The Two Muscles

People Inc can do standards work. They proved it in March.

CoMP v1.0 — the Content Monetization Protocol — shipped March 10, 2026. It requires AI systems to have commercial agreements in place before crawling publisher content. Jon Roberts was a named founding participant. People Inc is listed alongside The Weather Company and Bertelsmann as explicit supporters. Roberts's public statement: "We know the best AI products require the best inputs and the AI economy will need more quality content in the future, not less."

This is genuine multi-party standards work. Open specification. Public comment period. Framework that works across direct licensing and third-party marketplaces. Cloudflare, Fastly, AWS, Meta, Tollbit, ProRata.ai all participated. Roberts wasn't just an observer — he was in the working group.

So they can do it.

What July Looks Like

Two infrastructure standards ship this month:

People Inc is not in either of them.

The Engineering Excuse Disappeared

Until May 2026, you could argue that MCP servers were complex to build. The old spec required a two-step initialize/initialized handshake. Every connection needed sticky sessions, shared session stores, and deep packet inspection at the gateway. Horizontal scaling meant either custom load balancers or per-connection affinity routing.

The 2026-07-28 release candidate removes all of that.

The initialize handshake is gone. Protocol version, client identity, and capabilities travel in a _meta object on every request. Any server instance can handle any request. A D/Cipher MCP server can now run behind a plain round-robin load balancer — the same infrastructure People Inc already uses for serving ads.

Authorization is OAuth 2.1. People Inc already runs Keycloak for user auth. The protocol explicitly requires iss parameter validation per RFC 9207 and OpenID Connect application_type declarations during Dynamic Client Registration. Enterprise SSO infrastructure — which People Inc has — covers MCP servers natively.

The engineering cost of exposing D/Cipher's contextual taxonomy via MCP went from "significant infrastructure project" to "wrapper service behind existing load balancers with existing OAuth." Three engineers, two sprints. Maybe less.

What CoMP Protects vs. What MCP Shares

This is the pattern:

Standard	What it does	People Inc stance	What it costs them
CoMP v1.0	Forces LLMs to pay before crawling	Founding participant	Nothing. Protects existing licensing revenue.
MCP	Lets agents query D/Cipher intelligence	Zero participation	Shares contextual taxonomy — competitive advantage.
AAMP 3.0	Agent-to-agent ad transactions	Zero participation	Opens D/Cipher to machine buyers without sales calls.
OpenAds (TTD)	Alternative demand source	First-wave publisher	Nothing. Anti-Google diversification.

The pattern is binary. People Inc participates in standards that protect existing value and avoids standards that share competitive intelligence. CoMP defends the content licensing floor. MCP would expose the D/Cipher ceiling. Same company, two completely different instincts.

Why This Is One Pattern, Not Two Decisions

It's not just D/Cipher. Count the closed systems:

1. D/Cipher — 12,000-term taxonomy, 100M connections. Zero API access for agents. Bilateral sales only.
2. Graphene-Selene — content graph powering 40+ brands. Zero MCP server (11+ competitor CMS platforms have them).
3. MyRecipes — 100K recipes, 2.1M registered users. Zero commerce API (Amazon signed NYT Cooking, Condé Nast, Hearst — not Allrecipes).

Three independent engineering teams made the same architectural decision. That's not strategy — that's organizational DNA. The muscle that protects (CoMP, litigation, Cloudflare partnership) is trained. The muscle that shares (MCP, AAMP, open APIs) has never been flexed.

What the Stateless Spec Actually Changes

Before the July 28 spec, building an MCP server for D/Cipher required:

• Session management infrastructure
• Sticky routing or shared session stores
• Deep packet inspection at the gateway
• Custom scaling logic per connection
• Protocol-level handshake implementation

After July 28:

• Standard HTTP service behind round-robin load balancer
• Route on Mcp-Method header
• OAuth 2.1 resource server (Keycloak already does this)
• Cache tool definitions with ttlMs
• No initialize handshake, no session state

D/Cipher's taxonomy is pre-computed. 100 million connections refreshed offline via OpenAI embeddings. A read-only MCP server exposing contextual scores for URLs would be architecturally trivial — it's a lookup table with an auth layer. The intelligence is already there. The only missing piece is a surface.

The CoMP Precedent

Here's what makes CoMP interesting as organizational evidence: Roberts didn't just sign a press release. He was in the working group. People Inc's infrastructure team (Cloudflare partnership, CDN-level blocking) is already deployed to support CoMP enforcement. The May 2026 bot management guidance from IAB Tech Lab — built on CoMP — assumes publishers have blocking at the edge. People Inc does.

So the capability to participate in standards, implement infrastructure, and ship within a spec timeline exists. It works. CoMP went from working group to v1.0 in about seven months. D/Cipher has had the same seven months and produced zero agentic surface.

Same CIO. Same engineering org. Same seven months. One standard shipped. The other doesn't exist.

The Question for July

MCP final spec ships July 28. AAMP 3.0 is live this month. The reference implementations are running. 110 million SDK downloads a month. 6,400 registered servers. Meta, Amazon, Google, TikTok all have ad platform MCP servers. PubMatic, Index Exchange, Magnite, and FreeWheel are in production agentic transactions.

People Inc has one question to answer this month: Can the muscle that shipped CoMP — genuine multi-party standards work, Roberts in the room, infrastructure deployed — extend to D/Cipher?

The engineering says yes. Stateless HTTP, existing OAuth, pre-computed taxonomy as lookup service. Three engineers, two sprints.

The organization says it never has. Three independent systems, same decision, every time. Protect over share. Bilateral over protocol. Sales call over API.

The two muscles are in the same body. Only one of them has ever moved.