MCP server components and a server-to-catalog relationship method
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Active
- Domain
- documentation, security
Research direction
Start with docs/rfcs/composite-component-appraisal.md §9 and open question 6, then review TR-COMP-MCP-001 and TR-COMP-MCP-002 in #439. Read test_catalog_substitution_after_proof_stops_transport and coverage.json for the current gateway-only behavior; done means the evidence requirements, recomputable server-catalog relationship, and vectors for server mismatch and appraisal drift are defined.
Written by the indexing model from the issue text.
Description
Spec section affected
None yet. docs/rfcs/composite-component-appraisal.md §9 and open question 6, TR-COMP-MCP-001 and TR-COMP-MCP-002, from #439.
Problem
mcp-server and tool-catalog are separate component categories. The COMP-MCP-* vectors keep their results apart, so a valid server with an altered catalog, or a valid catalog from an untrusted server, is non-affirming for the right component. But no profile says what evidence an mcp-server component rests on. And no relationship method binds a catalog to the server that served it.
Today the gateway enforces that binding outside the token. The holder proves the exact action, including the server identity and the catalog definition hash, so a catalog swapped after the proof stops transport (test_catalog_substitution_after_proof_stops_transport). That is why TR-COMP-MCP-002 is gateway-only in coverage.json.
Proposed change
- An
mcp-serverappraisal profile that names its evidence: artifact provenance, endpoint identity and transport key binding. Which of these are required is the first question. - A relationship method, with a digest preimage a second implementation can recompute, that ties a
tool-catalogcomponent to themcp-servercomponent that served it. - Vectors for a catalog served by a different server, and for drift after appraisal.
Backward compatibility
- Non-breaking (new optional field, informative addition)
Motivation
Tool poisoning and rug pulls happen at the server-catalog seam. The token should be able to say which server a catalog came from, not leave it to each gateway.
Related issues or PRs
#439
Generated with Claude Code
- Dominant language
- Python
- Stars
- 37
- Forks
- 33
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 120
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from agentrust-io/trace-spec
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
agentrust-io/trace-spec#593 · 1 comment ·
Maintainers usually reply within 1 day
-
bug needs-review:HIGH
Difficulty 5/5 Over a week Newbie friendliness 20/100
agentrust-io/trace-spec#591 · 11 comments ·
Maintainers usually reply within 1 day
-
prototype(manifest_requirements): resolve accepted_methods without duplicating bindings and reject unconfigured binding endpoints with ProfileErrorPossibly taken @drk-ram claimed this 2 days ago. Open
Difficulty 3/5 1-2 days Newbie friendliness 78/100
agentrust-io/trace-spec#580 ·
Maintainers usually reply within 1 day
-
feat(delegation): add parent_record_hash, verify_delegation_link, and verify_delegation_chain to agentrust_tracePossibly taken @drk-ram claimed this 2 days ago. Open
Difficulty 4/5 3-5 days Newbie friendliness 58/100
agentrust-io/trace-spec#581 ·
Maintainers usually reply within 1 day
-
revocation,trust-record-verify: implement es256 and es384 bundle verification and add EC revocation vectors (#448 items 1, 10)Possibly taken @drk-ram claimed this 2 days ago. Open
Difficulty 4/5 3-5 days Newbie friendliness 52/100
agentrust-io/trace-spec#584 ·
Maintainers usually reply within 1 day
All issues in agentrust-io/trace-spec
Similar issues
-
[Bug]: IndexHandler.post crashes with HTTP 500 on malformed payloads, missing credentials, or when login is disabledPossibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 6 days
-
github_actions
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
collective/icalendar#2003 · 1 comment ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 79/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
openzim/python-scraperlib#360 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
volcengine/OpenViking#6445 ·
Maintainers usually reply within 1 day