MCP And A2A Safety

MCP And A2A Safety

PIC-TS v0.8 mirrors Python PIC structured MCP and A2A reports. Descriptors, calls, cards, and handoffs are candidate evidence until checked. They do not grant delegated tool authority or settlement.

Commands

npx pic-ts mcp descriptor-check --descriptor descriptor.json --profile development
npx pic-ts mcp invocation-preflight --descriptor descriptor.json --call call.json --profile development
npx pic-ts a2a card-check --card card.json --profile development
npx pic-ts a2a handoff-check --handoff handoff.json --profile development

MCP Checks

MCP descriptor reports preserve descriptor hash, version, canonical tool name, side-effect class, auth scope, egress policy, schema hashes, provenance/signature requirements, dangerous metadata, prompt-injection diagnostics, and rug-pull blockers.

A descriptor with descriptor_changed_after_approval=true is rejected at descriptor-report time and again at invocation-preflight time.

Invocation preflight also blocks canonical name mismatch, missing per-call approval, missing output redaction policy, missing trace logging, tool-name collision, hidden escalation in arguments, and budget overruns.

The report returns executed=false.

A2A Checks

A2A reports preserve identity, endpoint provenance, task schema, declared authority, replay nonce, idempotency key, and handoff scope.

The non-claim is important: an A2A handoff is provider evidence, not delegated execution authority.

SDK

import {
  a2aAgentCardReport,
  a2aTaskHandoffReport,
  mcpToolDescriptorReport,
  mcpToolInvocationPreflight,
} from "percolation-inversion-compiler-ts";

Search Terms

PIC-TS MCP descriptor report, MCP invocation preflight, descriptor_rug_pull_blocked, tool_name_collision, hidden_escalation_in_arguments, output_redaction_policy_required, A2A agent card, A2A task handoff, delegated authority, tool safety, candidate evidence, executed=false.