Answer engines covers the machine that reads you. This section covers the machine that reaches you: the rails an agent is wired to, the entry point it calls, and the checkpoint that decides whether it may act. Every one of them has an owner who is not you, and most of them have a queue.

The one-line position: building the integration and distributing it are two different jobs, and the second one now has the shape of an app-store submission — reviewed, un-SLA’d, and never to be your only path.

The protocol is settled; the differentiation moved

For products agents integrate with, the Model Context Protocol became the connection layer in mid-2026: a stateless core that runs anywhere ordinary HTTP does, four Tier-1 SDKs, and the major cloud vendors publicly behind the 2026-07-28 spec. “We speak MCP” is table stakes now, not a differentiator. What differentiates is what your server exposes, how well each tool is annotated, and how safely an agent can act through it — the same questions a reviewer asks in the queue below. A protocol-version migration is a customer-facing deprecation to run with a date and a guide, not a backend chore; developer experience has the benchmark windows.

The rails, and the queues on them

An MCP server nobody can find is an SDK nobody installs. The rails a developer’s agent actually runs on are curated, reviewed channels with app-store-grade vetting and, in most cases, no published review SLA.

  • The model vendors’ directories. Anthropic’s Connectors Directory and OpenAI’s are the largest, and the spread between them is the whole lesson. One integrator’s dated timeline (August 2026) shows a submission held four months in Anthropic’s review queue and then discarded with instructions to resubmit, while OpenAI approved the same connector in 29 days. Anthropic still publishes no formal review timeline — its submission docs say only that “review times vary with queue volume” (checked 2026-09-16) — and the two-tier listing is now written into its docs: a screened-but-not-reviewed-in-depth “Community” label at entry, a checkmarked “Verified” label for connectors it has tested more closely, with no separate application for the second. A lighter door, not a faster one; and the label changes how a connector is displayed and discovered, not what it can do once connected. The queue risk is documented, not hypothetical, and it is invisible until you are in it.
  • The platform-owned marketplaces. Vercel’s Agent Marketplace and GitHub’s agent-apps Marketplace category (both August 2026) are rails wired into their owners’ own agent harnesses: being listed is being callable from inside the tool a developer already runs. Data and infrastructure incumbents — MongoDB, Nutanix — now ship hosted MCP servers as product features, which makes the “rail” and the “competitor” the same company more often than is comfortable.
  • The publisher programmes. The gates are a competitive surface between rails. Docker made Verified Publisher applications self-serve in August 2026 — dropping a contact-sales step while keeping manual review, with one badge covering images, MCP servers, models and agents. When you price the queues, note which rails are lightening their gates and which are not; the spread is itself a selection criterion.

The practical move is a rails inventory: list every curated rail your buyers’ agents run on, dual-list where you qualify, and price each review queue as a channel risk with a date on it. Treat submission like an App Store review — annotate every tool, ship a complete privacy policy, prepare a populated reviewer test account — and never make one directory your only path to users: publish your own install instructions and connect URL so the launch does not wait on the queue.

The entry point moved from a file to a call

By late August 2026 the front door itself started moving from published files to callable entry points. Neon renamed its CLI and shipped agent-specific commands (neon init, neon mcp, neon skills) with the exact AGENTS.md snippet it wants developers to paste; Postman launched Orbit, free no-signup API discovery for agents whose integration brief states what an endpoint cannot do. Two things transfer. The AGENTS.md file a developer’s agent reads at session start is a docs surface you should write the entry for — being named there is this cycle’s “get into the quickstart” — and a callable surface logs every invocation, which makes it the one agent-facing investment whose usage you can actually count.

By mid-September 2026 the entry point moved once more, from the call to the account. Neon’s Claimable Neon (2026-09-11) implements the anonymous registration method of WorkOS’s open auth.md protocol: an agent reads neon.com/auth.md, runs neon claim create, and gets a Postgres project with no human account, capped at 100 MB, 1 GB of transfer and 72 hours, then hands the person a 15-minute claim link; claiming rotates every pre-claim credential. Railway shipped the human-shaped version a month earlier (deploy first, 60 minutes to claim). Three things transfer. The unclaimed tier is a pricing decision written in three numbers, and it belongs on the pricing page. The caps are the abuse control, so they have to be published rather than discovered. And Neon’s stated reason for choosing anonymity over an allowlist — to see which agents find the file and how far they get — makes the claim the first countable activation event an agent produces: discovered, created, claimed is a funnel, and the last step is the one to report. The same week made the agent a first-class CLI user elsewhere: Vercel added vercel changelog so a coding agent can read and search the changelog from the terminal, and PlanetScale’s pricing page now hands out a read-only Postgres connection so “you and your agent” can query cluster prices in SQL — the price list published as data rather than as a table to scrape.

By the third week of September the question “does an agent pick you” had a vendor selling the answer. Armature’s homepage call to action moved from “Get started” to “Get discovered” (2026-09-19): a managed service that measures which tools Claude Code, Codex and Cursor install — the company’s own study covers 16,893 agent sessions — and works on raising a product’s rate, beside self-serve MCP analytics. Treat it the way you treat a rank tracker for search. The free check comes first — ask the three agents to add your category to a scratch repository and read what they install, and what they cite while choosing — and the paid service only when that check stops scaling or someone is accountable for the number.

The older, human version of the same channel still works and is often cheaper: an integration with the framework or platform your developers already use, an IDE plugin, a co-marketed launch with a partner whose audience overlaps yours. The test is identical — does the integration make the developer’s existing tool better, or does it make your logo appear in it — and the agent rails inherit whichever answer you give.

The transaction an agent can be trusted with

Where your product sells or provisions something, the machine-reader logic extends from reading to acting, and the pattern converged in mid-2026 into a small buildable category with a research name (“pre-action” or “runtime” authorization). First shipped at mass-market scale by GoDaddy’s Developer Platform: serve every docs page as markdown and tell the developer to hand your OpenAPI spec to their LLM, then make the transactional flow agent-safe — a quote step that returns an exact price and a short-lived token before anything commits, per-attempt idempotency keys so a retry cannot double-purchase, scoped tokens so an agent can search without holding purchase permission, and an explicit consent record of what was agreed and when. The through-line is a checkpoint that evaluates a declared policy before the agent’s call executes, not after.

The consumer end of the same pattern reached scale in September 2026: Stripe’s Link wallet ships inside Meta’s Muse (2026-09-08), so an agent checks out at Link’s million-plus merchants with a saved payment method or gets a single-use virtual card scoped to one purchase, the person approves the total in chat, and the agent never sees the card. The developer-facing end got its scoped-token reference the same month — Cloudflare’s Wrangler and its API MCP server let a user decline optional OAuth scopes one by one in the consent dialog, so an agent holds only what the workflow needs — and Auth0’s Agent Gateway beta (2026-09-18) packages the checkpoint itself as a product: every tool call bound to the agent, the organization and the user, authorized before it runs, with a kill switch and audit logs. What a vendor selling to agents should take from all three is that the wallet, the scope and the checkpoint are now standard parts, so a flow without them reads as unfinished rather than as cautious.

Nobody can show you conversion data on agent-initiated purchases yet. Adopt the pattern anyway: every element doubles as good API design for humans, documenting the flow is a positioning claim competitors mostly cannot make, and an API an agent can safely act on is the next rung of docs as the front door.

What to measure

The rails are the rare agent-facing channel with counters. Log invocations per tool on your own server, because a callable surface tells you what a published file never could; keep the rails inventory dated, with each queue’s submission date and status, so a four-month hold is a fact on a spreadsheet rather than a surprise in a launch retro; and count installs that came through your own connect URL against those that came through a directory, which is the only number that will tell you whether a queue was worth waiting on.