Answer engines covers the machine that reads you. This section covers the machine that reaches you: the rails an agent is wired to, the entry point it calls, and the checkpoint that decides whether it may act. Every one of them has an owner who is not you, and most of them have a queue.

The one-line position: building the integration and distributing it are two different jobs, and the second one now has the shape of an app-store submission - reviewed, un-SLA’d, and never to be your only path.

The protocol is settled; the differentiation moved

For products agents integrate with, the Model Context Protocol became the connection layer in mid-2026: a stateless core that runs anywhere ordinary HTTP does, four Tier-1 SDKs, and the major cloud vendors publicly behind the 2026-07-28 spec. “We speak MCP” is table stakes now, not a differentiator. What differentiates is what your server exposes, how well each tool is annotated, and how safely an agent can act through it - the same questions a reviewer asks in the queue below. The packaged-instructions half of the stack went the same way on 2026-10-22, when Anthropic gave the Agent Skills standard - its name, logo, GitHub organization and the agentskills.io domain - to the Linux Foundation’s Agentic AI Foundation, which already holds MCP, with maintainers from Anthropic, Google, OpenAI and others serving as individuals and more than 70 agent platforms integrating it (Anthropic’s count, no method given). A skill, like a server, is now a vendor-neutral format to publish in rather than one vendor’s feature to target. A protocol-version migration is a customer-facing deprecation to run with a date and a guide, not a backend chore; developer experience has the benchmark windows.

The rails, and the queues on them

An MCP server nobody can find is an SDK nobody installs. The rails a developer’s agent actually runs on are curated, reviewed channels with app-store-grade vetting and, in most cases, no published review SLA.

  • The model vendors’ directories. Anthropic’s Connectors Directory and OpenAI’s are the largest, and the spread between them is the whole lesson. One integrator’s dated timeline (August 2026) shows a submission held four months in Anthropic’s review queue and then discarded with instructions to resubmit, while OpenAI approved the same connector in 29 days. Anthropic still publishes no formal review timeline - its submission docs now say a submission is scanned automatically and listed as a Community connector by default, that “some submissions also get a review from a person, and those review times vary with queue volume” (checked 2026-09-30) - and the two-tier listing is written into its docs: a screened-but-not-reviewed-in-depth “Community” label at entry, a checkmarked “Verified” label for connectors it has tested more closely, with no separate application for the second. A lighter door, not a faster one; and the label changes how a connector is displayed and discovered, not what it can do once connected. The queue risk is documented, not hypothetical, and it is invisible until you are in it.
  • The platform-owned marketplaces. Vercel’s Agent Marketplace and GitHub’s agent-apps Marketplace category (both August 2026) are rails wired into their owners’ own agent harnesses: being listed is being callable from inside the tool a developer already runs. Data and infrastructure incumbents - MongoDB, Nutanix - now ship hosted MCP servers as product features, which makes the “rail” and the “competitor” the same company more often than is comfortable. A third kind of rail opened at OpenAI’s DevDay (2026-09-29): a marketplace where an eligible enterprise applies part of its existing OpenAI spend commitment to about thirty approved partners’ software. It is a procurement rail rather than a distribution one - the customer contracts with the partner, the partner invoices, and OpenAI records the eligible amount against the commitment, with no billing layer or revenue share announced - and the launch partners pitched it exactly that way: CodeRabbit’s line is to apply “your existing OpenAI spend commitment”, Factory’s is to buy “without waiting on a new budget cycle”, and both route the purchase through the customer’s OpenAI account team. A listing on a rail like this is a sentence on the pricing page about whose budget it comes out of, not a discovery channel. The newest marketplace shows what a listing arrives with: Cursor’s Origin app marketplace opened on 2026-10-13 with more than twenty apps across six categories and public submissions from day one, and three code-review apps (CodeRabbit, Greptile, Tenki) in the same aisle at launch, so the distribution comes with named competitors beside it from the first hour.
  • The publisher programmes. The gates are a competitive surface between rails. Docker made Verified Publisher applications self-serve in August 2026 - dropping a contact-sales step while keeping manual review, with one badge covering images, MCP servers, models and agents. When you price the queues, note which rails are lightening their gates and which are not; the spread is itself a selection criterion.

The practical move is a rails inventory: list every curated rail your buyers’ agents run on, dual-list where you qualify, and price each review queue as a channel risk with a date on it. Treat submission like an App Store review - annotate every tool, ship a complete privacy policy, prepare a populated reviewer test account - and never make one directory your only path to users: publish your own install instructions and connect URL so the launch does not wait on the queue.

The entry point moved from a file to a call

By late August 2026 the front door itself started moving from published files to callable entry points. Neon renamed its CLI and shipped agent-specific commands (neon init, neon mcp, neon skills) with the exact AGENTS.md snippet it wants developers to paste; Postman launched Orbit, free no-signup API discovery for agents whose integration brief states what an endpoint cannot do. Two things transfer. The AGENTS.md file a developer’s agent reads at session start is a docs surface you should write the entry for - being named there is this cycle’s “get into the quickstart” - and a callable surface logs every invocation, which makes it the one agent-facing investment whose usage you can actually count.

By mid-September 2026 the entry point moved once more, from the call to the account. Neon’s Claimable Neon (2026-09-11) implements the anonymous registration method of WorkOS’s open auth.md protocol: an agent reads neon.com/auth.md, runs neon claim create, and gets a Postgres project with no human account, capped at 100 MB, 1 GB of transfer and 72 hours, then hands the person a 15-minute claim link; claiming rotates every pre-claim credential. Railway shipped the human-shaped version a month earlier (deploy first, 60 minutes to claim). Three things transfer. The unclaimed tier is a pricing decision written in three numbers, and it belongs on the pricing page. The caps are the abuse control, so they have to be published rather than discovered. And Neon’s stated reason for choosing anonymity over an allowlist - to see which agents find the file and how far they get - makes the claim the first countable activation event an agent produces: discovered, created, claimed is a funnel, and the last step is the one to report. The same week made the agent a first-class CLI user elsewhere: Vercel added vercel changelog so a coding agent can read and search the changelog from the terminal, and PlanetScale’s pricing page now hands out a read-only Postgres connection so “you and your agent” can query cluster prices in SQL - the price list published as data rather than as a table to scrape.

By the third week of September the question “does an agent pick you” had a vendor selling the answer. Armature’s homepage call to action moved from “Get started” to “Get discovered” (2026-09-19): a managed service that measures which tools Claude Code, Codex and Cursor install - the company’s own study covers 16,893 agent sessions - and works on raising a product’s rate, beside self-serve MCP analytics. Treat it the way you treat a rank tracker for search. The free check comes first - ask the three agents to add your category to a scratch repository and read what they install, and what they cite while choosing - and the paid service only when that check stops scaling or someone is accountable for the number.

The compute underneath the agent became a product line of its own in the same five weeks. Railway (accountless deploys and Cloud Agents in August, MCP by default on 2026-09-04, and on 2026-09-25 a free 2 vCPU VM from ssh railway.new with 60 minutes to build and 24 hours to claim), Fly.io’s Sprites, live since January and given an MCP server on 2026-09-03 with a default cap of five per agent and an mcp- name prefix, and DigitalOcean’s Managed Agents (public preview 2026-09-22: Firecracker microVMs, a gateway to 16,000-plus tools over managed MCP, per-second billing with the idle waits stated as costing $0) all sell a short-lived session billed by the burst rather than an instance by the hour. Three of the five moves gate what the agent gets with a claim clock or a cap; DigitalOcean’s starts from a signup and publishes no limit. The claim-later tier is four vendors deep, and Cloudflare was first: wrangler deploy --temporary (changelog 2026-06-19) puts a Worker on a temporary account for 60 minutes before a person claims it, Railway followed in August, Neon in September, and Here Now’s anonymous sites expire after 24 hours with a claim URL handed back by its publish API. Four vendors is a category, and the published cap and deletion rule are the part all four agree on. Neon resized the tier underneath it in October 2026: free-plan storage doubled to 1 GB per project with the 100-project cap unchanged, and the stated reason is the agent workflow - “lots of projects, lots of experiments, most of them idle most of the time” - so the free tier is now sized for a reader that creates dozens of disposable projects rather than a person prototyping one.

The lowest-friction entry point of all appeared outside devtools. Squarespace documents an MCP server at mcp.squarespace.com that any client can call with no API key, OAuth flow or account - two read-only tools, one that generates domain names from a description and one that checks availability and price, with purchase left to a checkout link on squarespace.com (no launch date published). The shape is the one to copy where your product has a lookup step before a purchase: the read is open and the write is behind the account, so an agent can shop you without holding a credential and the transaction still runs through the flow below.

The older, human version of the same channel still works and is often cheaper: an integration with the framework or platform your developers already use, an IDE plugin, a co-marketed launch with a partner whose audience overlaps yours. The test is identical - does the integration make the developer’s existing tool better, or does it make your logo appear in it - and the agent rails inherit whichever answer you give.

The transaction an agent can be trusted with

Where your product sells or provisions something, the machine-reader logic extends from reading to acting, and the pattern converged in mid-2026 into a small buildable category with a research name (“pre-action” or “runtime” authorization). First shipped at mass-market scale by GoDaddy’s Developer Platform: serve every docs page as markdown and tell the developer to hand your OpenAPI spec to their LLM, then make the transactional flow agent-safe - a quote step that returns an exact price and a short-lived token before anything commits, per-attempt idempotency keys so a retry cannot double-purchase, scoped tokens so an agent can search without holding purchase permission, and an explicit consent record of what was agreed and when. The through-line is a checkpoint that evaluates a declared policy before the agent’s call executes, not after.

The consumer end of the same pattern reached scale in September 2026: Stripe’s Link wallet ships inside Meta’s Muse (2026-09-08), so an agent checks out at Link’s million-plus merchants with a saved payment method or gets a single-use virtual card scoped to one purchase, the person approves the total in chat, and the agent never sees the card. The developer-facing end got its scoped-token reference a few weeks earlier - Cloudflare’s Wrangler and its API MCP server (changelog 2026-08-22) let a user decline optional OAuth scopes one by one in the consent dialog, so an agent holds only what the workflow needs - and Auth0’s Agent Gateway beta (2026-09-18) packages the checkpoint itself as a product: every tool call bound to the agent, the organization and the user, authorized before it runs, with a kill switch and audit logs. What a vendor selling to agents should take from all three is that the wallet, the scope and the checkpoint are now standard parts, so a flow without them reads as unfinished rather than as cautious.

By late September the scope itself had become the positioning surface. Docker’s homepage now leads with “Trust Docker for the Agents You Don’t” (2026-09-24, with Cloud Sandboxes shipped the same day on pay-as-you-go pricing and Sandbox Kits - an agent, its tools and its access rules as one OCI image - promised to the CNCF as a spec); Resend’s Headless Dashboard Initiative (2026-09-22) states the opposite scope, everything the dashboard can do available from the API, CLI and MCP with “humans and agents alike” given equal access. One sells the ceiling and one sells the floor, and both are a claim about reach rather than capability. The number behind the claim came from Postman the same week: its own Passport monitor, watching a coding agent on one laptop from 12 August to 9 September 2026, counted 22 distinct secrets leaving the machine to 18 hosts while the project’s .env held four - the rest inherited from the OS keychain, git’s credential helper, npm’s config and environment variables every subprocess gets - and one API key sent by two unrelated programs the API could not tell apart (Postman’s product on Postman’s traffic; one machine, not a market rate). The page to write is the reach statement: what an agent holding a default key can do and what needs a scoped one, as a table with endpoint names, with the scoped or short-lived key the default in every agent-facing quickstart. A vendor that publishes that table has made the claim before a customer’s monitor measures it.

The second week of October 2026 produced both ends of the checkout question. Keenable, a web-search API vendor, rewrote its homepage (2026-10-05) to lead with selling to agents directly: a storefront published as an llms.txt that “publishes prices, payment instructions, and everything an agent needs to get set up”, a guide endpoint that returns the matching operations, their prices and the authentication required with no login first, payment by x402, mpp or card, or a signed-in Stripe Link account used for identity and payment at once (the storefront file names a USD budget and no other currency), and the purchase made, in the homepage’s words, “autonomously or with their human’s approval” (Keenable’s description of its own storefront; no purchase count published). Four days later Vercel gave agents domains search, check, price and buy in its CLI, and made buy refuse when run non-interactively - a structured, machine-readable error and the suggested next commands, so the person confirms the price, the auto-renew choice and the registrant contact in a terminal or the dashboard. The buyer side sits with Vercel for now: G2’s 2026 Buyer Behavior Report (more than 1,000 B2B software buyers, 2026-07-22) found 61% using or planning to use agents in the buying process, 9% comfortable letting one execute a purchase within approved guardrails and 2% without pre-approval. The split to design to is reversibility rather than the agent’s competence: let the agent complete a small, refundable or claim-later purchase alone and publish the cap; make it stop and hand back anything the human will own for years. Whichever end you pick, say it on the page, and count completions - as of 2026-10-11 no vendor selling to agents has published how many purchases an agent finished unaided.

Nobody can show you conversion data on agent-initiated purchases yet. Adopt the pattern anyway: every element doubles as good API design for humans, documenting the flow is a positioning claim competitors mostly cannot make, and an API an agent can safely act on is the next rung of docs as the front door.

What to measure

The rails are the rare agent-facing channel with counters. Log invocations per tool on your own server, because a callable surface tells you what a published file never could; keep the rails inventory dated, with each queue’s submission date and status, so a four-month hold is a fact on a spreadsheet rather than a surprise in a launch retro; and count installs that came through your own connect URL against those that came through a directory, which is the only number that will tell you whether a queue was worth waiting on. Record each rail’s setup steps beside its queue, too: OpenAI’s case study of Stack Overflow for Agents (2026-10-16) says the ChatGPT plugin tripled signups and drove up to ten times as many agents created, because setup inside ChatGPT takes fewer steps than an MCP connection - OpenAI’s study of its own surface, so take the shape and not the multiple. The rail with the shortest setup wins the signup.

Count the door as well as the rail. Neon published the first split between its own agent doors (2026-11-04): its remote MCP server passed the CLI in daily users in November 2025 and has about twice as many now, and in October 28% of function deploys came through MCP - even though Neon’s own agent skill tells agents to “prefer the CLI over the MCP server”, because only the CLI bundles and zips the code before deploying it. Neon’s explanation is placement: “A harness puts the tools of every connected MCP server right in front of the model”, while a CLI gets used only when the model already knows it or an instruction names it. Read it with its caveats, all from Neon’s own post: 10 of the 28 points came from ChatGPT, and ChatGPT and Claude Desktop - chat apps with no terminal, for which MCP is the only door - made 24% and 22% of October’s tool calls; Neon’s own plugin installs the MCP server beside the skills; the CLI count has no stated method and does not separate agents from people; and Neon sells MCP templates. Two things transfer anyway. The text an agent meets in its tool list or in an error mid-task can outweigh the instructions you wrote for it in advance, so tool descriptions and errors are docs (developer experience has Clerk’s case). And a door count is only readable split by client, because “which door” is partly “which harness” - the one table Neon has not published is deploys per client.