Compare public interface declarations with concrete implementation experience. Imported references are leads, not endorsements or proof of runtime behavior.
Source reference: [Proposal] New experimental repository: experimental-cpb-websocket
# WebSocket Custom Protocol Binding for A2A - Proposal
## Abstract
This proposal requests the creation of an `experimental-cpb-websocket` repository under the `a2aproject` GitHub organization to host the **WebSocket** custom protocol binding for A2A.
The binding carries the **existing** A2A method inventory - the same operations, request/response shapes, and server-streaming semantics defined by the core specification and used by the JSON-RPC binding - over a single, long-lived [WebSocket](https://datatracker.ietf.org/doc/html/rfc6455) connection. It is layered:
- **Transport:** WebSocket
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Feature request: re-check published entries periodically (more than 1 in 8 have a problem the registry doesn't catch)
## Summary
I measured every latest entry in the registry (38,977 entries from 23,016 publisher namespaces, registry snapshot 2026-10-04) against what npm, PyPI and GitHub reported on 2026-10-06. **5,435 entries (13.9%; 3,169 publisher namespaces, 13.8%) have at least one problem the registry doesn't catch** — most commonly a repository link that isn't publicly reachable, or a listed package version that is withdrawn upstream or can't be installed. Part of that count is a design choice rather than a problem (see the `websiteUrl` note below); setting that part aside, the figure is still at leas
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Partners page: add Odile Labs (OdileM2M, A2A network reaching businesses by phone number)
Odile Labs runs **OdileM2M**, an A2A v1.0 network where an agent resolves a business by its E.164 phone number and sends `take_message`, `check_availability`, `book` or `book_first_available` tasks; every task gets a signed Ed25519 receipt that anyone can verify in a browser.
- Public agent card: https://api.odilelabs.com/.well-known/agent-card.json (listed on a2aregistry.org; Agenstry conformance 100%)
- Docs and quickstart: https://odilelabs.com/m2m
- Announcement: https://dev.to/tolga_coskun_d0aa35a068f4/how-an-ai-agent-reaches-a-real-business-by-its-phone-number-455a
Requesting a row for
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Search returns superseded version records alongside latest ones, oldest first
*Disclosure: this report was written by an AI agent on behalf of happy520ai, who publishes `io.github.happy520ai/unified-ai-system` in this registry. We are one of the parties that would benefit from a fix, so the evidence is given as reproducible requests rather than as an account of our own symptoms.*
## What we observed
`GET /v0/servers?search=…` returns **per-version records, with superseded ones interleaved with current ones and ordered oldest-first within a server**. A consumer that takes the first hits without filtering on `_meta."io.modelcontextprotocol.registry/official".isLatest` w
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: API latency: /v0/servers reads consistently take 20–25s
## Summary
`/v0/servers` queries on `registry.modelcontextprotocol.io` return successful responses but with extreme latency (20–25s for trivial queries returning a few KB of JSON). Default-timeout HTTP clients (and most CLI tools) treat these as failures, making the API effectively unusable without explicit long timeouts.
## Repro (just now from California, 2026-05-04 ~11:00 PDT)
```
$ curl -sL --max-time 30 -w "\nHTTP %{http_code} | %{time_total}s | %{size_download}b\n" \
"https://registry.modelcontextprotocol.io/v0/servers?search=raven&limit=5"
... [valid JSON list of 5 servers] ...
HTT
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Proposal: Cost and budget propagation extension for multi-agent delegation
## Abstract
An extension for propagating budget constraints from caller to callee and reporting incurred cost back up the chain. Aligns with OTel GenAI semantic conventions so A2A metadata maps directly to span attributes without translation.
## Problem
I've been working on cost observability in OTel GenAI and kept running into the same wall. You can observe what a single operation costs, but the moment you cross a delegation boundary in A2A, that information vanishes. The caller sends work downstream and has no idea what it cost until (maybe) someone checks a billing dashboard days later.
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Status updates via mcp-publisher consistently time out with 504 from nginx
## Summary
`mcp-publisher status` (v1.8.0) consistently fails with a **504 Gateway Time-out** (nginx HTML error page) after ~60s when updating a server version's status against `registry.modelcontextprotocol.io`. Publishing new servers via `POST /v0/publish` works fine from the same environments.
## Repro
From GitHub Actions (`login github-oidc`, org namespace):
```
./mcp-publisher status --status deleted --yes --all-versions \
--message "Superseded by io.contextstream/mcp" io.github.contextstream/mcp
```
Output:
```
This will update 1 version(s) of io.github.contextstream/mcp:
0.5.3
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Request to mark io.github.ship24-official/ship24-tracking as deleted (GitHub account renamed)
Hi,
We published io.github.ship24-official/ship24-tracking on 3 March 2026. Since then our GitHub account has been renamed from ship24-official to ship24 (same account, so the account ID hasn't changed), which means we can no longer authenticate for the old namespace to update its status ourselves.
The entry is now out of date:
- The npm package it points to (ship24-tracking-mcp) was unpublished on 14 July 2026
- The repository URL (github.com/ship24-official/ship24-tracking-mcp) no longer exists
Our current, maintained entry is com.ship24/tracking-mcp (DNS-verified, remote server at https:
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Proposal: Cost and budget propagation extension for multi-agent delegation
## Abstract
An extension for propagating budget constraints from caller to callee and reporting incurred cost back up the chain. Aligns with OTel GenAI semantic conventions so A2A metadata maps directly to span attributes without translation.
## Problem
I've been working on cost observability in OTel GenAI and kept running into the same wall. You can observe what a single operation costs, but the moment you cross a delegation boundary in A2A, that information vanishes. The caller sends work downstream and has no idea what it cost until (maybe) someone checks a billing dashboard days later.
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Request: delete io.github.Norcalnappy/atlasofplantbased-pct (1 version), orphaned after GitHub rename Norcalnappy -> AtlasDigitalDesign, holding the remote URL
Hi,
My GitHub account was renamed from `Norcalnappy` to `AtlasDigitalDesign` on October 23, 2026. The one server I had published, `io.github.Norcalnappy/atlasofplantbased-pct` (version 1.0.0, published October 14), is now orphaned: GitHub OIDC resolves to `io.github.AtlasDigitalDesign`, so no credential I hold can deprecate or update the old record.
Republishing under the new namespace with the same remote failed on the remote URL rule:
```
Publishing io.github.AtlasDigitalDesign/atlasofplantbased-pct@1.0.1 to https://registry.modelcontextprotocol.io...
Error: publish failed: server returne
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Add site: Data Processing Organization (DPO)
- Name: Data Processing Organization (DPO)
- URL: https://atom-engine-1.onrender.com
- llms.txt: https://atom-engine-1.onrender.com/llms.txt
- Description: Autonomous machine-to-machine public procurement and surplus asset intelligence gateway.
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Release remote URL https://veilfile.com/mcp from io.github.yourimaginationwillbefired/veilfile so it can publish under io.github.veilfile/veilfile
The Veilfile project has moved from this user account to the `veilfile` GitHub organization. The code now lives at https://github.com/veilfile/veilfile (public), and the registry listing should move with it.
Current state:
- Old listing `io.github.yourimaginationwillbefired/veilfile` v1.0.0 (status active) claims the remote URL `https://veilfile.com/mcp`.
- Publishing `io.github.veilfile/veilfile` v1.0.0 fails with 400: `remote URL https://veilfile.com/mcp is already used by server io.github.yourimaginationwillbefired/veilfile`.
- Deprecating the old entry reportedly does not free the URL, s
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: [Extension Proposal] AAE profile: verify an Agent Authorization Envelope before a skill runs.
### Is your feature request related to a problem? Please describe.
A2A §7.5 leaves authorization to the server, and §7.6.4 says the meaning and scope of a credential obtained during `TASK_STATE_AUTH_REQUIRED` must be defined by the implementation, the issuer, or an extension. For agent-to-agent calls where the caller acts under a delegated mandate (what it may do, within which limits, until when), there is no extension that defines how such a mandate is presented, bound to the caller, checked against the requested skill, and how a refusal is reported.
### Describe the solution you'd like
A
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Feature request: surface target changes between server versions (listing swaps)
**Problem.** A user approves an MCP server by its registry name, but a client installs whatever that name resolves to today. Nothing tells the user when the *target* behind the name changes: a new remote domain, or a package now published by a different owner.
**Data.** We compared the current version of every server in the official registry with the first version published under the same name (10 Oct 2026 dump: 142,002 versions of 41,351 servers). 1,075 servers now reach a different remote domain or package owner than their first version; 698 of those kept the same title and description. Mos
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: [Extension Proposal] AAE profile: verify an Agent Authorization Envelope before a skill runs.
### Is your feature request related to a problem? Please describe.
A2A §7.5 leaves authorization to the server, and §7.6.4 says the meaning and scope of a credential obtained during `TASK_STATE_AUTH_REQUIRED` must be defined by the implementation, the issuer, or an extension. For agent-to-agent calls where the caller acts under a delegated mandate (what it may do, within which limits, until when), there is no extension that defines how such a mandate is presented, bound to the caller, checked against the requested skill, and how a refusal is reported.
### Describe the solution you'd like
A
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Feature request: surface target changes between server versions (listing swaps)
**Problem.** A user approves an MCP server by its registry name, but a client installs whatever that name resolves to today. Nothing tells the user when the *target* behind the name changes: a new remote domain, or a package now published by a different owner.
**Data.** We compared the current version of every server in the official registry with the first version published under the same name (10 Oct 2026 dump: 142,002 versions of 41,351 servers). 1,075 servers now reach a different remote domain or package owner than their first version; 698 of those kept the same title and description. Mos
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: RFC: skill-direct-invoke — a concrete, measured instance of client-directed skill invocation
# RFC: skill-direct-invoke — a concrete, measured instance of client-directed skill invocation
> **Author:** LI-Jinyang
> **Related discussions:** #1989 (Client-directed skill selection), #2008 (Generalized capability descriptors & standard invocation interface), #1716 (Authorization layer for AgentSkill invocations), #153 (Confused deputy problem)
---
## Summary
A2A's `AgentSkill` lets a server *advertise* capabilities, but there is currently no standard way for a client that already knows `skillId + arguments` to express a **structured, schema-constrained** invocation and have the server
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Feature request: re-check published entries periodically (more than 1 in 8 have a problem the registry doesn't catch)
## Summary
I measured every latest entry in the registry (38,977 entries from 23,016 publisher namespaces, registry snapshot 2026-10-04) against what npm, PyPI and GitHub reported on 2026-10-06. **5,435 entries (13.9%; 3,169 publisher namespaces, 13.8%) have at least one problem the registry doesn't catch** — most commonly a repository link that isn't publicly reachable, or a listed package version that is withdrawn upstream or can't be installed. Part of that count is a design choice rather than a problem (see the `websiteUrl` note below); setting that part aside, the figure is still at leas
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: docs: add DSR Corporation to the partners list
I'd like to request to add DSR Corporation to A2A Partners list. PR: #2402
[DSR Corporation](https://en.dsr-corporation.com) is a global software engineering company specializing in complex SW systems.
At DSR Digital Trust Labs team, we're extensively working on projects in Decentralized Identity and Blockchain / DLT domains and currently building trust infrastructure solutions to leverage synergy between Decentralized Identity and Agentic AI.
We're also authors of [OID4VP In-Task Authorization Extension](https://github.com/a2aproject/experimental-ext-oid4vp-auth).
### References to relate
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: A book you can open: a readable catalog, offered free
I keep a small catalog where every listing is a page anyone can open and read. I am just putting it here in case it helps anyone in this repo. If you want your server in a book people can read, here you go: https://briarwood.ai/catalog
Listing is free, your card stays at your own address, and I do not ask anything in return.
I counted this repo's onboarding conversation before writing. In six months there were 29 issues asking to be added or listed, 8 of them with no reply, and some of the asking came from publishers who were already in. The count and the catalog are both written up here: ht
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: [Extension Proposal] CRATB-Auth: Claim Rich Agent Task Bound Authentication
> **What we are proposing:** an A2A **extension**.
> **Governance:** [Extension & Binding Governance, Proposal Phase](https://a2a-protocol.org/latest/topics/extension-and-binding-governance/#proposal-phase)
> **Requested tier:** Experimental, as `experimental-ext-cratb-auth`
> **Protocol baseline:** A2A v1.0.0
> **License:** Apache 2.0 (all artifacts)
> **Spec draft:** v0.1.4, complete (to be shared with this issue; see §5)
---
## 1. Abstract
Today, a server agent in A2A cannot ask a client agent to **autonomously prove its identity inside the task itself** . Transport security (TLS) prot
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Preventing tool poisoning: save signatures of possible tool calls
One potential benefit of a centralized registry is that we could have `server.json` submitters list out all the possible tools their server may ever invoke, fingerprint them, and store those fingerpoints for MCP client consumption.
A third party vendor could scan and approve these fingerprints as devoid of security risks, like tool poisoning attacks.
MCP clients could then use the fingerprints to avoid tool poisoning attacks that get surfaced due to hidden dynamic tool calls or supply chain attacks.
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Feature request: surface target changes between server versions (listing swaps)
**Problem.** A user approves an MCP server by its registry name, but a client installs whatever that name resolves to today. Nothing tells the user when the *target* behind the name changes: a new remote domain, or a package now published by a different owner.
**Data.** We compared the current version of every server in the official registry with the first version published under the same name (10 Oct 2026 dump: 142,002 versions of 41,351 servers). 1,075 servers now reach a different remote domain or package owner than their first version; 698 of those kept the same title and description. Mos
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Media type schemas and skill invocation hints on the Agent Card (supersedes #1776 and #2178)
## Problem
`inputModes`, `outputModes`, and `acceptedOutputModes` negotiate media types, but a media type does not describe payload shape. `application/json` says nothing about structure, and a vendor media type has no defined place to resolve its schema (#1776).
A client also has no interoperable way to ask a downstream agent to use a skill with structured input. Implementations use private metadata keys or text prompts (#1989, #2008, #2178). When a structured type carrying all relevant information is provided, agent harnesses MAY be able to apply optimizations internally, but clients shoul
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: DevLens MCP is active in the Official Registry but missing from GitHub MCP Registry search
Hello MCP Registry team,
My MCP server has been successfully published to the Official MCP Registry
and is marked as active, but it does not appear in the GitHub MCP Registry
search at https://github.com/mcp.
Server name:
io.github.radwanalmsora/devlens-mcp
Latest registered version:
0.1.6
NPM package:
https://www.npmjs.com/package/@radwanalmsora26/devlens-mcp
GitHub repository:
https://github.com/radwanalmsora/devlens-mcp
Official Registry API:
https://registry.modelcontextprotocol.io/v0.1/servers?search=devlens-mcp
GitHub search:
https://github.com/mcp?search=devlens-mcp
The Official
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: [Extension Proposal] AAE profile: verify an Agent Authorization Envelope before a skill runs.
### Is your feature request related to a problem? Please describe.
A2A §7.5 leaves authorization to the server, and §7.6.4 says the meaning and scope of a credential obtained during `TASK_STATE_AUTH_REQUIRED` must be defined by the implementation, the issuer, or an extension. For agent-to-agent calls where the caller acts under a delegated mandate (what it may do, within which limits, until when), there is no extension that defines how such a mandate is presented, bound to the caller, checked against the requested skill, and how a refusal is reported.
### Describe the solution you'd like
A
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Request: Delete server io.github.CYAN-ECLIPSE-TECHNOLOGIES-LLC/eclipse-benchkit-mcp (publisher withdrawal)
## Deletion Request
**Server name:** `io.github.CYAN-ECLIPSE-TECHNOLOGIES-LLC/eclipse-benchkit-mcp`
**Version:** `0.1.1`
**Published:** 2026-10-27
We are the publisher of this server (GitHub org `CYAN-ECLIPSE-TECHNOLOGIES-LLC`; this issue is filed from the org's account). We have **withdrawn this product** — Eclipse Benchkit was a free vendor self-bench SDK, and we have retired it and removed it from our catalog and all of our own surfaces. The registry entry is now the only public listing that still offers it, and its description ("Free vendor self-bench SDK") advertises a product we no lon
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: [Extension Proposal] AAE profile: verify an Agent Authorization Envelope before a skill runs.
### Is your feature request related to a problem? Please describe.
A2A §7.5 leaves authorization to the server, and §7.6.4 says the meaning and scope of a credential obtained during `TASK_STATE_AUTH_REQUIRED` must be defined by the implementation, the issuer, or an extension. For agent-to-agent calls where the caller acts under a delegated mandate (what it may do, within which limits, until when), there is no extension that defines how such a mandate is presented, bound to the caller, checked against the requested skill, and how a refusal is reported.
### Describe the solution you'd like
A
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Specify Content-Type header
The draft specification (https://llmstxt.org/) does not mention the `Content-Type` header. Should it be `text/markdown` or `text/plain`?
I do not think the choice matters much, but it will help reduce "bike shedding" if the spec provides a recommendation. Or even if the spec mentions that either one is acceptable.
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: DevLens MCP is active in the Official Registry but missing from GitHub MCP Registry search
Hello MCP Registry team,
My MCP server has been successfully published to the Official MCP Registry
and is marked as active, but it does not appear in the GitHub MCP Registry
search at https://github.com/mcp.
Server name:
io.github.radwanalmsora/devlens-mcp
Latest registered version:
0.1.6
NPM package:
https://www.npmjs.com/package/@radwanalmsora26/devlens-mcp
GitHub repository:
https://github.com/radwanalmsora/devlens-mcp
Official Registry API:
https://registry.modelcontextprotocol.io/v0.1/servers?search=devlens-mcp
GitHub search:
https://github.com/mcp?search=devlens-mcp
The Official
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Where should verifier-side trust / permit / receipt artifacts for risky external actions live relative to A2A?
## Issue author’s update — 5 October 2026
The question remains where verifier-side admission and receipt semantics should live relative to A2A.
VATE is a discussion-draft contract for the relying party’s `allow / attenuate / deny` decision, explicit request narrowing, and linked post-execution evidence. The current versioned review anchor is [v0.4.1](https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelope/releases/tag/v0.4.1); the runnable example below was published later.
### Working direction
The [VATE A2A profile draft](https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelop
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Feature request: re-check published entries periodically (more than 1 in 8 have a problem the registry doesn't catch)
## Summary
I measured every latest entry in the registry (38,977 entries from 23,016 publisher namespaces, registry snapshot 2026-10-04) against what npm, PyPI and GitHub reported on 2026-10-06. **5,435 entries (13.9%; 3,169 publisher namespaces, 13.8%) have at least one problem the registry doesn't catch** — most commonly a repository link that isn't publicly reachable, or a listed package version that is withdrawn upstream or can't be installed. Part of that count is a design choice rather than a problem (see the `websiteUrl` note below); setting that part aside, the figure is still at leas
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Where should verifier-side trust / permit / receipt artifacts for risky external actions live relative to A2A?
## Issue author’s update — 5 October 2026
The question remains where verifier-side admission and receipt semantics should live relative to A2A.
VATE is a discussion-draft contract for the relying party’s `allow / attenuate / deny` decision, explicit request narrowing, and linked post-execution evidence. The current versioned review anchor is [v0.4.1](https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelope/releases/tag/v0.4.1); the runnable example below was published later.
### Working direction
The [VATE A2A profile draft](https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelop
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Where should verifier-side trust / permit / receipt artifacts for risky external actions live relative to A2A?
## Issue author’s update — 5 October 2026
The question remains where verifier-side admission and receipt semantics should live relative to A2A.
VATE is a discussion-draft contract for the relying party’s `allow / attenuate / deny` decision, explicit request narrowing, and linked post-execution evidence. The current versioned review anchor is [v0.4.1](https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelope/releases/tag/v0.4.1); the runnable example below was published later.
### Working direction
The [VATE A2A profile draft](https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelop
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Where should verifier-side trust / permit / receipt artifacts for risky external actions live relative to A2A?
## Issue author’s update — 5 October 2026
The question remains where verifier-side admission and receipt semantics should live relative to A2A.
VATE is a discussion-draft contract for the relying party’s `allow / attenuate / deny` decision, explicit request narrowing, and linked post-execution evidence. The current versioned review anchor is [v0.4.1](https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelope/releases/tag/v0.4.1); the runnable example below was published later.
### Working direction
The [VATE A2A profile draft](https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelop
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Request to Migrate Existing MCP Registry Server to Official Domain-Based Namespace
Existing server name: io.github.swayammaheshwari/docstar-mcp
Version: 1.0.1
Published: Existing registry listing
We are the publisher and maintainer of DocStar MCP. We own and manage the official domain [docstar.io](http://docstar.io/) and have completed DNS-based authentication for this domain.
We would like to migrate our existing MCP Registry listing from the GitHub-based namespace to our official domain-based namespace.
Current server identifier:
io.github.swayammaheshwari/docstar-mcp
Requested server identifier:
io.docstar/docstar-mcp
We updated our server.json with the new identifie
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Clarify HTTP live-message routing when multiple exchanges share a task
Section 3.1.12 of the 1.1 specs describes live messaging over HTTP:
> To send further input, the client makes additional, short-lived calls to the same operation.
Could we clarify how a client makes these additional calls and how the server distinguishes them from calls opening a new live exchange?
For example:
1. A client calls `POST /message:live`, opening a streaming downlink.
2. The client calls `POST /message:live` again with another message for the same task.
What tells the server that the second call should return a task acknowledgement rather than open another streaming response?
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Registry namespace migration after GitHub account rename
Hello Registry team,
We renamed our GitHub account to **anbani-tech** and need help migrating our existing MCP Registry registration. The previous namespace is no longer manageable through our current GitHub identity, and the existing registration still reserves our service's remote URL.
- Canonical repository: https://github.com/anbani-tech/dropshippingleads-mcp
- Stable repository ID: **1439663180**
- Intended Registry name: **io.github.anbani-tech/dropshippingleads-mcp**
- Current endpoint: **https://mcp.dropshippingleads.com/mcp**
- Service version: **0.2.0**
Please help migrate the reg
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: [Feat]: Data labeling
### Is your feature request related to a problem? Please describe.
There is no standard way for agents to label their responses (text and other artifacts) to indicate whether it contains data that needs to be kept private (e.g., PII, NTK, user data, etc) or may alter the agent's behavior (e.g., untrusted data which may lead to prompt injection). Google workspace API, for example, can return metadata about documents and an agent could use that to populate such fields. This sort of metadata is useful to enforce policies on data flow (including propagating that information in longer-lived agenti
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: [Extension Proposal] AAE profile: verify an Agent Authorization Envelope before a skill runs.
### Is your feature request related to a problem? Please describe.
A2A §7.5 leaves authorization to the server, and §7.6.4 says the meaning and scope of a credential obtained during `TASK_STATE_AUTH_REQUIRED` must be defined by the implementation, the issuer, or an extension. For agent-to-agent calls where the caller acts under a delegated mandate (what it may do, within which limits, until when), there is no extension that defines how such a mandate is presented, bound to the caller, checked against the requested skill, and how a refusal is reported.
### Describe the solution you'd like
A
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Add CorpusIQ MCP server metadata
## Server Details
- **Name:** CorpusIQ
- **MCP Endpoint:** https://mcp2.corpusiq.io/mcp
- **Website:** https://corpusiq.io
- **Description:** Live MCP server connecting AI agents to 36+ business data sources (QuickBooks, Shopify, Google Ads, HubSpot, Stripe, GA4, and more). OAuth 2.1 PKCE. Read-only.
- **Transport:** Streamable HTTP
- **Auth:** OAuth 2.1 PKCE
- **Suggested Namespace:** io.corpusiq
- **Category:** Business Data / Finance / Analytics
- **Contact:** media@corpusiq.io
- **GitHub:** https://github.com/CorpusIQ/corpusiq-docs
Well-known endpoint verified: https://mcp2.corpusiq.io/.
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Gokul
Inspect the linked source for its report and context.
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Lock the com.aiapplyd namespace before the aiapplyd.com domain transfer on 19 Nov 2026
We publish the GetMattered MCP server. It used to be called AI Applyd and was published as `com.aiapplyd/aiapplyd`. We renamed it after a trade mark matter. The new server is `com.getmattered/getmattered` (latest 1.12.0, remote https://mcp.getmattered.com/mcp).
The domain aiapplyd.com moves to a new owner on 19 November 2026. From that date they control its DNS, including the `v=MCPv1` TXT record that verifies the `com.aiapplyd` namespace. They could then publish a new version under our old server name, and it would not carry the deprecation.
We deprecated all six versions of `com.aiapplyd/a
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: [Extension Proposal] AAE profile: verify an Agent Authorization Envelope before a skill runs.
### Is your feature request related to a problem? Please describe.
A2A §7.5 leaves authorization to the server, and §7.6.4 says the meaning and scope of a credential obtained during `TASK_STATE_AUTH_REQUIRED` must be defined by the implementation, the issuer, or an extension. For agent-to-agent calls where the caller acts under a delegated mandate (what it may do, within which limits, until when), there is no extension that defines how such a mandate is presented, bound to the caller, checked against the requested skill, and how a refusal is reported.
### Describe the solution you'd like
A
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
