Your next customer will probably arrive as software.
Not as a chatbot, and not as a person using an AI tool to write a better email. As an agent: software deployed by a buyer, acting on that buyer’s behalf, instructed to find suppliers, gather facts, compare terms, and increasingly to transact. Your clients, your vendors, and your partners are deploying them right now.
Those agents are already trying to interact with your company, and today they do it badly. They scrape your website and mistake last year’s pricing page for current terms. They parse your PDFs and pull a specification from a document your team superseded eighteen months ago. They call your main line and hang up on the phone tree.
Tomorrow, a growing number of them will stop trying. They will route to the companies that make their work easy, and your company will never learn it was considered.
Your next customer will probably arrive as software.
Every company has a front door. For most of the last thirty years it has been a website, a phone number, and a salesperson, in roughly that order of first contact. Larger companies added a customer portal, a partner extranet, an EDI connection, a handful of APIs for the integrations that mattered enough to fund. Every one of those doors was designed around an assumption so deeply held that nobody ever wrote it down: the party arriving is a person.
That assumption is now failing, quietly, in ways that show up in no report your team currently produces. Which raises a question almost nobody in the mid-market is asking: what does your company look like to a machine that has been instructed to consider doing business with you?
The Human Customer Assumption Was Correct For So Long
It is worth pausing on how correct the human-front-door posture was, because the people who built it were not careless.
When a buyer researched vendors, a buyer read. So companies invested in pages a person could scan, case studies a person could skim, a phone tree that got a person to the right department. When a partner needed data, a partner asked, and someone in operations pulled a report and emailed it. When an integration was worth building, it was worth building specifically, for one named counterparty, with a contract behind it. The economics were unambiguous. Machine-readable access was expensive to build, expensive to maintain, and useful to almost nobody, because almost nobody on the other side had a machine capable of using it well.
The mid-market in particular had every reason to hold this position. A company running twenty production systems accumulated over three decades does not have spare integration capacity. The systems that needed to talk to each other were connected point to point, at real cost, only when the business case forced it. Opening those systems outward, to counterparties who had not asked and could not consume, would have been an unforced expense.
None of that was wrong. It was an accurate reading of who was arriving. What has changed is not the quality of the decision, and not the cost of the alternative; it is the arrivals themselves.
The Protocol That Changed the Question
The reason this is happening now, rather than in some hazy five-year future, is a piece of plumbing called the Model Context Protocol.
Anthropic released MCP as an open standard in November 2024. It is, in essence, a standardized way for an AI agent to connect to an external system, discover what it can do there, and use it, without a bespoke integration built for every model-and-system pair. In December 2025 the protocol was donated to the Agentic AI Foundation under the Linux Foundation, with OpenAI and Block joining as co-founders and AWS, Google, Microsoft, Cloudflare, GitHub, and Bloomberg among the supporting members.
That governance change matters more than the technical one. It moved MCP out of the category of one vendor’s initiative and into the category of infrastructure that competitors have agreed to share. When rivals agree on a standard, the standard stops being a bet.
The adoption curve since is among the steepest on record for a developer protocol. Monthly SDK downloads reached roughly 97 million by early 2026, up from about a hundred thousand at launch. Public server counts run between 9,600 and 17,500 depending on which registry is counting, with private and enterprise-internal servers estimated at several times that. Roughly 28% of Fortune 500 companies were running MCP servers by mid-2026, and Gartner projects that 40% of enterprise applications will embed task-specific AI agents by the end of this year.
Two Waves
The first wave of MCP adoption was internal. Companies connected their own AI tools to their own systems, so that an analyst could ask a question in natural language and have it answered from the data warehouse instead of a spreadsheet export. Useful, and by now unremarkable.
The second wave is the interesting one, and it is just beginning. A small number of companies have started pointing MCP servers outward, toward their counterparties, so that a customer’s agent or a partner’s agent can arrive, identify itself, and get an answer without a human in the loop.
Grasshopper Bank, working with its digital banking provider Narmi, became the first US bank to ship one in August 2025. It is read-only by design; a business client’s AI agent can query balances, transactions, and vendor patterns, and can move nothing. Modest in scope, and it still drew coverage, because being first is a story.
Software vendors are moving in parallel. HubSpot, Atlassian, Linear, Sentry, Klaviyo, and Adobe’s Marketo all ship remote servers now, racing to make the data inside their products reachable by their customers’ agents.
That second wave deserves its own name, because it is going to reshape how companies compete for business.
Agent Docks
I have started calling these external-facing interfaces Agent Docks: the places a company deliberately builds where its counterparties’ AI agents can arrive, identify themselves, get answers, and transact.
The metaphor is chosen carefully. A dock is not a wall with a hole in it; a dock is infrastructure built to welcome arrivals and turn them around profitably. Harbors compete for ships. They dredge channels, publish charts, staff pilots, and streamline customs, because every vessel that berths somewhere else is revenue lost to a rival port. The harbors that treated arriving ships as a nuisance became footnotes.
The posture problem
That competitive framing is the part most likely to be lost, because the instinct of most IT organizations, and nearly every security vendor, will run the opposite direction. Their frame will be defensive: agents as threats, interfaces as attack surface, the objective being to inventory and close unmonitored doors.
Some of that discipline is genuinely necessary, and the evidence supports the concern. Independent scanning has found that a majority of public MCP servers carry exploitable risk, and only a small fraction implement proper authorization by default. Authentication, permissioning, and logging are table stakes for any dock worth building, and a dock built without them is a liability wearing the costume of an initiative.
But if defense is the whole frame, you will build nothing. And the agents will berth elsewhere.
Agent Docks are a revenue posture, not a security posture.
Agent Docks are a revenue posture, not a security posture. The question they answer is not “how do we keep machines out?” It is “how do we become the easiest company in our market for a machine to do business with?” Those two questions produce entirely different projects, sponsored by different executives, funded from different budgets, and measured by different results.
Undocked
The failure state has a name too.
An undocked company is one whose answers are locked in phone trees and PDFs while its competitors’ answers are one clean protocol call away. Undocked companies will not experience the loss as an event. There will be no breach, no outage, no lost RFP with a debrief attached. They will experience it as a slow, unexplained decline in inbound activity, as a growing share of first contact shifts from humans browsing to agents querying, and as an increasingly puzzling gap between marketing reach and qualified conversations.
That is the most dangerous shape a competitive loss can take, because nothing in the management reporting stack is designed to detect it.
Anatomy of a Dock
There is a common first assumption that this is a content problem, solved by publishing a file that tells AI systems where to look. That file exists; it is called llms.txt, and it is worth shipping. It is also not a dock; it is a channel marker. Adoption sits around 8% to 10% of sites, major crawlers have not committed to fetching it, and the measured effect on citation is close to nothing. What it does well is point. It cannot let anyone in.
A dock has five parts.
Channel markers
The signals that tell an arriving agent a dock exists and what lies behind it. This is llms.txt, robots.txt configured for AI user agents, and increasingly a standardized metadata document at a well-known address that lets an agent learn what a server offers before opening a connection. Cheap, fast, necessary, and the least of it.
The berth
An externally reachable MCP server exposing a deliberately narrow set of tools. Not the internal servers a company builds for its own staff, which are a different project with a different threat model. This one faces outward, toward parties who do not work for you and whose agents you did not configure.
Identity and scope
The arriving agent is registered as a distinct identity, not treated as a proxy for whichever human delegated to it. Access is scoped per counterparty, so a client’s agent sees that client’s data and nothing adjacent. Write operations, where permitted at all, require human approval before touching a record of consequence.
The log
A record of what arrived, what it asked, what it received, and what it was refused. Almost nobody has this today, and it is the part that converts an experiment into something a board and an auditor can live with. It is also what becomes evidence when a counterparty disputes what an agent was told.
The meter
The optional fifth part, and the one that turns a cost center into a line of business. A parallel set of standards emerged over the past year specifically to let machines transact: a checkout protocol from OpenAI and Stripe, a payment-consent protocol originating at Google and since contributed to the FIDO Alliance, a commerce protocol co-developed by Shopify and Google that launched in January 2026 with more than twenty partners including Walmart, Target, and Etsy, and an HTTP-native payment mechanism from Coinbase now housed at the Linux Foundation for per-request access to data, APIs, and compute. McKinsey estimates agentic commerce could influence three to five trillion dollars in global commerce by 2030.
What Belongs on a Dock, and What Doesn’t
This is where most first attempts go wrong, in both directions. Some companies dock everything they can technically expose, and create a liability. Others dock only what was already on the public website, and create nothing of value.
The useful sort is by who may ask, not by what the data is.
Open water
Answers any arriving agent may have without identifying itself. Capabilities and service lines. Geographic coverage. Certifications, licenses, and insurance status. Standard commercial terms. Published specifications. General availability windows. Who to route a specific class of question to.
This tier looks trivial and is not, because for most mid-market companies these answers are currently scattered across a website, a capabilities deck, a proposal template, and one person’s memory, and no two agree. Making them consistent is the work; exposing them is the easy part.
Berthed
Answers a specific, authenticated counterparty may have about its own relationship with you. Order and project status. Account position. Their contract terms and pricing. Their inventory, their tickets, their documents, their scheduled work.
This tier requires identity and scoping, and it is where most of the practical value sits, because it displaces the highest volume of routine human contact. It is also where a scoping error becomes a disclosure incident, which is why the identity layer is not optional here.
Piloted
Answers that require human judgment before release. Custom pricing. Exception handling. Capacity commitments. Anything where the correct response depends on a commercial decision rather than a data lookup.
The dock’s job in this tier is not to answer. It is to let an agent submit a well-formed request, receive an accurate acknowledgment, and be told what happens next and when. That alone is a substantial improvement on a contact form and a three-day silence, and it carries almost none of the risk of an autonomous answer.
Never leaves the harbor
The process logic itself, as distinct from its outputs. Margin structure. Other counterparties’ data. Anything whose value depends specifically on not being retrievable, and anything you would not put in writing to the counterparty’s competitor, because you cannot control where a retrieved answer travels next.
The sequencing test
Within those tiers, three questions decide what gets built first.
Is it a question you already answer? If someone in your company answers it dozens of times a month, it is a candidate. If nobody has ever asked, docking it is vanity.
Is there one authoritative answer? If the answer differs depending on whom you ask, it cannot be docked yet. Discovering that is usually the most valuable output of the first month, because it surfaces data ownership disputes that have been deferred for years.
What does a wrong answer cost at machine speed? A person given bad information corrects it in conversation. An agent given bad information acts on it, and so do the next thousand agents, without anyone noticing the pattern until it has propagated.
Start where the volume is highest and the blast radius is smallest. That is almost always the berthed tier, read-only.
Early Dock Builders
The list of dock builders is short and instructive.
Beyond Grasshopper, a newer banking entrant went considerably further in April 2026, exposing an endpoint any compatible agent can reach, through which agents open business accounts, issue cards, and send payments without a human initiating the action. Whether that proves prescient or premature will be evident within a year.
In product data, a European product information vendor shipped a native MCP server in January 2026 and paired it with a payments partnership the following month, so a single brand can expose its catalog to agents and accept machine-initiated payment through one integration. Discovery through one protocol, checkout through another, composed. That is a working dock with a scale house attached.
In partner ecosystems, a major cloud provider opened its partner platform to external agents in March 2026, letting partners’ AI query pipeline, draft funding requests, and surface co-sell motions. Its trust model is worth copying regardless of industry: cryptographic authentication, per-partner data isolation enforced by identity policy, a sandbox for testing, and mandatory human approval before any write reaches a live record.
Note what nearly all of these have in common. They are software and financial services companies, where the product and the data are the same object. The pattern has barely touched companies whose business is physical, operational, or relational.
The Harbors That Are Still Empty
In commercial real estate, no brokerage, owner, operator, or institutional landlord has built an Agent Dock. What exists is third parties scraping listing platforms, community-built servers assembled from public county and federal data, and vendors offering their own customers an inbound path into their own products. Nobody in the industry has opened a berth outward for the counterparties who evaluate them.
The same is true across professional services, distribution, specialty manufacturing, construction and the built environment, higher education, insurance brokerage, senior living, logistics, and most of healthcare outside the largest systems.
That is not a technology gap. Build costs are public and unremarkable: generally fifteen to forty thousand dollars for a credible proof of concept, and fifty to two hundred thousand for a production implementation with proper isolation, authentication, and audit logging. Those are line items, not transformation programs.
It is an attention gap. Nobody has been assigned the question.
The Trap of Waiting for Your Vendors
Here is the objection I expect from thoughtful operators: won’t our software vendors just build this for us?
Partially. And that is exactly the trap.
Your ERP vendor will dock the data inside your ERP; one major vendor has a storefront server on its roadmap for general availability this year, described as making a retailer’s product data directly accessible to agents. Your CRM vendor has already shipped one. Your industry’s vertical platforms will dock the slices of your business that live in their systems, each on its own schedule, each with a compelling launch announcement.
Take all of them. They will be good, they will be cheap, and building competing versions would be foolish.
Then notice what they have in common. Every one of those docks answers questions about the data inside one vendor’s system, because that is the only data the vendor can see.
The questions your counterparties will actually ask do not respect those boundaries. Can you deliver this configuration to this location by this date at this price with this certification in place? Answering that requires the inventory system, the production schedule, the logistics constraints, the pricing logic, the compliance record, and the specific commercial judgment your company applies to exceptions. That answer exists nowhere as a retrievable fact. It lives across five systems and in the working memory of three people who have been there a long time.
No vendor will ever build that dock, because no vendor can see the whole question.
The last technology wave trained a generation of operators to let vendors deliver the future in quarterly releases. That posture mostly worked, because the stakes were internal efficiency and the vendor’s roadmap eventually arrived. It fails here, because the dock that matters, the one answering the questions only your company can answer, has to be designed by someone who understands the whole business. That is not a product you will be able to buy.
What the First Dock Actually Buys You
Three things, and the third is the one operators consistently underestimate.
The first is position. In most industries the title of first company to build a real Agent Dock is unclaimed, and it comes with earned media attached; a small bank shipping a read-only balance lookup drew national attention because being first into an empty harbor is a story. That coverage compounds into the association that matters when a category eventually forms.
The second is a compliance head start. High-risk obligations under the EU AI Act became enforceable on August 2, 2026, and agent gateways operating on regulated data fall inside their scope. Companies with European customers are building inside a regime whether or not they have noticed. Designing deliberately now is considerably cheaper than retrofitting a departmental experiment later.
The third is the query log, and it is worth more than the dock.
Your first dock will produce a record of what arriving agents actually asked for, in what order, on behalf of whom, and where they gave up. That is unfiltered demand data from the moment of evaluation, gathered before any human relationship has formed and before any answer has been shaped by a salesperson. No survey replicates it. No win-loss interview reaches it, because the agents that route away never become losses you know about. Companies that dock early will spend two years learning what their market asks for while their competitors are still guessing, and that asymmetry is more durable than the software.
Building While the Harbor Is Quiet
I want to be measured about timing, because this is an early-innings observation rather than a mature market report. Roughly thirty remote MCP servers appeared on curated lists in July, up from sixteen in January. An independent census of more than 17,000 indexed servers found that only about one in eight met a reasonable bar for documentation, maintenance, and reliability. Most docks being built right now are junk.
Which gives the moment a specific character: the bar is low, the category is nearly empty, and being credibly dockable is a differentiator almost everywhere.
The question worth putting on your leadership team’s agenda does not require any technical vocabulary at all. What do our clients, partners, and suppliers ask us, and how many of those questions could a machine answer accurately today, without a person? For most mid-market companies the honest answer is a small fraction, and finding out the size of that fraction is itself the finding.
Because the arrival is coming either way. When a machine shows up representing your best prospect, what will it find?
The companies that build their docks while the harbor is quiet will be the ones the ships already know when the traffic arrives.
The companies that build their docks while the harbor is quiet will be the ones the ships already know when the traffic arrives.
