Workflow and Orchestration Agents

Agents wired into business tools through MCP, A2A and connector platforms.

The public MCP registry grew from about 1,200 servers to more than 47,000 in under a year, and each server is a tool an agent can be given. China blocked Meta's roughly $2 billion purchase of the Manus agent on April 27, 2026.

Servers in the official MCP Registry: Dec 2025 1,204; May 2026 9,599; Aug 2026 25,761; Oct 2026 47,267. Third-party reading of the registry API SERVERS IN THE OFFICIAL MCP REGISTRY Dec 2025 1,204 May 2026 9,599 Aug 2026 25,761 Oct 2026 47,267 ACTIVE SERVERS THIRD-PARTY READING OF THE REGISTRY API
MCP SDK downloads a month
~500M
A2A supporting organizations
150+
Copilot Studio organizations
230,000+
Registry incidents
1

Deployments

Connector platforms give agents standing access to company systems

Microsoft says more than 230,000 organizations use Copilot Studio to build agents on Microsoft 365 data. Manus reached $100 million ARR before China ordered the Meta deal unwound. ByteDance open-sourced its Coze Studio agent builder in July 2025, and Alibaba says more than 800,000 agents were built on Bailian.

Flagship workflow agents deployments
DeploymentDeveloper / operatorWhereScaleAutonomyStatusControls declared
Microsoft Copilot StudioMicrosoft / EnterprisesGlobal1 million+ custom agents; 230,000+ organizations (May 2025)Runs autonomous triggersGenerally availableA2A support; governance through Agent 365
ManusManus / Consumers and prosumersGlobal$100 million ARR (Dec 2025)Runs multi-step web and computer tasksMeta purchase ordered unwound by NDRCNot confirmed
Coze and Coze SpaceByteDance / Developers and enterprisesChina and globalNot disclosed (Jul 2025)Agent builderGenerally availableNot confirmed

Recent events

  • Anthropic donated MCP to the Linux Foundation's Agentic AI Foundation on December 9, 2025.
  • Slack's MCP server passed 1 million active users within six weeks.
  • ServiceNow says agentic deployments rose ninefold in nine months.
  • Stolen Drift OAuth tokens let attackers pull data from hundreds of Salesforce instances in August 2025.

Attack surface

Six of ten attack-surface dimensions rate very significant or critical

Integrations, behavior boundary and multi-agent rate critical. Ratings use five levels, from limited to critical, and cover the paths an attacker or a failure can take into the agent.

Attack surface by dimension: Physical access limited; Identity and authentication very significant; Command and control channels very significant; Perception and sensors limited; Connectivity surface significant; OTA and update pipeline significant; Data capture and retention very significant; Integrations and permissions critical; Behavioral and policy boundary critical; Multi-agent coordination critical Physical access LIMITED Identity VERY SIGNIFICANT Command and control VERY SIGNIFICANT Perception LIMITED Connectivity SIGNIFICANT OTA updates SIGNIFICANT Data capture VERY SIGNIFICANT Integrations CRITICAL Behavior boundary CRITICAL Multi-agent CRITICAL
Attack surface rating by dimension. Longer, darker bars are rated higher.
Workflow agents attack surface by dimension
DimensionRatingWhy
Physical accessLimitedThe orchestration agent is software
Identity and authenticationVery significantService accounts, OAuth tokens across integrated tools, enterprise identity infrastructure
Command and control channelsVery significantGoal specification through prompts
Perception and sensorsLimitedWorkflow agents operate on textual and structured inputs
Connectivity surfaceSignificantAPI access to many integrated tools
OTA and update pipelineSignificantModel updates, prompt template changes, workflow definition changes, sub-agent updates flow through the operator's infrastructure
Data capture and retentionVery significantWorkflow state, sub-agent interactions, tool outputs, customer data flowing through the orchestrated process
Integrations and permissionsCriticalThe defining dimension
Behavioral and policy boundaryCriticalPlanning-layer policy, tool-use policy, sub-agent coordination policy
Multi-agent coordinationCriticalThe defining property when multi-agent patterns are deployed

Incidents

One registry incident involves workflow agents

Each row links to its full record, with the control that failed, who found it and whether a reporting rule applied.

Registry incidents: workflow agents
IncidentDateAgentFound byControl that failed
Stolen Drift Tokens Drain Salesforce DataAug 2025AI chat agent integrationNot disclosedBroad OAuth tokens held by an AI chat agent

Rules

Protocol specs, not regulators, set most workflow agent controls

Rules that apply to workflow agents
RuleJurisdictionWhat it requiresStatus
China agent Implementation OpinionsChinaSector filing; 19 priority scenariosEffective Jul 15, 2026
NDRC foreign-investment review (Manus)ChinaBarred foreign investment in ManusApr 27, 2026
MCP specification 2026-07-28Open standardAuthorization aligned with OAuth and OpenID ConnectReleased Jul 28, 2026
A2A v1.0Open standardSigned Agent Cards for agent identityApr 2026

Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.

Record

Page Record

Agent class
Software
Datasets
ai_deployments.csv (3 rows for this page); ai_attack_surface.csv (10 rows); ai_incidents.csv (1 linked)
Key sources
MCP adoption (Digital Applied)
A2A (Linux Foundation)
Manus (Decrypt)
Last verified
October 2026