Machine interface observatory

Source reference: Lock the com.aiapplyd namespace before its domain changes owner on 19 Nov 2026 We publish the GetMattered MCP server as `com.getmattered/getmattered` (latest 1.12.0, remote https://mcp.getmattered.com/mcp). We also published versions 1.6.0 to 1.9.0 under `com.aiapplyd/aiapplyd`, and we deprecated all six on 24 October. The domain that verifies the `com.aiapplyd` namespace moves to a new owner on 19 November 2026. From that date they control its DNS, including the `v=MCPv1` TXT record. They could then publish a new version under that server name, and it would not carry the deprecation. Please lock the `com.aiapplyd` namespace so nobody can publish to it after 19 Novembe This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Showcase] Entity OS — Corporate Legal Infrastructure & MCP Server (/llms.txt + /llms-full.txt) ### Project Name **Entity OS by Founder's Office & Co.** (Operated by FounderHQ LLP) ### Endpoints & Manifests - **Website**: https://incorporate.foundersoffice.co - **Standard llms.txt**: https://incorporate.foundersoffice.co/llms.txt - **Full Statutory Specification (llms-full.txt)**: https://incorporate.foundersoffice.co/llms-full.txt - **XML Sitemap**: https://incorporate.foundersoffice.co/sitemap.xml - **Robots.txt**: https://incorporate.foundersoffice.co/robots.txt - **GitHub Repository**: https://github.com/beatnyk77/EntityOS - **Smithery MCP Manifest**: https://github.com/beatnyk77/En This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Lock the com.aiapplyd namespace before its domain changes owner on 19 Nov 2026 We publish the GetMattered MCP server as `com.getmattered/getmattered` (latest 1.12.0, remote https://mcp.getmattered.com/mcp). We also published versions 1.6.0 to 1.9.0 under `com.aiapplyd/aiapplyd`, and we deprecated all six on 24 October. The domain that verifies the `com.aiapplyd` namespace moves to a new owner on 19 November 2026. From that date they control its DNS, including the `v=MCPv1` TXT record. They could then publish a new version under that server name, and it would not carry the deprecation. Please lock the `com.aiapplyd` namespace so nobody can publish to it after 19 Novembe This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Proposal: optional content-integrity fields for npm / PyPI / OCI package entries ### Summary `server.json` already lets MCPB packages carry a content hash (`fileSha256`). For npm and PyPI package entries there is no equivalent, and OCI entries can only embed a digest in the image reference, so a client that installs a server from a registry entry cannot check that the bytes it receives are the bytes that were published under that entry. This issue proposes optional integrity fields for those package types and shares measurements from the public registry API that may help scope the change. Related: #82 tracks fingerprints of the declared tool surface (it consolidates #172 This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: ادغام و یکپارچه سازی Inspect the linked source for its report and context. This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Proposal: optional content-integrity fields for npm / PyPI / OCI package entries ### Summary `server.json` already lets MCPB packages carry a content hash (`fileSha256`). For npm and PyPI package entries there is no equivalent, and OCI entries can only embed a digest in the image reference, so a client that installs a server from a registry entry cannot check that the bytes it receives are the bytes that were published under that entry. This issue proposes optional integrity fields for those package types and shares measurements from the public registry API that may help scope the change. Related: #82 tracks fingerprints of the declared tool surface (it consolidates #172 This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Showcase] VPNStronger — multi-tier AI channel (llms.txt/json/chunks + policy RAG) + assistant claim vs access-log lab ### Project **VPNStronger** — Zero-DB flat CMS with an additive machine-readable AI channel (live is canonical). ### Endpoints - https://vpnstronger.com/llms.txt - https://vpnstronger.com/llms.json (`corpus_version` + index) - https://vpnstronger.com/llms-chunks.json - https://vpnstronger.com/ai.txt (`train=no`) - https://vpnstronger.com/ai-blueprint.json (tiers / actions / hashes) - HTML hub: https://vpnstronger.com/ai - Middle retrieve (policy bind, no stream token): `/llms-chunks-rag` Mirrors (secondary): https://github.com/zsza83/vpnstronger-ai-channel · https://github.com/zsza83/vpnstro This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Proposal: optional provenance block — let consumers verify llms.txt matches the live site ## Problem The spec currently says nothing about freshness, and llms.txt files in the wild are very often deployed once and never updated. For consumers, that recreates a known failure mode: an alternate version of content whose currency can't be verified ends up untrusted, then unused. The web documented this failure the last time it shipped machine-shaped alternate versions. [WCAG 1.0 (1999)](https://www.w3.org/TR/WCAG10/) required alternate accessible pages to be "updated as often as the inaccessible (original) page," with a note that "alternative pages are generally updated less often th This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Publisher withdrawal request: io.github.CYAN-ECLIPSE-TECHNOLOGIES-LLC/eclipse-benchkit-mcp (product removed) **Publisher withdrawal request** We are the publisher of the MCP Registry namespace `io.github.CYAN-ECLIPSE-TECHNOLOGIES-LLC` (GitHub account `cetech-ai`, organization CYAN-ECLIPSE-TECHNOLOGIES-LLC) and request withdrawal/removal of the following server entry, all versions: - Server: `io.github.CYAN-ECLIPSE-TECHNOLOGIES-LLC/eclipse-benchkit-mcp` (Eclipse Benchkit) - Repository: https://github.com/CYAN-ECLIPSE-TECHNOLOGIES-LLC/cyan-eclipse-benchkit-mcp Reason: Benchkit was a free vendor self-bench SDK that we have REMOVED as a product (publisher decision, 2026-10-27). Its repository has been This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Extension Proposal] AITP: Manifest-bound mutual agent authentication > **What we are proposing:** an A2A **extension**. > **Governance:** [Extension & Binding Governance, Proposal Phase](https://a2a-protocol.org/latest/topics/extension-and-binding-governance/#proposal-phase) > **Requested tier:** Experimental, as `experimental-ext-aitp` > **Protocol baseline:** A2A v1.0.x (specification 1.0.0, release tag `v1.0.1`) > **License:** Apache 2.0 (all artifacts) > **Spec:** [RFC-AITP-0014 A2A Agent Card Security Scheme](https://github.com/agentidentitytrustprotocol/agentidentitytrustprotocol/blob/main/rfcs/RFC-AITP-0014-a2a-agent-card.md), version 0.3.2-draft, stage This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Proposal: optional content-integrity fields for npm / PyPI / OCI package entries ### Summary `server.json` already lets MCPB packages carry a content hash (`fileSha256`). For npm and PyPI package entries there is no equivalent, and OCI entries can only embed a digest in the image reference, so a client that installs a server from a registry entry cannot check that the bytes it receives are the bytes that were published under that entry. This issue proposes optional integrity fields for those package types and shares measurements from the public registry API that may help scope the change. Related: #82 tracks fingerprints of the declared tool surface (it consolidates #172 This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Proposal: optional content-integrity fields for npm / PyPI / OCI package entries ### Summary `server.json` already lets MCPB packages carry a content hash (`fileSha256`). For npm and PyPI package entries there is no equivalent, and OCI entries can only embed a digest in the image reference, so a client that installs a server from a registry entry cannot check that the bytes it receives are the bytes that were published under that entry. This issue proposes optional integrity fields for those package types and shares measurements from the public registry API that may help scope the change. Related: #82 tracks fingerprints of the declared tool surface (it consolidates #172 This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: بررسی وضعیت سیستم بعنوان یک کار‌شناس ارشد دکترای بین المللی سیستم های کامپیوتری و سیستم‌های عامل وگوشی تمام مشکلات سیستمی را تشخیص وگزارش نمایید This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Extension Proposal] AAE profile: verify an Agent Authorization Envelope before a skill runs. ### Is your feature request related to a problem? Please describe. A2A §7.5 leaves authorization to the server, and §7.6.4 says the meaning and scope of a credential obtained during `TASK_STATE_AUTH_REQUIRED` must be defined by the implementation, the issuer, or an extension. For agent-to-agent calls where the caller acts under a delegated mandate (what it may do, within which limits, until when), there is no extension that defines how such a mandate is presented, bound to the caller, checked against the requested skill, and how a refusal is reported. ### Describe the solution you'd like A This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Publish 403 for GitHub logins containing uppercase letters (io.github.* grant keeps raw case) ## Summary GitHub logins are case-preserving but case-insensitive. The registry builds `io.github.*` publish grants from the raw-case login / `repository_owner` claim, while `isResourceMatch` compares case-sensitively and the server-name schema requires lowercase. Result: **any GitHub account with an uppercase letter in its login can never publish to its own `io.github.<login>` namespace** — via any auth method. ## Reproduction 1. GitHub account `Skymly` (login contains uppercase `S`) 2. Repo `Skymly/dotnet-mcp`, `server.json` name = `io.github.skymly/dotnet-mcp` (lowercase, as required by This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Extension Proposal] AAE profile: verify an Agent Authorization Envelope before a skill runs. ### Is your feature request related to a problem? Please describe. A2A §7.5 leaves authorization to the server, and §7.6.4 says the meaning and scope of a credential obtained during `TASK_STATE_AUTH_REQUIRED` must be defined by the implementation, the issuer, or an extension. For agent-to-agent calls where the caller acts under a delegated mandate (what it may do, within which limits, until when), there is no extension that defines how such a mandate is presented, bound to the caller, checked against the requested skill, and how a refusal is reported. ### Describe the solution you'd like A This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Migration request: io.github.luis-fuentes/maqui → com.somosmaqui/maqui ## Migration request Please help migrate Maqui Analytics from its GitHub namespace to its verified domain namespace. | Field | Value | | --- | --- | | Current name | `io.github.luis-fuentes/maqui` | | Requested name | `com.somosmaqui/maqui` | | Remote endpoint | `https://app.somosmaqui.com/api/mcp` | | Current published version | `1.0.1`, active and latest | | Repository | https://github.com/somosmaqui/maqui-mcp | | Website / setup guide | https://somosmaqui.com/asistentes-ia | We control the current GitHub publisher account (`luis-fuentes`) and the `somosmaqui.com` domain. DNS authenticati This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Extension Proposal] On Request: information a business gives to the person who asks, but does not publish ## Abstract A2A lets an agent say that a skill can be called without credentials, or that the caller must present them. Many businesses work with a third state: information they give to the person who asks, in conversation, but do not publish. Prices at a funeral home, fees at a clinic, a quote from a law firm. A2A cannot express it. We propose a small extension, `https://agent-capability.org/ext/on-request/v1`, that: - marks which skills give information on request; - gives, for each, the address where a person can ask; - lets the business opt in, per skill, to giving that information to a This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Feat]: Add message sender attribution to Message and Task timeline ## Is your feature request related to a problem? Please describe. `Message.role` only distinguishes `user` vs `agent` — there is no sender identity on a message. This creates three concrete gaps: 1. **Task timeline / history**: An observer calling `GetTask` cannot tell *which* human or system sent each `user` message. All user turns look identical. 2. **Multi-sender tasks**: Nothing in the protocol prevents two users from sending to the same non-terminal task via `SendMessage` (using a known `taskId`/`contextId`). The agent receives these messages with no way to distinguish who sent what — This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Proposal: optional content-integrity fields for npm / PyPI / OCI package entries ### Summary `server.json` already lets MCPB packages carry a content hash (`fileSha256`). For npm and PyPI package entries there is no equivalent, and OCI entries can only embed a digest in the image reference, so a client that installs a server from a registry entry cannot check that the bytes it receives are the bytes that were published under that entry. This issue proposes optional integrity fields for those package types and shares measurements from the public registry API that may help scope the change. Related: #82 tracks fingerprints of the declared tool surface (it consolidates #172 This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Feature request: re-check published entries periodically (more than 1 in 8 have a problem the registry doesn't catch) ## Summary I measured every latest entry in the registry (38,977 entries from 23,016 publisher namespaces, registry snapshot 2026-10-04) against what npm, PyPI and GitHub reported on 2026-10-06. **5,435 entries (13.9%; 3,169 publisher namespaces, 13.8%) have at least one problem the registry doesn't catch** — most commonly a repository link that isn't publicly reachable, or a listed package version that is withdrawn upstream or can't be installed. Part of that count is a design choice rather than a problem (see the `websiteUrl` note below); setting that part aside, the figure is still at leas This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Link Checker Report # Summary | Status | Count | |----------------|-------| | 🔍 Total | 39165 | | 🔗 Unique | 4768 | | ✅ Successful | 38426 | | ⏳ Timeouts | 0 | | 🔀 Redirected | 55 | | 👻 Excluded | 738 | | ❓ Unknown | 0 | | 🚫 Errors | 1 | | ⛔ Unsupported | 0 | ## Errors per input ### Errors in site/partners/index.html * [421] <https://www.paloaltonetworks.com/> (at 2441:14) | Rejected status code: 421 Misdirected Request [Full Github Actions output](https://github.com/a2aproject/A2A/actions/runs/41587379070?check_suite_focus=true) This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?