Tutorials, comparisons and design patterns for building autonomous agents that self-fund, call 345+ models and orchestrate MCP Tools.
Microsoft Entra Agent ID went GA in April 2026 and got an MCP-server how-to on September 3. We audited the primary sources: the 58 Markdown files under docs/agent-id in the public entra-docs repo, the Graph beta resource types, the sidecar's OpenAPI document and image tags on MCR, and the token claims reference. The model is unusual: an agent identity is a service principal with no credentials of its own. Its blueprint holds the credential and impersonates the agent through a two-hop client_credentials exchange keyed by fmi_path. The resulting token carries xms_par_app_azp and facet claims valued 11 or 13. We map the three OAuth flows, the 59 Graph permissions blocked for agents, the sidecar's HTTP contract, the federation path for agents that run outside Azure, and the exact-match resource rule that makes or breaks an MCP server behind Entra.
The x402 spec still says a payment signature is 65 bytes. Ours was 640. We generated a P-256 key with openssl, made it the owner of a Coinbase Smart Wallet on a Base fork, signed a real EIP-3009 authorization as a WebAuthn assertion, and settled it through USDC's bytes-signature overload. Along the way we measured the EIP-7951 precompile on Ethereum, Base, OP Mainnet, Arbitrum and Polygon, compared it with the Solidity fallbacks, replayed the verification against Base mainnet with state overrides, and read what the x402 facilitator actually does with a signature that cannot be recovered with ecrecover.
Between 4 and 11 September, 23 pull requests merged into x402 and the biggest was a fourteen-week Cardano integration. Getting a chain with probabilistic finality in forced the facilitator timeout from 30 to 90 seconds, fixed Hono and Next adapters that could return an empty body after a long settle, and made the seller's maxTimeoutSeconds the MCP client's abort timer. Also: a double-encoding catalog poisoning fix ported to three languages, a minDeposit hint with a buyer-side ceiling, the MCP Python SDK refusing off-origin redirects, X Pay shipping responses before settlement, and Visa's 23 percent trust number.
The dollar an agent spends over x402 is about to become a licensed product. We audit the GENIUS Act and its five pending proposals as an operator: the three definitions that decide whether a payment gateway is a digital asset service provider, the three prohibitions with dates in 2027 and 2028, the freeze capability that Section 4(a)(6) turns into a licensing condition and that already lives in USDC's transferWithAuthorization modifiers, and the x402 facilitator code that cannot name a blacklisted address when it fails. Plus the interest ban, who is lining up to be a permitted issuer, and what it all means for a gateway that accepts USDT and USDC.
Three open agentic commerce protocols and at least one proprietary surface now compete for the machine checkout. Adyen Agentic, announced in June 2026, bets that merchants will pay to not choose: three API layers that translate one integration into UCP, ACP, AP2 and Meta's AI checkout. We map what translation technically requires — feed, checkout state, payment credentials, agent verification — and audit what is verifiable today: open spec repos on one side, a 404 where the aggregator's docs should be on the other.
MCP is about to ship its pre-connection discovery layer. SEP-2127 defines Server Cards — static JSON documents describing a remote server's identity and transports — discovered through a protocol-agnostic AI Catalog at /.well-known/ai-catalog.json. We audit the final design: what changed since the January draft, what the schema actually contains, why primitives were excluded, and where the unsigned-metadata gap leaves paying agents exposed.
The MCP roadmap's first priority is server-initiated events — webhooks and channels — and the concrete design lives in an incubation repo led by AWS and Anthropic. We read the Events design sketch (updated four days ago), the subscriptions/listen machinery that already shipped in 2026-07-28, the OpenAI proposal that died on September 2, and a production field report showing 30% of long-polled tool calls succeeding for nobody.
Today an agent learns that an endpoint is payable by paying the cost of calling it. An August IETF draft and an open x402 Foundation extension move that discovery out of band: a _x402 DNS TXT record pointing at a /.well-known/x402 manifest, resolved in at most one DNS query and one HTTPS GET. We read the draft, the extension PR, and the census data attached to its review — 982 manifests found on 1,521 hosts, only 8.2% with usable payment data.