MCP Server Provenance Records
A signed statement about an MCP server: what it is, what tools it exposes, who is saying so, and how much that is worth. Specification: spec/server-provenance-v1.md.
cMCP enforces policy at the call boundary and can say nothing about whether the server on the other end is what it claims. Its catalog answers that locally, with approved definitions and a pinned TLS fingerprint, but all of it is operator-asserted: nothing one operator learns is usable by the next.
from agentrust_trace.provenance import build_record, sign_record, verify_record, check_tool_catalogcheck_tool_catalog() is a separate call, on purpose
Verifying the signature proves a document is internally consistent and signed by a key you trust. That is exactly what an attacker holding a stolen publisher key produces. What they cannot do is make the server in front of you offer the tools their record describes.
That comparison needs something verify_record() structurally does not have — what the server said to you — so it is its own call, with its own exception type, so a consumer can tell "bad document" from "wrong server".
Assurance is a closed set
publisher-asserted, observer-attested, tee-attested. The interesting fact about a provenance record is never that it exists but who is asserting it, and a verifier MUST NOT read absence as any of them.
Identity is artifact, endpoint, or both
A URL is the obvious handle and the worst candidate: it moves, it is per-deployment, and two operators running the same server produce different ones. artifact.digest covers the entrypoint rather than the interpreter — every interpreted server on a host shares one interpreter digest, so a pin over it matches a completely different server. endpoint.spki_sha256 digests the public key rather than the certificate, so identity survives renewal.
Out of scope, and it says so
Key distribution for publisher (a PKI question this format would only pretend to answer), whether a server is any good (the moment a provenance format scores servers, its publisher becomes the party everyone must trust), and what the code does at runtime.
Full detail in CHANGELOG.md.