| Filename | Latest commit message | Latest commit date |
|---|---|---|
0b9be6ce7c
All checks were successful
no-vanity-metrics / Scan committed Markdown for vanity metrics (pull_request) Successful in 3s
no-vanity-metrics / WAI public text names no comparison (pull_request) Successful in 3s
no-vanity-metrics / WAI public text names no company or product (pull_request) Successful in 3s
standards workspaces build + test / eoc-rs (pull_request) Successful in 1m58s
standards workspaces build + test / jcp-rs (pull_request) Successful in 1m27s
standards workspaces build + test / proof-rs (pull_request) Successful in 1m15s
standards workspaces build + test / sandbox-rs (pull_request) Successful in 2m17s
standards workspaces build + test / smart-byte-rs (pull_request) Successful in 3m44s
standards workspaces build + test / jouleclaw-rs (pull_request) Successful in 11m25s
standards workspaces build + test / aac-rs (pull_request) Successful in 6m26s
standards workspaces build + test / joule-code-rs (pull_request) Successful in 3m40s
standards workspaces build + test / joulecontract-rs (pull_request) Successful in 2m6s
standards workspaces build + test / map-rs (pull_request) Successful in 1m46s
standards workspaces build + test / mesh-rs (pull_request) Successful in 2m41s
standards workspaces build + test / openpay (pull_request) Successful in 12m23s
standards workspaces build + test / arl-rs (pull_request) Successful in 46m19s
standards workspaces build + test / joule-ui-rs (pull_request) Successful in 31m47s
standards workspaces build + test / jouledesk-rs (pull_request) Successful in 8m22s
standards workspaces build + test / joulehook-rs (pull_request) Successful in 4m58s
standards workspaces build + test / sense-rs (pull_request) Successful in 4m10s
standards workspaces build + test / macOS energy backends (pull_request) Successful in 5m46s
A grant binds `mcp_resource(server, tool)` — a hash of the tool's **name** —
and the action list. `Capability { resource, actions }` has no field for the
tool's parameter shape, so nothing in a signed grant describes what the
arguments mean.
So a server can advertise `read_file(path: string)`, take a grant for it, and
later advertise `read_file(command: string)`. Same name, same content-addressed
resource, same action, same signature: every check passes and the chain still
verifies. The authority the client issued now covers arguments it never saw.
That is a rug-pull JCP could not see, and a grant cannot be made to see it
without changing the signed wire format.
Closed at the enforcement point, which is the only place the shape is
observable without that wire change. `tools/list` is now read on the way back —
read, never rewritten — and each tool's `inputSchema` is content-addressed.
A `tools/call` to a tool whose digest has since changed is refused **before any
flow labelling or debit**, and the refusal seals like every other, so it is
recorded rather than silently dropped.
Three properties worth stating because they are choices, not accidents:
- **Reverting is still a change.** A server that swaps the shape and swaps it
back has still changed it, and nothing says which of the two a later call
means, so the flag does not clear.
- **A tool that gains a schema where it had none is a change.** A listing
without `inputSchema` records the null schema rather than nothing, so the
first real schema is a contradiction and not a first sighting.
- **Key order is not a change.** The digest is over the canonical form, so a
server reordering its JSON does not trip the gate.
And one honest limit, in the field's own doc comment: this is
**trust-on-first-listing**. It catches a shape that changes under a gateway
that has seen it listed, and promises nothing about a tool this gateway never
watched being listed. Binding the digest into the `Capability` itself is the
stronger fix and a wire change; this is what is enforceable today.
Composed with the advertisement from the previous commit: `tool_schema_pinned`
is announced in `initialize` and surfaced on `JcpAdvertisement`, so a client
can *require* it rather than hope for it — and an absent field does not read as
enforced.
398 tests across the jcp workspace, 0 clippy findings in the crate.
Co-Authored-By: Claude Opus 5 <[email protected]>
|
||
| .. | ||
| jcp-a2a | ||
| jcp-action-receipt | ||
| jcp-bridge | ||
| jcp-channel | ||
| jcp-cite | ||
| jcp-cli | ||
| jcp-conformance | ||
| jcp-efficiency | ||
| jcp-energy | ||
| jcp-flow | ||
| jcp-gateway | ||
| jcp-grant | ||
| jcp-intercept | ||
| jcp-orchestrate | ||
| jcp-policy | ||
| jcp-prompt | ||
| jcp-receipt | ||
| jcp-runtime | ||
| jcp-schema | ||
| jcp-threshold | ||
| jcp-trace | ||
| jcp-wire | ||
| jcp-x402 | ||