R3-02 · backs slide 18
R3-02 Product experiment log
Supports slide 18.
Four tests on the anchor. Each one names what we tried, what came back and the call it forced.
| Test | Dates | What we tried | Result | Decision |
|---|---|---|---|---|
| Mapping engine | Mid-Aug to 30 Sep 2026 | A multi-word expression engine to recognise control and policy language, with provenance on every mapping | Done after six and a half weeks: about 56,000 definitions generated. Derived mappings carry our label; publisher-traced mappings carry the publisher’s. | Ship. Next test is Jev (R3-08). |
| MCP server beta | Invites 18 Sep; release 19 Sep | Agents query the crosswalk directly. About a dozen invites to existing API users; more than half said yes the same day. | Kevin Houston: “I am connected, and it works great!” (22 Sep). SecRed ran a five-battery harness (21 Sep), found a real defect (an edge rule returning a bare 403), Michael fixed it the same day, and SecRed re-ran against production on 27 Sep. Marfi signed an NDA 23 Sep and is testing. IT Convergence assigned an engineer. | Keep the beta. See the surprise below. |
| Pricing page | 9 to 10 Sep (Sprint 20 SCAMPER); emails 16 to 23 Sep | SCAMPER on 78 upgrade-CTA events, 2 paid-tier clicks and 0 checkouts in eight days. Top three: quote path beside checkout, one-question email to the eight named visitors, partner-led revenue through DTA. | One-question emails: 6 sent of 16 planned (16 to 23 Sep). Hugh at Deura InfoSec said yes at $1,000 a year; Heidi said the fees surprised her. | Keep asking. 2 organisations now pay through Stripe; Hugh invoiced 1 Oct. |
| Partner marketing pages | Finished 25 Sep 2026 | A page per partner on stigviewer.com | Live but unlinked while they go through editorial review (30 Sep). | Keep. Every new partner gets one. |
The surprise
Customers won’t pay for MCP separately. The evidence came from a partner’s customers, not ours. Micah Spieler at Strike Graph, 24 Sep: “The biggest request from the lower tier was for our MCP server, but when we tried to charge for it, we got a lot of push back. Customers pointed to all their other tools that didn’t charge for MCP usage.” I made the call the same morning: “For now, we’ll just bundle API and MCP together.” In August I’d planned MCP as a separately priced product. Someone else’s evidence changed that before we spent on it.
Not yet evidenced:
- that the mapping engine output is “crosswalked” across all 56,000 definitions (the record says “generated to recognise control and policy language”)
- that partners link to their pages, or that the reseller conversation starts from them
- that the quote path beside checkout has shipped
Sources:
- Mapping engine and partner pages: Weekly Check-In 30 Sep 2026
- MCP beta: Weekly Check-In 23 Sep 2026 (invites, release, SecRed report, Michael’s 22 Sep fix); Weekly Check-In 30 Sep 2026 (Marfi NDA, SecRed re-run, IT Convergence)
- MCP pricing: Weekly Check-In 30 Sep 2026 (Micah Spieler quote and bundling call); Weekly Check-In 2 Sep 2026 (MCP as a separate product, 27 Aug)
- Pricing page: Sprint20_SCAMPER_Cougias.md (Sprint 20 Micro-assessment folder); Weekly Check-In 9 Sep and 23 Sep 2026
- Paying organisations: R2-05