Agents Are Getting Plumbing, Not Just Models

The router becomes a product

The first piece of plumbing is the model router, and OpenRouter has rebuilt its from the ground up. OpenRouter launched a next-generation Router rebuilt from the ground up, and the company says the new Routers outperforms the previous version by up to 4x depending on the benchmark, with the routing step 3x faster at the p90 in live tests. The router processes over 2.5 trillion tokens per month from over 100,000 users, according to the company, and it chooses models by weighing eleven factors, including live pricing and provider health, while its provider routing chooses providers based on user preferences, uptime, latency, price and prompt cache state. m:…4951

The more interesting launch is Auto Code, a specialised router for coding work that favours a higher tier of coding models and weighs speed more heavily than the general router. OpenRouter says Auto Code scores in line with Claude Opus 5.5 while costing 74% less per task. During beta testing, the router stayed on the same model for nearly nine of every ten agent turns, which protects input token cache benefits, and invalid tool calls were 4x lower while agentic responses were cut off half as often compared with the previous router. The router also supports governance policies including guardrails, zero data retention and bring-your-own-key keys, and users can view routing insights in the chatroom or via API metadata. The implication is that routing is becoming a place where cost, quality and policy are decided per request, not per deployment. m:…4951

One config file, three dialects

If the router decides which model answers, the mcp.json file decides which tools the agent can reach, and the file is not portable between editors. Claude Code reads mcpServers in the project-root .mcp.json file, Cursor reads mcpServers in the .cursor/mcp.json file, and VS Code reads servers in the .vscode/mcp.json file. Environment variable syntax is inconsistent too: Claude Code uses ${VAR} syntax, while Cursor and VS Code use ${env:VAR} syntax, and Claude Code supports environment variable defaults in the form ${VAR:-default}. A config can be valid JSON and still use a key the client does not read, which is the kind of silent failure that wastes an afternoon. m:…1889

The details keep diverging from there. Claude Code remote HTTP entries require the type http field, and Claude Code reads the project .mcp.json at startup and asks for approval before using its servers. Claude Code stores local and user-scoped servers in ~/.claude.json, Cursor uses ~/.cursor/mcp.json for servers available across projects, and VS Code's .vscode/mcp.json supports stdio, HTTP and SSE servers as well as input variables for secure password prompts, which Cursor does not resolve. Requesty's MCP Gateway allows supported clients to connect to multiple HTTP-based MCP servers through one gateway, which is one answer to the fragmentation, though it adds a dependency of its own. The practical lesson is that MCP configuration is now a compatibility matrix, not a single file format. m:…1889

The gatekeeper with a 4,500-deep queue

Once a server is built, getting it in front of users means passing a platform gate, and Meta's gate for its Muse agent is now open but crowded. Meta now accepts MCP servers from outside developers on Muse, and the review process includes risk assessment, tool review and end-to-end testing. Meta has over 4,500 pending connector submissions, and Muse reached 10 million US downloads in its first 40 days, according to the account, so the queue is long and the audience is large. Meta sorts tools into three sensitivity classes, and sensitive write actions in Muse require user permission every time. m:…5896

The hard constraints are technical as well as procedural. Muse requires a public HTTPS URL for MCP server connections, and Meta does not support localhost or VPN-hosted servers for Muse. Meta does not approve new tools that move money, so payment and transfer tools are excluded outright. For developers, the message is that distribution through an agent platform is now a real channel with a real review process, and the backlog means submission timing and tool classification are part of the product plan, not an afterthought. m:…5896

Privilege without credentials

The last piece of plumbing answers the security question that agents make urgent: what happens when the credentials an agent holds are stolen. Edera grants privileged operations to workloads as object capabilities, and a workload needing an operation receives a single socket for that specific operation, with the broker re-validating the grant on every call. No network path is opened for capability calls, and a stolen secret in an object-capability system is worthless outside the granted workload. That contrasts with the usual failure: stolen registry tokens or kubeconfigs allow unauthorised access from any reachable machine. m:…4361

The model is old, originating in a 1966 paper, but the implementation is current: Edera runs each workload in a separate virtual machine zone, its capsudo uses a Unix socket to replace sudo for privilege delegation, and Edera 1.13.0 removed the daemon's control API in favour of named capabilities. The limits are stated plainly too: Edera's object capabilities do not replace network policy for standard HTTP and gRPC traffic, and Kubernetes NetworkPolicy operates at OSI layers 3 and 4 while Cilium derives security identity from pod labels and Istio uses X.509 certificates tied to Kubernetes service accounts for identity. The suggestion for agent builders is that the credential is the wrong unit of privilege, and a socket that carries exactly one operation is a better one. m:…4361