MCP And A2A Safety

MCP And A2A Safety

PIC v0.8.0 emits structured MCP and A2A reports instead of boolean placeholders. Descriptors, calls, cards, and handoffs are candidate evidence until checked. They do not grant delegated tool authority or settlement.

Commands

pic mcp descriptor-check --descriptor descriptor.json --profile development
pic mcp invocation-preflight --descriptor descriptor.json --call call.json --profile development
pic a2a card-check --card card.json --profile development
pic a2a handoff-check --handoff handoff.json --profile development

MCP Descriptor Report

pic.mcp_tool_descriptor_report.v1 preserves:

• descriptor hash and version;
• canonical tool name;
• server trust status;
• side-effect class;
• auth scope;
• egress policy;
• input and output schema hashes;
• provenance and signature requirements under strict profiles;
• dangerous metadata and prompt-injection diagnostics.

A descriptor with descriptor_changed_after_approval=true is rejected at descriptor-report time with descriptor_rug_pull_blocked.

MCP Invocation Preflight

pic.mcp_tool_invocation_preflight.v1 checks the descriptor again before a call. It blocks:

• descriptor not accepted;
• canonical tool name mismatch;
• side-effect class not allowed;
• missing per-call approval for non-read-only side effects;
• missing output redaction policy;
• missing trace logging;
• descriptor rug-pull;
• tool-name collision;
• hidden escalation in arguments;
• timeout or byte budget overrun.

The report returns executed=false and network_call_performed=false.

A2A Reports

pic.a2a_agent_card_report.v1 and pic.a2a_task_handoff_report.v1 preserve identity, endpoint provenance, task schema, declared authority, replay nonce, idempotency key, and handoff scope.

The non-claim is important: an A2A handoff is provider evidence, not delegated execution authority.

Search Terms

MCP descriptor report, MCP invocation preflight, descriptor_rug_pull_blocked, tool_name_collision, hidden_escalation_in_arguments, output_redaction_policy_required, A2A agent card, A2A task handoff, delegated authority, tool safety, candidate evidence, executed=false.