A short piece of fiction, written by API Evangelist. The reader is imagined; the post, and every number and quotation from it, is real: "Discovery Is The First Governance Control: My Keynote At Tyk LEAP ON TOUR In New York," Kin Lane, October 22, 2026, https://apievangelist.com/2026/10/22/discovery-is-the-first-governance-control-my-keynote-at-tyk-leap-on-tour-in-new-york/
Marisol read the post on her phone, on the train home from a vendor dinner, and by the second paragraph she had stopped skimming. She ran platform security at a regional lender, and the number she gave her steering committee every month was a single digit count of MCP servers. Forty-one. She had put it on a slide.
The post told her to ask which N. It said that when someone says "we have N MCP servers," there are really three numbers behind it. In the catalog the author described, there were 6,968 MCP entries, 4,041 real servers, and 3,321 hosted endpoints an agent could actually open. Marisol's forty-one had come from a spreadsheet that teams filled in when they felt like it. She did not know whether it was the first number, the second or the third. She suspected it was none of them.
She bristled at that. The figures came from a public catalog of providers, not from a bank's internal estate, and the post itself said the same shape holds inside a company without showing her any proof. She typed a note to herself that this was an assertion, and a convenient one for someone who sells measurement. Then she deleted the note, because the line about discovery had landed anyway. The author wrote that nothing can inspect a path it has not found, and her whole governance program was an inspection program. It had inspected forty-one things.
The part that made her uncomfortable was the authorization section. Of 31,004 scored providers, 2,075 published the metadata an agent needs to find an authorization server, which was 6.7%, while 7,710 handed out a bearer token or an API key and nothing else. Her own team had issued API keys to an agent pilot in the spring. She remembered approving it. The audit log named the integration, not the person the agent worked for. Nobody had asked, and it would be her answer to give when someone did.
She did not feel converted. The post ended with a list, and the list was tidy in a way her real estate was not. Publish discovery on your own domain, put identity in the path, fix the APIs underneath. Each item was a quarter of work for a team that would resist it. She also noticed that the author was addressing a room of people who bought gateways, and she kept that in mind. But the post was honest enough to say that getting the server up is the easy part, and that matched what she had seen. The pilot had stood up in a week. Nobody had touched the error handling.
By the time she reached her stop she had decided against the large response. She would not ask for a discovery program or a budget line.
At home she opened the forty-one-row spreadsheet and added three columns: declared, exists, reachable. Then she picked the five rows owned by the team she trusted most and sent them a short message asking them to fill in the columns for those five only, by Friday. She left the slide alone for now.