Logistics Around the Model

The agentic platform layer continues to evolve.

April brought three developments at the platform layer that sits between a language model and a deployed agent: a UI standard hitting its largest enterprise milestone, a hosted runtime arriving in public beta, and a security disclosure documenting what has accumulated underneath. Together they offer a current map of how the agent platform looks under the hood.

Visual MCP tools

MCP Apps, the interactive UI extension to the Model Context Protocol, shipped in late January and was co-developed by Anthropic, OpenAI, and the MCP-UI working group. The extension lets MCP servers return rendered components, typically iframes that the host displays inside the chat, so users can interact with the result directly. Major partners followed quickly: Amplitude, Asana, Box, Canva, Clay, Figma, Hex, monday.com, and Slack integrated within weeks. April brought the standard’s largest enterprise milestone, with Salesforce announcing Headless 360 at its TDX developer conference, an architecture that exposes its entire platform through MCP and renders interactive components across any compatible host.

A tool that returns UI lets the user see and interact with the actual interface, without the agent paraphrasing it first. A query against a Figma file returns the file preview itself, and the user can navigate the result without leaving the chat. Most production tool integrations were already wrapping their JSON outputs in custom UI built separately by each integrator. MCP Apps standardizes that wrapping at the protocol level, and the server controls its own presentation. As the first MCP extension to ship in this form, it sets the template for how tool authors can claim screen real estate inside an agent loop.

Agentic runtime for rent

Anthropic launched Claude Managed Agents in public beta on April 8. The service provides a hosted runtime for long-horizon agent work, with stable interfaces for sessions, sandboxed execution environments, credential storage, and observability. Pricing runs at $0.08 per session-hour on top of token costs, which turns a long-running agent into a metered offering on Anthropic’s infrastructure. Notion, Asana, Rakuten, and Sentry are already in production. On April 23, Anthropic added a long-term memory beta to the same release, letting agents persist context across sessions through a filesystem-mounted store.

The launch extends Anthropic’s product surface from the model itself to the harness around it. Teams running agents in production had been stitching together their own session managers, sandboxed runners, and audit logs, often using a mix of open-source tooling and bespoke code. Such systems need to survive crashes, retain credentials across restarts, and produce traceable records of what they did, all of which the harness handles. By offering the harness as a managed service, Anthropic absorbs that integration burden and prices it by the hour. For teams that had been treating agent infrastructure as a side project, the build-versus-buy calculation has changed.

Handle with care

Earlier this month, OX Security disclosed a sweep of vulnerabilities across the MCP ecosystem, totaling more than ten CVEs across an estimated 200,000 servers. The central finding sits in the protocol’s STDIO transport, where the StdioServerParameters interface accepts arbitrary command arguments that an attacker can inject. That spec calls for passing arbitrary input to the local shell, so an attacker who can reach an MCP server’s input also reaches its host. OX titled the report “The Mother of All AI Supply Chains” and framed it as the first systemic survey of the agent ecosystem’s plumbing. The disclosure lands as MCP installations move from experimental to load-bearing, including the same partner integrations that ship MCP Apps.

Anthropic responded by updating MCP’s security guidance and the SECURITY.md in the reference repository, without changing the protocol behavior. In the company’s framing, the transport works as designed and sanitizing input is the responsibility of the developer who exposes the server. The updates clarify that any MCP server taking external input must apply its own input validation and that operators should isolate servers in environments with appropriate trust boundaries. That position separates protocol-level responsibility from implementation-level responsibility. Whether the line holds depends on the willingness of thousands of MCP server authors to implement the validation Anthropic now asks them to own.

Agents are here to stay

A year ago, the open questions about agents concerned whether they could complete tasks at all and how they would access tools. April’s developments suggest those questions have settled enough for the next set to surface: how the layer presents itself, who runs it, and what happens when its plumbing leaks. The platform that surrounds the model now moves on its own.