Skip to content

Free2PA 0.3.1 - Agent-native MCP trust gate

Choose a tag to compare

View all tags
@kilroyblockchain kilroyblockchain released this 18 Jul 16:49
v0.3.1
23a0d93

Free2PA 0.3.1: Agent-native MCP trust gate

Free2PA is the automatic trust gate for the files that steer AI agents. This
patch makes the Streamable HTTP MCP server a first-class integration surface.

Added

  • Generic verify_asset MCP tool for any Nerve Center file and neighboring
    Free2PA sidecar.
  • Declared MCP input and output schemas.
  • Structured PASS/FAIL and LOAD/REJECT results with independent
    signature, exact-file, certificate-currentness, and local publisher-trust
    facts.
  • Stable VERIFIED, CONTENT_CHANGED, INVALID_SIGNATURE, EXPIRED_CERT,
    and UNTRUSTED_ISSUER reason codes.
  • Read-only, idempotent MCP tool annotations and bounded request bodies.
  • A complete public project dossier with architecture, threat model, judging
    strategy, evidence, schedule, risks, and definition of done.

Verification

  • 14 automated tests pass.
  • A real Streamable HTTP client proves trusted LOAD, changed-file REJECT,
    and outside-group REJECT behavior.
  • The exact public release commit passed GitHub-hosted CI.
  • The archive clean-installs on Node.js 20+ and includes the Codex skill.
  • npm audit --omit=dev reports zero known vulnerabilities.
  • No signing private keys are included.

Free2PA is Apache-2.0 freeware. It is C2PA-inspired, not a conforming or
interoperable C2PA implementation, and does not claim C2PA endorsement.

Assets 26
Loading