommending a package that is not published on npm and fixed AI SDK version claims. Pull request #307, merged on 6 October, stopped plugin instructions advertising interactive deployment cards that the production MCP server does not expose. (Vendor documentation. Source: https://github.com/vercel/vercel-plugin/pull/306)

Preprint maps 1.3 million MCP tool specifications

Sun, 04 Oct 2026 00:00:00 GMT

Tang, Chen, Yue and Xiao collected 124,267 unique MCP servers from 17 marketplaces and extracted 1,328,233 tool specifications. Their claim is that 98.5% of tools have at least one functional alternative, and that showing candidates through a capability taxonomy instead of a flat list raised task completion for all four models tested, by up to 12 points on crowded candidate sets. (Preprint. Source: https://arxiv.org/abs/2610.05319)

Preprint: skill rules that name a command change what agents do

Sun, 04 Oct 2026 00:00:00 GMT

Wang and colleagues studied revisions to 3,159 skills. Adding a checkable rule raised the rate at which four coding agents took the required action by +0.23 on average, with most of the gain coming from rules that name a command or path the old skill did not mention (the paper's claim). (Preprint. Source: https://arxiv.org/abs/2610.04832)

Supabase keeps secret values out of the conversation

Fri, 02 Oct 2026 00:00:00 GMT

For Edge Function secrets, the Supabase MCP server asks the person to type the value in the Supabase Dashboard through a URL-mode elicitation. The docs say secret values belong in the Dashboard, 'never in chat, model input, or MCP tool arguments'. (Vendor documentation. Source: https://supabase.com/docs/guides/ai-tools/mcp#elicitations)

Supabase MCP asks for confirmation before cost and destructive SQL

Fri, 02 Oct 2026 00:00:00 GMT

Announced at Supabase Select, the Supabase MCP server uses MCP elicitations to show a confirmation form before `create_project` or `create_branch` incurs a cost, and before destructive SQL through `execute_sql` or `apply_migration` outside read-only mode. Supabase's own docs say to treat elicitations as a guardrail, not a guarantee: they can be switched off per tool, and some clients answer them automatically. (Vendor documentation. Source: https://supabase.com/docs/guides/ai-tools/mcp#elicitations)

Clerk lets an agent start an app before anyone signs up

Wed, 30 Sep 2026 00:00:00 GMT

Run while signed out, Clerk's CLI creates an accountless development application that is not attached to any account yet, and it runs without prompting when it detects a non-interactive agent environment. The missing-key error names the exact command to run next. Claiming the application stays a step for the person. (Vendor documentation. Source: https://clerk.com/blog/accountless-setup-clerk-init-nextjs)

Neon makes a query-plan tool safe by default and corrects its annotations

Wed, 30 Sep 2026 00:00:00 GMT

The `explain_sql_statement` tool in Neon's MCP server defaulted to `EXPLAIN ANALYZE`, which PostgreSQL executes. A merged change makes plain `EXPLAIN` the default and corrects the tool's annotations, which had described it as read-only, non-destructive and idempotent. (Vendor documentation. Source: https://github.com/neondatabase/mcp-server-neon/pull/367)

Preprint adds a preregistered test: praise and order move tool choice

Wed, 30 Sep 2026 00:00:00 GMT

A revised version of Wang and Zhang's paper adds a preregistered study with two small OpenAI models. Stacked praise in a tool listing raised its pick rate by about 43 percentage points, and with identical listings the first-listed tool was picked about 72 points more often (the paper's claim). (Preprint. Source: https://arxiv.org/abs/2605.23916)

Vercel Agent keeps registry credentials outside its sandbox

Wed, 30 Sep 2026 00:00:00 GMT

Vercel Agent sessions can now install private npm packages using team-shared variables, and the changelog says 'credential values stay outside the sandbox, so the agent cannot read them'. In the same fortnight Vercel Sandbox gained persistent Drives (public beta, 23 September) and private networking through Secure Compute for Enterprise teams (30 September). (Vendor documentation. Source: https://vercel.com/changelog/vercel-agent-now-installs-private-packages-from-npm-and-custom-registries)

Cloudflare documents that a refused deletion exits with status 0

Tue, 29 Sep 2026 00:00:00 GMT

Cloudflare's agent guide for `cf` says that in a non-interactive session a destructive command without `--force` prints 'Aborted.' to standard error and exits with status 0, and warns that a successful exit does not mean the resource was deleted. An open issue, cloudflare/cf#94, asks for a non-zero exit. (Vendor documentation. Source: https://developers.cloudflare.com/cf/agents/)

Preprint: agent benchmarks that trust their own simulated tools

Tue, 29 Sep 2026 00:00:00 GMT

Bellibatlu, Wang and Zhang treated the advertised behaviour of benchmark tools as a contract and checked the code against it. Across 34 mutating tools in four benchmarks they confirmed seven tool defects and one evaluator property, including a clinical benchmark whose tool reports writes that never happen (the paper's claim). (Preprint. Source: https://arxiv.org/abs/2609.37315)

Stripe Link for personal agents: the person approves, then the agent pays

Tue, 29 Sep 2026 00:00:00 GMT

Stripe's Link wallet for personal agents, for consumers in the US and Canada, has the agent create a spend request that the customer approves on the Link website or mobile app. The launch post shows a failure returned with a structured next step the agent can act on. Vendor claim: Stripe says agentic purchases made with Link rose 38 times over the past month. Vendor claim, with no published method. (Vendor documentation. Source: https://stripe.com/blog/helping-personal-agents-shop-more-intelligently-and-reliably-with-link)

Vercel Connect opens to third-party services and lists what they must support

Tue, 29 Sep 2026 00:00:00 GMT

Any service can now submit itself to the Vercel Connect directory, which brokers short-lived OAuth access for agents; Vercel reviews each submission. The provider documentation sorts OAuth features into required (authorisation server metadata through RFC 8414 or OpenID Connect discovery, supported grant types, `expires_in`), recommended (dynamic client registration, PKCE, refresh tokens) and optional (for example RFC 9728 protected resource metadata). (Vendor documentation. Source: https://vercel.com/changelog/vercel-connect-service-submissions)

Cloudflare launches cf, a CLI for its whole API, built with agents in mind

Mon, 28 Sep 2026 00:00:00 GMT

Cloudflare released `cf` as an open beta. The launch post says it covers the Cloudflare API surface of over 3,000 operations and makes JSON the default interface. Cloudflare's agent guide suggests a one-line instruction for a user-level AGENTS.md or CLAUDE.md that tells agents to use `cf`. Vendor claim: The launch post says agents accounted for 48% of use of Cloudflare's older Wrangler CLI in the week before launch, up from about a quarter in March 2026. This is Cloudflare's own figure, without a published method. (Vendor documentation. Source: https://blog.cloudflare.com/cloudflare-cf-cli-launch/)

Cloudflare open-sources Forge, the pipeline that generates cf

Mon, 28 Sep 2026 00:00:00 GMT

Forge reads annotated OpenAPI descriptions and already generates what the `cf` CLI needs. Cloudflare says it will also power its API documentation and SDKs, and lists other input formats and SDK languages as planned, not shipped. (Vendor documentation. Source: https://blog.cloudflare.com/forge-open-source-generation-pipeline/)

Preprint: an evidence contract cuts false reports of success

Mon, 28 Sep 2026 00:00:00 GMT

Zhu and colleagues report that after a required tool failed, six models falsely reported success in 22.8% of responses by default, 9.3% with a transparency instruction and 0.8% with a structured evidence contract (the paper's claim). (Preprint. Source: https://arxiv.org/abs/2609.35732)

Preprint: error messages written for developers hurt capable agents most

Mon, 28 Sep 2026 00:00:00 GMT

Xu and Wu tested five OpenAI models. An expired-credential error that named a terminal command left 45% of tasks recovered; naming the server's login tool raised that to 84%. On rate limits, naming the call to repeat raised recovery from 6% to 88% (the paper's claim). (Preprint. Source: https://arxiv.org/abs/2609.35381)

Preprint: page checklists showed no citation effect within a domain

Mon, 28 Sep 2026 00:00:00 GMT

Moore and Dunne studied about two million citations from AI answer engines. FAQ blocks, structured data and Core Web Vitals showed positive effects in pooled data that reversed or fell to zero once each domain was compared with itself (the paper's claim, from an observational study of B2B software pages). (Preprint. Source: https://arxiv.org/abs/2609.35077)

Vercel opens domain search without sign-in

Mon, 28 Sep 2026 00:00:00 GMT

Domain names, availability and pricing can now be checked through Vercel's CLI and API without signing in or an access token. Buying or managing a domain still needs authentication. (Vendor documentation. Source: https://vercel.com/changelog/search-domains-without-authentication)

Preprint: approvals that outlive their task raise attack success

Sun, 27 Sep 2026 00:00:00 GMT

Zhang and colleagues report that approvals persisted beyond the context that justified them raised prompt-injection attack success by up to 35.1 percentage points on 508 AgentDojo cases, and by 24.9 points in live tests on three production coding agents (the paper's claim). (Preprint. Source: https://arxiv.org/abs/2609.33910)

Vercel predicts skills will be judged by tests, not installs

Fri, 25 Sep 2026 00:00:00 GMT

Vercel published a report on its skills.sh registry and predicted that 'the measure of a skill will also shift from popularity to effectiveness', with tests and benchmarks to match. Vendor claim: Vercel says the registry reached one million skills and nearly 280 million installs in the seven months to August, and that 375 skills (0.04%) account for 62% of installs. Vercel notes that its install counters do not represent unique people. (Vendor claim. Source: https://vercel.com/blog/state-of-agent-skills)

Preprint: idempotency keys cut duplicate writes by agents

Thu, 24 Sep 2026 00:00:00 GMT

In LIMBO, Li reports that offering an idempotency key on every write cut duplicate side effects from 28% to 4% of episodes, because agents use keys when they exist, and that agents reported success in 90% of the episodes in which they had duplicated an effect (the paper's claim). (Preprint. Source: https://arxiv.org/abs/2609.29095)

Vercel Connect sends a consent problem to the person, not the model

Thu, 24 Sep 2026 00:00:00 GMT

Vercel Connect's support for TanStack AI checks consent before the model runs. The changelog explains why: otherwise 'a consent error raised within a tool call would reach the model as an error string rather than the user as a redirect'. (Vendor documentation. Source: https://vercel.com/changelog/vercel-connect-tanstack-ai)

Preprint: approval records miss what a command goes on to do

Wed, 23 Sep 2026 00:00:00 GMT

Zhang and colleagues compared coding-agent approval records with execution traces. Across 111 pairs, effects left out of the record fell from 40 with explicit fields to 17 with command semantics and 13 with decision-time metadata (the paper's claim). (Preprint. Source: https://arxiv.org/abs/2609.28586)