Nobody Was Guarding the Write Side

Give a contractor a key to your house and most of your worry goes into what they might see. The mail on the counter, the photos on the fridge, the sticky note with the wifi password. Fair enough. But that is not the expensive worry. The expensive worry is what they might move, overwrite, or throw out while you are at work.

AI agents have had exactly that blind spot, and last week two things landed that finally name it. Cloudflare shipped a layer that sorts every agent tool call by how much damage it can do. And the maintainers of MCP, the protocol most agents now use to reach real software, published a roadmap admitting that agents still cannot prove who they are.

The missing brake pedal

Cloudflare put WriteGuard into private beta. It sits in front of MCP servers and classifies every single tool call by what that call does to the system on the other side: read-only, reversible write, or destructive.

The behavior follows the label. Reads pass through unchanged. Allowed writes go through, but they get agent attribution and an audit event attached. Critical actions get blocked before the handler runs, which is the part that matters, because a destructive call that fails halfway is still a destructive call. Every invocation is marked successful, failed, or blocked, and a scrubbed event goes asynchronously to an audit Worker.

It lands next to Cloudflare's MCP traffic detection work from earlier this month, which means the same traffic now has both a detection layer and an enforcement layer. Seeing and stopping are different products, and you need both.

Why everyone was watching the reading side

Almost the entire MCP security conversation so far has been about reads. Prompt injection. Data exfiltration. What the agent can see. Those are real, and they are also the failures that are easy to picture, because they look like a leak.

The write side looks like nothing at all until it looks like a disaster. In a tool list, the harmless tool and the destructive one are neighbors. Same shape, same one-line description, same calling convention. Nothing in the list says "this one is irreversible." Today the thing standing between a mis-scoped agent run and a wiped record is usually a well-worded prompt and somebody paying attention.

Which is why the location of the enforcement is the real story. The industry is converging on the idea that agent safety belongs at the tool boundary, not inside the model. That is genuinely good news. Tool-boundary rules are something an ordinary engineering team can write down, test, and show to an auditor. Model-level alignment is not.

The other half: an agent with no ID

On August 22 the MCP core maintainers published an updated roadmap, their first in five months, organized into five priority areas. Two of them read like a description of what breaks the moment agents stop being a chat window.

The first is identity. From the roadmap itself:

MCP authorization today is built around a person approving access in a browser. That works well for interactive clients, but more and more of the callers are agents running as cloud workloads with their own identity, acting on behalf of a user who isn't present, or delegating narrower authority to sub-agents.

Read that again as a sentence about liability rather than engineering. Every scheduled overnight agent is a workload acting for a person who is asleep. The way that works today is a long-lived token sitting in a config file, which is the exact pattern the roadmap wants to retire. The fix being pursued is DPoP (RFC 9449, proof-of-possession tokens) plus workload identity federation, the ID-JAG grant behind Enterprise-Managed Authorization, and standard token exchange, with the maintainers active in the IETF OAuth and WIMSE working groups.

When that lands, "which agent, under whose authority, scoped how narrowly, valid for how long" becomes answerable at the protocol level. Put it next to WriteGuard's attribution and you have the two halves of one answer: the credential and the action.

And the tool lists got too long

The second roadmap item is more mundane and more immediately expensive. In the maintainers' own words, connecting to a server with a hundred tools means the model pays for that entire surface before the user has asked a single question, and tool selection tends to get worse as the list grows.

That is a tax on every agent anyone has built. The fix being scoped is progressive tool discovery: a server offers a small entry point and reveals more of its catalog as the conversation narrows. Until it ships, the mitigation is architectural. One narrow agent per job beats one agent with everything plugged into it, on both cost and accuracy.

This is not a fringe protocol argument

Worth sizing. The two Tier-1 MCP SDKs, TypeScript and Python, have each crossed a billion cumulative downloads, with close to half a billion downloads a month across Tier 1. This is not a protocol that might get adopted.

And the timing is not a coincidence, because agents just stopped being conversations. AWS made persistent AgentCore runtimes generally available, long-running workflows that survive across sessions. Snowflake moved CoCo Automations into public preview on August 21, scheduled unattended agent runs inside a managed sandbox, where each run creates a thread you can open afterward and continue. xAI launched Grok Bot, agents that each get their own persistent cloud computer and quietly run scheduled routines until they need a human. Three companies, three starting points, one conclusion: an agent is becoming a scheduled, stateful process rather than a chat.

Scheduled and stateful means unattended. Unattended means nobody is standing there at the moment of the write.

What I would take from this

1. Sort your tools by blast radius. Read, reversible write, destructive. Write the list down. Most teams have never actually looked at what their agent is permitted to change.
2. Put a human in front of the destructive tier, and keep the record of that decision. Approval that leaves no trace is not a control, it is a vibe.
3. Log attribution, not just events. Which agent, acting for which person, changed which record. That is the artifact a compliance review actually asks for.
4. Split the monolith. A narrow agent with four tools beats one agent with two hundred, today, on cost and on reliability.
5. Inventory your long-lived tokens now. When workload identity federation arrives, the migration is trivial with a list and painful without one.

None of that requires a frontier model or a research team. It is plumbing. And this was the week the industry admitted that the plumbing is the product.