The MCP drum keeps beating. The Agent Skills keep evolving. The fundamentals of API operations keep being invested in. While I don't think APIs will ever be the darling thing to invest and talk about again, it will continue to be foundational, all while the MCP, Skills, and all things LLM will continue to shrink down into part of our useful and diverse API toolbox. I notice a lot of rhetoric across multiple engineering disciplines that those who have their house in order (ie. APIs, data, observability, etc.), are the ones who are doing well with the AIs.

5,395 posts went out in the last seven days across the 3,505 API-bearing providers I track, and 3,917 of them carried an API-related signal in the title. Last week the story was the factory floor — the OpenAPI-to-MCP pipeline industrializing. This week the story is arrival: the platforms that sat out the MCP gold rush showed up, all at once, and the people who rushed in early started publishing their incident reports.

Let me walk through what I saw.

MCP Reaches the Platforms That Waited

For a year the MCP wave was startups, infrastructure vendors, and the hyperscalers. This week the consumer platforms arrived — including the two you'd least expect to move quickly.

• Apple introduced the Safari MCP server for web developers — out of WebKit, no less. The browser itself is now an MCP surface, which means the agent-driven development loop reaches all the way into rendering and debugging the web.

• Meta announced Developer Tools MCP — the Facebook developer platform, one of the oldest and most locked-down API ecosystems there is, handing agents a first-class way in.

• Google shipped the Google Pay & Wallet Developer MCP server — payments and credentials, the highest-stakes integration surface Google has, now agent-accessible.

• Alchemy put every one of its blockchain APIs in your AI assistant with its MCP server — the whole catalog, not a curated sliver.

When Apple, Meta, and Google Pay all ship the same artifact in the same week, the argument about whether MCP is a fad is over. The interesting question now is the one the rest of this newsletter is about: what it costs to run these things responsibly, and how providers explain to developers when to use them.

"CLI, API, or MCP?" Becomes the Question Every Provider Has to Answer

The sleeper genre of the week wasn't a product launch — it was providers writing down guidance on which interface to use for the job. This is the consumer-side decision I keep talking about, showing up as first-party documentation.

• Soda published "CLI, API, or MCP? Pick the right way to use Soda for the job" — a data-quality vendor walking developers through the same surface, three ways, with honest trade-offs.

• apilayer's "MCP vs. SDK vs. REST: Three Ways to Give Your AI App IP Data" kept circulating — the same framing from the API-marketplace side of the fence.

• NOWNodes wrote "RPC vs API: What's the Difference and Why It Matters for Web3 Developers" — the older version of the same question, still being asked.

• Site24x7 broke down "REST vs. GraphQL API monitoring: Key differences and blind spots" — because once you run multiple interface styles, your observability has to understand all of them.

Here is why I think this genre matters more than the launches: every provider now operates a portfolio of interfaces — REST, GraphQL, CLI, SDKs, webhooks, and now MCP — over the same underlying capabilities. The providers who write down when to use which are doing governance for their consumers, not just themselves. That is the shift I keep arguing for: API governance expanding from a producer mindset to a consumer reality, and this week it showed up as blog posts.

Running MCP in Production Gets Real

You know a technology has crossed from demo to dependency when the "what actually breaks" posts start. They started.

• ibanforge published "Running an MCP server in production: what actually breaks" — a small provider, which is exactly why it's valuable. No marketing, just the operational potholes.

• Gleap profiled MCPJungle, a gateway to manage all your team's MCP servers in one place — the fleet-management layer arriving right on schedule, because everyone suddenly has a dozen of these things.

• Microsoft took "MCP Beyond the Chat Window" into CI with build diagnostics — MCP as pipeline infrastructure, not chat garnish.

• Salesforce published "How to Secure Salesforce Hosted MCP Servers" — the enterprise hardening guide for its own hosted artifact.

• The Model Context Protocol project itself shipped "Enterprise-Managed Authorization: Zero-touch OAuth for MCP" — a direct answer to the 8.5%-of-MCP-servers-use-OAuth number that headlined last week's newsletter.

• AWS folded a Network MCP Server into a phased Transit Gateway to Cloud WAN migration with Terraform — MCP showing up inside a serious infrastructure migration runbook.

Last week we got the measurement of the security debt; this week we got the first structural responses — zero-touch OAuth from the protocol project itself, gateways to herd the fleet, and honest field reports. The gap between the 8.5% and the 91.5% is where the next year of API operations work lives.

Agent Skills Keep Compounding

The Agent Skills wave I flagged last week didn't slow down — it moved from announcement to application.

• Salesforce showed how to build native mobile apps within minutes using Agent Skills — skills as the packaging for an entire app-development workflow, not just API access.

• The PyPI firehose keeps confirming the pattern from the package side: a steady drip of narrow, single-purpose MCP packages — finance-intelligence-mcp, mimo-multimodal-mcp — the long tail assembling itself one pip install at a time.

My read holds from last week: MCP answers "how does an agent call my API," Agent Skills answer "how does an agent know how to use my product," and the serious platforms are shipping both. Salesforce building whole mobile apps from skills is the strongest signal yet that skills are becoming the unit of developer experience, not just a documentation garnish.

Webhooks Meet Agents

The event-driven side of the API world started wiring itself into the agent loop this week — which was inevitable, because agents that only act when you talk to them are half an agent.

• Nango published "How to make AI agents react to API webhooks" — the missing pattern: webhooks as the trigger that wakes an agent, instead of a human prompt.

• AutoContent's "Production Guide: Polling, Webhooks, Retries, and Status Handling for Content Generation APIs" — the unglamorous async fundamentals, restated for the generation-API era where every request is long-running.

Everything old is new again. We spent a decade teaching providers to publish webhooks so consumers didn't have to poll; now the consumer on the other end is an agent, and the same event plumbing becomes the agent's nervous system. If you never invested in your webhook story, your MCP server is going to feel strangely inert next to your competitors'.

The Documentation Layer Adjusts

Underneath the agent noise, the documentation conversation kept maturing — and it's increasingly about what happens when docs fail.

• GitBook asked "What developers do when API documentation is unclear" — the behavioral study angle: developers don't file tickets, they leave, or they guess. Both cost you.

• Mercado Pago now lets developers explore their integration flow directly from the API reference — reference docs absorbing the workflow layer, which is exactly the direction I want to see: the reference isn't a dictionary anymore, it's a map.

• CoinGate's Payment Channels API developer quickstart and GitBook's unclear-docs follow-up to its OpenAPI auto-generation posts round out the week — quickstarts and generated references converging on the same job.

The thread tying this to everything above: agents read documentation too, badly-specified APIs make badly-behaved agents, and the providers investing in workflow-shaped docs are the same ones shipping coherent MCP servers. The contract keeps being the source of truth, and the number of artifacts downstream of it keeps growing.

That's the week. The platforms continue to expand, the interface question continues getting redefined, and production reality invoices begin arrive. Next week I'll be watching whether the Agent Skills registry conversation starts — the lifecycle says it's due.

If you want this analysis applied to your own API operations, that's what I do.

The doorman fallacy is the mistake of reducing a multifaceted human role to its single most visible task. Coined by behavioral economist and advertising executive Rory Sutherland, it explains how companies make disastrous cost-cutting or automation decisions by focusing only on quantifiable metrics, ignoring the hidden, tacit value of human interaction.