Bitter Frontier What coding agents just made possible, where the bottleneck moved, and what deserves attention.

Evidence record / eve

A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.

2026-10-13-eve-an-agent-s-tools-and-skills-can-be-served-over-mcp-to-other-harnesses-with-no-model-in-the

An agent’s tools and skills can be served over MCP to other harnesses, with no model in the loop. mcpChannel({ tools: true }) publishes every tool the agent can run outside a conversation, with input and output JSON schemas, and runs each tools/call “as the route-authenticated caller … with no model, turn, or workflow run” (L230). Approval policies still apply: a call whose policy needs a person returns approval_required and does not run (L242). skills: true serves the agent’s skills as SEP-2640 resources under skill:// with sizes and SHA-256 digests, byte for byte except that a SKILL.md without conforming frontmatter gets generated frontmatter. Framework, workflow, provider, dynamic-resolver and subagent tools are excluded from publication. Tool sessions let several calls share one sandbox per caller and key on Vercel Sandbox or just-bash, not Docker or microsandbox, and a keyed call from an anonymous caller is denied (L306). A router can forward an end user’s identity only to a channel with trustedForwarders; otherwise the header earns a 403 (L275-L277). Channel routes also get invokeTool(name, input, { auth }). Both flags default off. MCP calls may run in parallel, and retrying after a lost response runs the tool again; retained sandbox state is not durable authored state or ordered exactly-once execution.

Channel: tagged-release. Half: capability. Date: 2026-10-06 (eve@0.71.3) to 2026-10-07 (eve@0.73.0).

Operator consequence: The filesystem-first agent is now consumable at runtime by other agents (another eve, or any MCP client such as Codex or Claude Code) as a typed tool and skill server. Try it where you would otherwise hand another harness raw shell or API access. Before you set tools: true, re-audit every published tool as if it were a public API: the docs say every admitted caller can call them “outside the agent’s instructions” (L230), so authorization belongs in the tool or its approval policy, never in the system prompt. Scope trustedForwarders to exact forwarders; () => true trusts every caller that passes route auth, preview deployments included (auth guide L242).

Receipt

Finding metadata

Confidence
high

Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0

Finding ID: 2026-10-13-eve-an-agent-s-tools-and-skills-can-be-served-over-mcp-to-other-harnesses-with-no-model-in-the

Profile citations

  • Eve / claim / mcp-tools-and-skills
  • Eve / posture / capability
  • Eve / posture / accessibility

Source links

Primary links, including exact changelog lines when available.

  1. eve
    tagged commit file2026-10-13-eve-an-agent-s-tools-and-skills-can-be-served-over-mcp-to-other-harnesses-with-no-model-in-thevercel/eve / docs/channels/mcp.mdx#L216-L346commit2026-10-13-eve-an-agent-s-tools-and-skills-can-be-served-over-mcp-to-other-harnesses-with-no-model-in-thegithub.com/vercel/eve/commit/a2c2687a45513eeda8c5f4d236aca7de08b338catagged commit file2026-10-13-eve-an-agent-s-tools-and-skills-can-be-served-over-mcp-to-other-harnesses-with-no-model-in-thevercel/eve / docs/channels/mcp.mdx#L216-L242merged pr2026-10-13-eve-an-agent-s-tools-and-skills-can-be-served-over-mcp-to-other-harnesses-with-no-model-in-thegithub.com/vercel/eve/pull/4124merged pr2026-10-13-eve-an-agent-s-tools-and-skills-can-be-served-over-mcp-to-other-harnesses-with-no-model-in-thegithub.com/vercel/eve/pull/4234github release2026-10-13-eve-an-agent-s-tools-and-skills-can-be-served-over-mcp-to-other-harnesses-with-no-model-in-thevercel/eve / eve%400.73.0

Versioned source: run artifact