Skip to content

v0.8.54 — MCP Tasks deny-by-default admission (SEP-2663) + elicitation-provenance (SEP-2260)

Choose a tag to compare

View all tags
@sattyamjjain sattyamjjain released this 23 Jul 06:36
v0.8.54
5e8058c

Two per-spec deny-by-default presets for the MCP 2026-07-28 final spec, shipped ahead of the spec cut-over. Both are opt-in, in-process (decorator, not a proxy), and keep the Pydantic-only zero-dep core intact.

MCP Tasks deny-by-default admission — SEP-2663

SEP-2663 finalises Tasks as an official extension, and a server may return a task handle unsolicited. This is the admission-control layer above the shipped SEP-1686 lifecycle guard, which it composes with (reuses the handle→principal/scope binding and unsolicited-/foreign-handle rejection — TasksAdmissionError subclasses TaskLifecycleError, so one except catches every Tasks refusal).

  • Capability gate — a tasks/* op is refused (tasks_capability_not_advertised) unless the client advertised the Tasks extension ({"tasks": {}} or {"experimental": {"tasks": {}}}).
  • Per-principal quota — outstanding tasks capped at max_outstanding_tasks (task_quota_exceeded).
  • TTL — handles expire after task_ttl_seconds (task_ttl_exceeded), stale handles swept to free a quota slot — shutting the Akamai hit-and-run task-DoS shape.

mcp_tasks_2026_07_28_defaults() / MCP_TASKS_2026_07_28.

MCP elicitation-provenance guard — SEP-2260

SEP-2260 makes any unsolicited server→client request invalid: a server may only raise an elicitation / sampling prompt within an active client-initiated request window. A server that pushes an elicitation with no client request in flight is a clean injection vector — the host renders the prompt as if the user's own system asked for it. This is the provenance (the when) axis, complementary to the shipped content classifier mcp_elicitation_guard_2026_04 (the what).

  • Tracks the client requests in flight (RequestWindow); check_elicitation_solicited(...) refuses unsolicited_elicitation (no window open) and foreign_request_window (referenced request id not in flight).
  • Operators mark the window with the client_request_window(window, request_id) context manager alongside @observe — no new engine, no new dependency.

mcp_elicitation_provenance_2026_07_defaults() / MCP_ELICITATION_PROVENANCE_2026_07.

Both presets are discovered by list_active(), top-level exported, and every decision flows through the shipped observability.track_event hook. SEP-2663 and SEP-2260 are spec ids, not CVEs. 28 new tests; full suite green (3,575 tests, 85.9% coverage).

Assets 2
Loading