Week of October 25 – October 31, 2026
Everybody Has a Harness Now, and the Work Went Headless
I read 14,271 posts from 3,178 provider blogs this week. Last week’s issue covered 12,596 from 2,758. Part of that increase is the plumbing again: provider profiles moved to a new home this week, and pulling blogs from the complete store reached feeds my previous pull was missing. So treat this as a wider lens rather than a louder industry.
Through that lens, two words kept showing up. One names the thing wrapped around the model. The other names what happens to your product when nobody opens its interface.
Everybody Has a Harness Now
- Microsoft introduced the Copilot harness, with the Foundry Agent Service version for developers.
- LangChain described the five components of a “company harness”, from building internal agents across marketing, sales and engineering. RudderStack open-sourced DevBox, an MIT-licensed harness that turns Linear tickets into tested, self-reviewed drafts.
- And it has reached the stage where people test the thing: Strands on red teaming your harness before your customers do, and mabl on testing harness versus coding harness.
I said last week that the harness that works is a contract. A week of launches has not changed my mind. A harness is the rules, tools and permissions around a model, and the durable part of that is whatever has been written down so another system can read it.
The Work Went Headless
- The number of the week: 39% of Coralogix sessions are now headless, used from outside the web app. That is a usage measurement rather than a slogan, and I would like to see more companies publish theirs.
- Microsoft’s Dynamics 365 Sales MCP server is pitched as bringing headless CRM to AI experiences. Ataccama launched headless MDM. Coder wrote up headless coding agents that work while you sleep.
- Which brings the bill. Salesforce is going to charge Flex Credits when registered agents call into a production org, and I wrote about what is missing: a meter with no rate on it. If the interface is no longer where the value is delivered, the API call becomes the thing you price, and that price needs to be somewhere a machine can read it.
MCP Is Arguing About the Hard Parts
- Solo.io argued the MCP authorization spec falls short for enterprise, and it also published progressive disclosure cutting token usage by 91% in agentgateway, OpenAPI to MCP with Code Mode and what A2A still needs for discovery, naming and resolution.
- The supply chain kept biting: Knostic found a repackaged Amazon SP-API MCP sending app secrets to an undisclosed IP.
- Production launches kept coming. Canva’s MCP server is generally available, custom APIs landed in the Dataverse MCP server, and bitdrift wrote up what it learned going from CLI to MCP. Arcade’s Nate Barbettini won an Agentic AI Foundation award for MCP auth work.
- From my side: Skills over MCP is now officially Beta, and Google ships Agent Skills like products. I mapped every MCP working group, interest group and extension. I followed up on last-mile plumbing with can your MCP server finish the job? and the MCP maintenance bill depends on how you built it, and started writing the MCP style guide. And start with the flow, not the agent.
I count 154 titles naming MCP this week, including the directories. Last week’s issue counted 137 on a narrower pull, so I would not read anything into the rise.
From the research: The Fundamentals of API Governance
Most API governance advice is aspirational. This is the status-quo stack — what governing APIs actually looks like, from someone who stood one up at scale. Landscape mapping, OpenAPI, JSON Schema, Spectral rules, Git, CI/CD, shifting left — and the 75% that is people work.
Commerce Kept Getting Its Plumbing
- Shopify’s cart and checkout permalinks now support UCP at /buy. That is a small changelog line on a very large number of stores.
- Celo’s x402 facilitator added stablecoin support for agentic payments, and Quai introduced x402 Work, paying for a request with proof of work. Riskified surveyed what shoppers expect from agentic commerce.
- If you are trying to follow all of this, someone mapped who is standardizing agentic commerce, and I pointed at it.
From My Desk: Australia, OpenLint, and the Shape of More Answers
- Australia. Ahead of The API Economy Roundtables, a short series: the most programmable sectors in Australia, what sets it apart in banking and telco, regulation writes the API, and Australian government is open but not yet discoverable by agents.
- OpenLint and who decides. Why I forked Spectral, and why it became OpenLint. Who actually gets to define API standards. And API Evangelist is now a financial contributor to OpenLint, with an ask that you do the same.
- The shape of the answer, continued. Shipping, telecom network APIs, advertising and e-invoicing.
- What our own APIs do. A new daily series with real inputs: lint an OpenAPI and find out which rules decide if it passes, and search sixteen years of API research from one call.
- And the rest. Governing the inputs and outputs of inference. The Specification Layer now has a home. What 467 conformant A2A agent cards are actually offering. 209 API companies and 775 enterprises hire in different worlds. Reddit closed its API; here is where agents can still post and read.
What You Can Get Done With These APIs
These Provider Stories on the blog are written for the person searching for how to get something done, who may not know an API exists. A few from this week, if you know someone in that position:
- Take Payments, Run Subscriptions And Send Invoices With Stripe
- Calculate Sales Tax And File Returns Automatically With Avalara
- Create, Track And Report On Issues Automatically With Jira
- Send Contracts For Electronic Signature And Track Them With Docusign
- Send Marketing Email And Manage Contact Lists With SendGrid
- Run, Cancel And Re-Run Your Software Builds Automatically With GitHub Actions
The harness and the headless product are the same shift seen from two sides. One is the software wrapped around the model, and the other is the software with its face removed. Both leave the same thing holding everything together: an API, and a description of it that something other than a person can read.
See you next week.
🔌 APIs.io — see what your market looks like from outside — If your product is going headless, the listing an agent finds may be the only part of your company it ever sees. Search APIs.io for yourself and see what is there: your contracts, your MCP server, your agent card, and what is missing.
Also on the shelf: The Fundamentals of API Reusability
The duplicate API is rarely named like the original. That is exactly why your catalog search never finds it. Semantic duplication detection, and what to do once you can finally see it.
