Week of November 1 – November 7, 2026
Agents Got Their Own Login, and Every One of Them Gets a Sandbox
I read 14,429 posts from 3,277 provider blogs this week, close to last week’s 14,271 from 3,178. With the pull now running against the complete provider store, the numbers have settled. That means changes from week to week are starting to say something about the industry again, rather than about my plumbing.
This week, the agent kept being treated less like a feature and more like a worker. It gets an identity so systems know who is calling, and a sandbox so systems can limit what it does.
Agents Got Their Own Login
- Supabase: Claude can now issue the identity assertion for enterprise-managed auth on its MCP server, for when your identity provider can’t. The New Stack put it more bluntly: Anthropic’s fix puts Claude in the identity business.
- The vendors are filling in the plumbing. Kong introduced Token Vault for governed OAuth for agents calling services like GitHub, Figma and Salesforce. Neon’s Managed Better Auth is now an OAuth 2.1 provider with MCP support. WorkOS Pipes lets each customer bring their own OAuth app. Vercel’s MCP server now supports Client ID Metadata Documents.
- Workload identity reached the places where agents run and where code ships: E2B gives each sandbox a signed identity, and Hex made workload identity available to every package on hex.pm.
- And the “why” arrived in the same week. NIST published ten design tenets for agent identity. Stacklok opened with an audit log saying a departed employee approved a 3 a.m. merge. Stack Overflow’s podcast: your agents need OAuth2, too. And CB Insights is already asking who security companies will buy next in agent identity, citing a Fortune 500 company that found more than 10,000 agents it did not know about.
None of this is new technology. It is OAuth, workload identity and audit logs, applied to a new kind of caller. That is good news. The hard part is still the boring part: knowing which agents exist and what each one is allowed to touch, written down somewhere a machine can check.
Every Agent Gets a Sandbox
- Render Sandboxes are in public beta: an isolated Linux environment per agent that runs indefinitely and suspends when idle. The New Stack framed it against Vercel’s 24-hour cap, and Vercel answered with sandboxes that start up to 2.4x faster.
- Figma explained Nimbus, the platform behind the tens of thousands of sandboxes its AI products need to run untrusted code. Google is donating gVisor to the CNCF, the sandbox Anthropic and OpenAI use, and OpenKruise Agents v0.6.0 manages agent sandboxes on Kubernetes. Docker wrote up sandboxes versus containers, and Solo.io compared NVIDIA OpenShell and Agent Substrate.
- Then the first crack. Endor Labs found a Docker Sandboxes vulnerability (CVE-2026-103916) that let coding agents read files outside the sandbox, cloud credentials included, through a routine copy command. HYCU’s argument the same week: the sandbox is not the security boundary.
I agree with HYCU. A sandbox limits what an agent can reach on the machine it runs on. It says nothing about what the agent can do through the APIs it holds a token for. That is why this section follows the last one. The boundary that matters is the identity and scope on each API call, and that is something we can describe, publish and check.
From the research: The Fundamentals of Context Engineering
Agents do not magically understand your API. Somebody has to curate what they need. That is the discipline behind the emerging context engineer role — context as a governed lifecycle artifact, not a prompt you tune.
MCP Moved From Access to Action
- The best number of the week came from Cyclr: across 816 SaaS products, official MCP servers rose from 47 to 100, or from 5.8% to 12.3%, and the servers are moving from reading data to doing things.
- What doing looks like: Curri’s MCP server lets an agent quote, book and track deliveries, with a person approving every booking. Amazon Connect flows can now call MCP tools through an External Tool block. Brightcove, GameAnalytics and Spacelift for OpenTofu shipped servers too.
- And people are measuring the result. Upstash ran coding agents through real Redis tasks with its MCP server, fixed what the benchmark found, and compared before and after. Postman’s Fabric Gateway puts multiple MCP servers behind progressive tool discovery to shrink what an agent has to read. Google Cloud offered five rules for evaluating agent skills before they bloat your context window, and .NET is delivering skills in NuGet packages.
I count 141 titles naming MCP this week, including the directories, against 154 last week. The count is flat. What changed is that these servers can now take actions, and each action is a call that needs an identity and a scope.
From My Desk: What a Score Is For, What APIs Cost, and What Went Dark
- Using the Kin Score. A short series on putting a score to work instead of chasing it: use a score to build your API roadmap, make the case for API investment with facts, what to check before you call your API production ready, score the APIs nobody outside your company can see, and where a score fits in your CI pipeline and developer portal.
- What APIs cost. The APIs.io pricing page now shows how APIs charge. Rethinking the API free tier in the agentic age. Service level agreements come back around as SLA4OAI.
- Where the client stack went. The client stack did not collapse, it went dark. Okapi is Dependabot for APIs, and the business needs the register behind it. Agents will not look for an SDK generator, they will look for a problem to solve.
- Standards and estates. The Dutch government now runs on OpenLint. The Microsoft API estate: 169 surfaces, one company. The x- prefix is a feedback loop, not a mistake.
- The shape of the answer, continued. Healthcare and payments and banking, plus the same fifty providers sit under every kind of application.
- And, fitting this week’s theme, find the PII and secrets an API exposes before you hand it to an agent.
What You Can Get Done With These APIs
These Provider Stories are written for the person searching for how to get something done, who may not know an API exists. A few from this week:
- Add Login, Multi-Factor Authentication And Enterprise Single Sign-On To Your Product With Auth0
- Manage Orders, Fulfill Shipments And Organize Products With Shopify
- Verify Insurance Eligibility, Check Claim Status And Handle Prior Authorization With Availity
- Store, Rotate And Recover Passwords And API Keys With Amazon Secrets Manager
- Make Calls, Send Texts And Register Your Brand For SMS With Twilio
- Publish Offers, Ship Orders And Print Shipping Labels With eBay
An identity says who the agent is. A sandbox limits where it can run. Neither one says what the agent is allowed to do once it is calling your API. That is still set by the API: its scopes, its rate limits, its prices and the contract that describes them. That is the part I keep asking providers to publish.
See you next week.
🔌 APIs.io — see what an agent sees when it finds you — Agents are getting identities and scopes. Search APIs.io for your company and see whether your authentication, scopes and pricing are described anywhere a machine can read them, or only explained on a page meant for people.
Also on the shelf: The Fundamentals of Markdown
llms.txt, AGENTS.md, SKILL.md. The agentic era standardised on a 2004 convention nobody ever finished specifying.
