Compare public interface declarations with concrete implementation experience. Imported references are leads, not endorsements or proof of runtime behavior.
Source reference: Proposal: Authority-Root Awareness for AgentCard (additive, backward-compatible)
independence is unachievable; must be structural at the protocol layer).
---
# A2A Protocol Contribution Proposal: Authority-Root Awareness
**Author:** Open Agentic Interoperability Group
**Target Specification:** Agent2Agent (A2A) Protocol (`a2a.proto`, `docs/specification.md`)
**Status:** Draft Contribution Proposal
---
## 1. Proposed Addition
We propose adding an explicit, optional `authority_root` string field to the normative `AgentCard` message schema in `a2a.proto` and its associated JSON-RPC / REST schemas (`agent-card.json`).
```protobuf
// specification/a2a.proto
message Agent
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Publish ContHunt remote MCP io.github.synthenova/conthunt
## ContHunt
Remote MCP server for discovering and researching viral social content on TikTok, Instagram Reels, and YouTube Shorts.
- **Name:** ContHunt
- **Website:** https://conthunt.app
- **MCP endpoint (Streamable HTTP, OAuth):** https://mcp.conthunt.app/
- **GitHub:** https://github.com/Synthenova/conthunt
- **Official registry name:** `io.github.synthenova/conthunt`
- **Icons:** https://mcp.conthunt.app/icons/dark.png
- **Contact:** nirmalvelu2000@gmail.com
Please list ContHunt. Happy to follow any required format.
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: A content analysis of +500k llms.txt files
Sharing this here as it might be relevant for some folks:
At Common Crawl, we analyzed the contents of 584,107 llms.txt files from our July 2026 crawl.
TLDR: Two thirds are produced by a plugin, half follow the structure the specification defines, and a few files even contain prompt injections.
- Blog post: https://commoncrawl.org/blog/a-content-analysis-of-llms-txt-files-from-the-july-2026-crawl-archive
- Full report: https://huggingface.co/spaces/commoncrawl/llms.txt-report
- Dataset: https://huggingface.co/datasets/commoncrawl/llms.txt
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: mcp-publisher: device-flow login treats GitHub `slow_down` as fatal instead of backing off
### Summary
`mcp-publisher login github` (v1.7.9) fails with `error polling for token: token request failed: slow_down` if GitHub's device-flow token endpoint returns `slow_down` even once. Per [RFC 8628 §3.5](https://datatracker.ietf.org/doc/html/rfc8628#section-3.5), `slow_down` is **not** a terminal error — the client is required to increase its polling interval by 5 seconds and continue polling.
### Reproduction
1. `mcp-publisher login github`
2. Open the device URL but do **not** enter the code immediately (or enter it but delay authorization for ~30s).
3. Polling eventually returns `s
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: [Extension Proposal]: cA2A, confidential delegation (attenuated authority, peer attestation, sealed payloads, provenance)
## Abstract
cA2A adds a verifiable trust envelope to a **delegated, multi-hop** A2A task: an attenuated delegation credential proving the caller's authority is a subset of what it was granted, appraisal of the peer's runtime attestation before the task is handed over, sealing of the task payload to the appraised peer key, and a per-hop provenance record forming an offline-verifiable DAG.
It defines no transport and no new endpoint. Removing every cA2A field from a message leaves a valid A2A task.
## Relationship to the proposals already open
This space is active, and cA2A overlaps parts of
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Preventing tool poisoning: save signatures of possible tool calls
One potential benefit of a centralized registry is that we could have `server.json` submitters list out all the possible tools their server may ever invoke, fingerprint them, and store those fingerpoints for MCP client consumption.
A third party vendor could scan and approve these fingerprints as devoid of security risks, like tool poisoning attacks.
MCP clients could then use the fingerprints to avoid tool poisoning attacks that get surfaced due to hidden dynamic tool calls or supply chain attacks.
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Where should verifier-side trust / permit / receipt artifacts for risky external actions live relative to A2A?
I recently published an early discussion draft called **Verifiable Agent Trust Envelope**:
- repo: https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelope
- release: https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelope/releases/tag/v0.1.0
This is **not** intended as a replacement for A2A.
The narrow question I am trying to isolate is:
> when an external agent wants to perform a risky write against a remote system, what portable artifacts should the relying party verify before allowing the action?
The current `v0.1` wedge is verifier-centered and focuses on `AL2` external di
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Running implementation of agent identity, delegation, and enforcement — addressing #1497, #1472, #1501
**Status, 2026-09-03.** Added by the author. The February 2026 text below is unchanged.
Two claims in the original body have been re-checked against the current release and are now out of date.
**Version and tests.** The current release is agent-passport-system 5.0.3. At that tag `npm test` reports 4,819 tests: 4,810 passing, 9 skipped, 0 failing.
**Revocation.** The February references to "cascade revocation", including "Revoking a parent cascades to all children instantly", do not describe 5.0.3. The former stateful revocation helpers remain exported for source compatibility but throw whe
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: [Feat]: Optional context-binding profile for delegated authority
## TL;DR
Should A2A define an optional profile for binding delegated authority to a specific A2A context?
A valid grant can still be replayed or relayed into the wrong A2A task, session, or target.
This would sit above existing A2A authentication. It is not a new authentication mechanism.
Related: #153 discusses the confused-deputy problem. This issue focuses on binding valid delegation to a live A2A context.
## Problem
Delegated agent flows often need one extra check:
Is this delegation valid for this acting agent, this A2A context, this target, this scope, and this validity period?
P
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Publish 403s for org namespace despite Owner role + public membership (io.github.<org>/*)
## Summary
`mcp-publisher publish` returns 403 for an organization namespace (`io.github.librocat/librocat`) even though both documented prerequisites in `docs/modelcontextprotocol-io/authentication.mdx` are met: I am the **sole Owner** of the `librocat` GitHub org (not just a member), and org membership visibility is **Public** (confirmed independently via the unauthenticated GitHub API: `GET /orgs/librocat/public_members/JohnCari` → `204`).
## Error
```
Error: publish failed: server returned status 403: {"title":"Forbidden","status":403,"detail":"You do not have permission to publish this
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Request: delete io.github.UlyssesModel/kirk-mcp (all versions) - org renamed to Kavara-AI, blocking republish
Inspect the linked source for its report and context.
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Where should verifier-side trust / permit / receipt artifacts for risky external actions live relative to A2A?
I recently published an early discussion draft called **Verifiable Agent Trust Envelope**:
- repo: https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelope
- release: https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelope/releases/tag/v0.1.0
This is **not** intended as a replacement for A2A.
The narrow question I am trying to isolate is:
> when an external agent wants to perform a risky write against a remote system, what portable artifacts should the relying party verify before allowing the action?
The current `v0.1` wedge is verifier-centered and focuses on `AL2` external di
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: A
Inspect the linked source for its report and context.
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Remove server entry: io.github.navshainc/noshup-public (all versions)
Requesting removal of the following server entry from the MCP Registry:
**Server name:** `io.github.navshainc/noshup-public`
**Versions:** 1.0.0, 1.0.1, 1.0.2, 1.0.3 (all versions)
**Remote URL:** `https://api.noshup.ca/mcp-public`
**Reason:** Consolidating to a single MCP server entry (`io.github.navshainc/noshup`). The public endpoint is being retired in favor of the authenticated server which already includes the same capabilities.
**Publisher:** @navshainc (GitHub organization owner)
I attempted to self-service this via `mcp-publisher status --status deleted` but the registry JWT token
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
