Extension: Server Identity and Tool Attestation#17
Open
abdelsfane wants to merge 1 commit intomodelcontextprotocol:mainfrom
Open
Extension: Server Identity and Tool Attestation#17abdelsfane wants to merge 1 commit intomodelcontextprotocol:mainfrom
abdelsfane wants to merge 1 commit intomodelcontextprotocol:mainfrom
Conversation
Define cryptographic server identity and tool attestation for MCP. Addresses OWASP MCP Top 10 risks: server impersonation (MCP09), tool poisoning (MCP03), supply chain attacks (MCP04), and insufficient authentication (MCP07). Specification includes: - Ed25519 key pairs for server identity (JWK format) - Self, publisher, and DNS attestation types - Tool definition signing via _meta - Challenge-response verification (identity/get, identity/challenge) - Key revocation mechanism Previously submitted as SEP-2267 to the core spec repository. Redirected here per maintainer guidance as an auth extension.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
_meta, challenge-response verification, and key revocationMotivation
MCP has no mechanism for clients to verify server identity or detect tool definition tampering. The OWASP MCP Top 10 identifies related risks:
Existing auth extensions solve client-to-server authorization. This extension solves the complementary problem: server-to-client identity.
Context
This was originally submitted as SEP-2267 to the core spec repository. Per maintainer guidance from @localden, this extension belongs in
ext-authrather than the core spec.The document has been reformatted to follow the ext-auth extension conventions (MDX format, numbered sections, parameter tables, RFC keyword styling).
What's Included
specification/draft/server-identity-attestation.mdx— Full extension specificationExtension capabilities:
_metaidentity/getandidentity/challengeJSON-RPC methodsBackward Compatibility
All new fields and methods are additive. Servers that do not implement this extension are unaffected. Clients that do not support it ignore the identity metadata. Existing OAuth mechanisms continue to work unchanged.
References