Skip to content

@polygraphso/litmus 0.36.0

Latest
Latest

Choose a tag to compare

View all tags
@RubenSousaDinis RubenSousaDinis released this 20 Jul 15:52
litmus-v0.36.0
8e9f9d5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Ships the litmus-v17 remote-grading hardening to the published package and the MCP registry.

  • Honest C-03 on remote targets. A remote (Streamable HTTP) server cannot have canaries planted in its environment, so probe 4.1 and C-03 now record skipped (reason: remote target) instead of a silent pass. A clean remote server still caps at B, now with C-02 and C-03 both named as not verified. Local stdio grading is unchanged (C-03 still pass/fail). This is the one pass/fail-semantics change; older attestations stay valid because methodologyVersion is a string.
  • Realistic client identity. The harness no longer announces itself as a fixed test client in the handshake. It presents a realistic MCP client identity drawn from a small fixed pool, chosen deterministically per target and overridable via LITMUS_CLIENT_NAME / LITMUS_CLIENT_VERSION, and records the presented identity in the evidence bundle.
  • Advisory surface-consistency check (remote only). After grading, the harness re-enumerates the tool surface on a second connection and records an advisory finding if it changed. Disclosure only; never moves the letter grade.

On-chain EAS schema unchanged (a skipped C-03 uses the existing skipped sentinel); bundle schema 1.9.0 to 1.10.0. Plugin 0.7.3 carries the 0.36.0 pin.

Assets 3
Loading