MCP harvesting:trustworthy data when your agent has a connector, not an API.

The model did not hallucinate. The data was never read.

If you let an agent read enterprise systems through a tool connector, this failure is already in your pipeline, and it is silent: the model does not hallucinate, the data is simply never read.

An agent is asked whether a supplier's safety certification is current. It calls a search tool, gets a result titled "Supplier Certification Overview," and reports that the supplier is certified. The answer is wrong: the snippet came from a two-year-old summary, and the current status, a lapsed certificate with a renewal in progress, was in a hidden tab the search never opened. Two steps later a second agent has written "certified" into a sourcing decision, and nothing records that the status was never read from a current source.

The model summarised exactly what the tool handed it. The failure was upstream, in the gap between the tool returned a result and the data was actually captured. The fix is not a smarter model. It is a discipline: never treat a search result as data, capture the real body, record where it came from, and refuse to promote any claim that cannot point back to a real source. Applied to an MCP surface, that discipline is MCP harvesting. The mechanics are ordinary, and section vii of the full note names which prior work each piece comes from. The contribution is two framings and one experiment.

The surface you are given is lossy, and you cannot fix it.

The new consumer of enterprise data is often another agent, and it cannot glance at a snippet and infer the rest, cannot tell a result is tangential, and does not get a second look. When the reader is a machine, the data has to carry its own context. The industry has noticed the demand side: a16z made machine legibility a headline of its 2026 outlook, and the data vendors are merging to ship "context layers" agents can read. Every one of those is written for the data producer, the team that owns the system and can clean it. The agent owner who was granted access to someone else's flaky surface, and has no authority to fix the server, is the consumer side of the same problem, and the 2026 discourse does not serve them.

That surface is lossy and non-deterministic, measured rather than asserted: a 2026 benchmark of real multi-tool tasks found frontier models completing under 60 percent of them, needing a parallel reference harness just to account for the surface returning different things at different times.¹ The failure modes are specific and repeatable, and each one shapes the architecture.

• A search hit is a lead, not evidence. A title or snippet is not the document; it becomes evidence only when a second call captures the actual body. Classify honestly what you captured; a preserved-but-unread file is a recorded gap, not a success.
• A "permission denied" is often a routing artifact. A file the user can already open returns 403 on one route and resolves on another. Chain fallback routes inside that one granted access, and record the trail. A genuine denial is a gap, never retried.
• A record id is not a content identity. The same bytes appear under two ids; hash the content and make the hash the identity, or you double-count.
• Search is ambiguous, and the failure is entity resolution. A query for one company matches a different one named alike. Bind every record to its entity by strength and keep only the strong bindings. Most agent failures over enterprise data are entity-resolution failures wearing the costume of reasoning failures.
• It is a documented security exposure. The lethal trifecta of tool access, untrusted content, and outbound capability has a name and a growing incident list; a 2026 review reported roughly two hundred thousand exposed servers.² Recording origin, classifying sensitivity, and never executing what you ingest is both the harvest discipline and the security posture.

Sample a sensor, do not call an API.

You do not trust any single read. You sample repeatedly, stamp every sample with where and when it came from, and make the sampling safe to repeat. Idempotency, content hashing, and the disk boundary are not arbitrary choices; they are what sampling a sensor requires.

The real decision is not deterministic or agentic. It is where you draw the line between the two.

The line is the disk. The agent collects and writes raw bytes; every deterministic guarantee runs on what is now on disk. There is one honest seam: the first hop, the agent issuing the call, is itself agent-mediated and not fully deterministic, so the discipline keeps that hop thin and mechanical and makes everything downstream idempotent, so a re-run catches what a flaky first read missed.

Refine with a model cascade, then gate every claim.

Refinement turns the raw harvest into typed knowledge through a cheap-model, expensive-model cascade. To be exact: in the single run on record, one top-tier model did both steps. The cascade is the design, not a result shown yet, and the savings the literature reports are modest, around a quarter to a half at matched quality, not the headline figures.³

The output is a typed atom: one claim, a payload a schema constrains, and two things that make it checkable. A locator carries the source, the content hash, the exact location, and a short quote copied literally from the source, the falsifiability handle; if the model cannot produce a real quote, the atom is dropped. An evidence strength, one of stated, implied, or inferred, tells a downstream agent how far to trust it.

Then the gate. The single strongest reason it exists: a 2026 study found citation links almost always work and are usually on-topic, yet the share of claims the cited source actually supports ran from 24 to 77 percent, collapsing toward 17 percent for one frontier model as tool calls scaled into the hundreds.⁴ A citation that looks valid and is not is worse than no citation, because it passes a glance. So the gate checks, deterministically, that the cited artifact is present, the quote appears, and the claim does not contradict the aggregated facts. Whether the better semantic check actually pays is the next section.

A similarity gate scores relatedness. Relatedness is not support.

A claim that can be wrong, the experiment pre-registered to break it, and what happened when it ran.

The structural reason is in the embeddings: the unsupported similarity-traps average a cosine of 0.89 to their source and the contradicted pairs 0.87, both higher than the genuinely supported paraphrases at 0.77. No threshold separates supported from unsupported, because the most dangerous unsupported claims look more like their source than the honest supported ones do. To catch most unsupported claims a similarity gate has to reject most good ones. The pre-registered falsification condition, that entailment fails to beat similarity at an equal or lower false-refuse rate, did not trigger. On this corpus the claim survives.

What this does and does not establish. The corpus is synthetic, authored and labelled by a single person, so it has no independent label check; it is built to contain the adversarial cases the grounding literature documents in the wild, and the finding is the gap between gate types, not an absolute rate. The "embedding gate" is a bi-encoder cosine; a cross-encoder or a fine-tuned natural-language-inference model would do better, and shades into the entailment gate. That is the honest boundary: similarity scoring cannot separate related from supported; entailment judgment, whether a small fine-tuned model or an LLM, can.

And what one production run cannot show

The full pattern was also run end to end once, on a single enterprise account. It demonstrated the failure modes in the wild: the same bytes under two ids that hashing caught, a record named after the target that belonged to a different company, material the convenient query path missed.

When to use this, and when not.

If a clean, complete API sits right behind the surface and you are authorised to call it, building this machinery is the wrong tool. The pattern earns its keep in a narrow box, and outside it is over-engineering.

One boundary on the architecture: the deterministic spine is only as deterministic as the surface allows. If the server is a thin shell over flaky screen automation, the retries are deterministically re-poking an unstable pipe. Harvesting bounds the damage, it records what it got and refuses to over-claim, but it cannot manufacture a reliability the source does not have.

The conditions under which this is wrong.

1. Not "MCP replaced the API." The API usually remains the source of truth. The claim is only that the surface an agent is granted is increasingly lossier than the API behind it.
2. The mechanics are not new. Idempotent extraction is data engineering; the cascade is model routing; the deterministic-around-the-model shape is compound AI systems.⁵ The contribution is two framings and one experiment.
3. Frontier models may shrink the niche. The pattern durably wins only where provenance is required, the fact count is high, freshness matters, and an audit trail is mandatory. Outside that box it is over-engineering, the condition that would make this wrong.
4. The central benefit is unproven on production data. The gate result is on a synthetic set; the one production run did not run the cascade or exercise the gate's reject path. The magnitudes are corpus-specific; the structural claims are what transfer.
5. The substrate mostly does not exist in production yet. Analysts rate agent-ready data as over-hyped and forecast more than 40 percent of agentic projects cancelled within two years.⁶ The missing substrate is the opportunity and the reason most attempts will not ship.

The reader is a machine. The surface gives it less.

The shift underneath all of this is that the consumer of enterprise data is becoming a machine that needs more structure and more provenance than a human ever did, and the access it is granted is becoming an unreliable tool surface rather than a clean API. MCP harvesting answers both at once: it samples the surface like a sensor, stamps every sample, refines with a model only where judgment is genuinely required, and gates the result so an unsupported claim cannot pass as a supported one. The mechanics are borrowed and named honestly. What this note defends is the framing, and the one test that says whether the central design choice earns its cost.