Machine interface observatory

Source reference: Where should verifier-side trust / permit / receipt artifacts for risky external actions live relative to A2A? I recently published an early discussion draft called **Verifiable Agent Trust Envelope**: - repo: https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelope - release: https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelope/releases/tag/v0.1.0 This is **not** intended as a replacement for A2A. The narrow question I am trying to isolate is: > when an external agent wants to perform a risky write against a remote system, what portable artifacts should the relying party verify before allowing the action? The current `v0.1` wedge is verifier-centered and focuses on `AL2` external di This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Feat]: Telemetry to collect anonymous A2A usage across all SDK ### Is your feature request related to a problem? Please describe. It is nearly impossible to measure adoption of A2A. Github stars and SDK downloads are the only metrics we have. **Ideal metrics:** - Monthly Active Agents using A2A (have had any iteractions) - Monthly sum of A2A tasks Metric dimensions (MECE): - Breakdown by A2A task terminal status - Breakdown by client/server - Breakdown by SDK language and version number - Breakdown by data binding or transport Optional Metric dimensions (MECE): - Breakdown by company names (domains) - Breakdown by agent card attributes ### Descri This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: HTTP domain authentication fails signature verification with matching Ed25519 key I am trying to publish a remote MCP server using HTTP domain authentication. Environment: - Windows 10 - mcp-publisher 1.8.1 - OpenSSL 4.0.2 - Domain: bodywise.io - Server name: io.bodywise/public - Authentication method: HTTP domain verification The public proof is served successfully at: https://bodywise.io/.well-known/mcp-registry-auth With Ed25519: - The private key passed to mcp-publisher is exactly 64 hex characters. - mcp-publisher prints an "Expected proof record". - That expected proof record exactly matches the proof record being served by bodywise.io. - The keypair was independ This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Where should verifier-side trust / permit / receipt artifacts for risky external actions live relative to A2A? I recently published an early discussion draft called **Verifiable Agent Trust Envelope**: - repo: https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelope - release: https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelope/releases/tag/v0.1.0 This is **not** intended as a replacement for A2A. The narrow question I am trying to isolate is: > when an external agent wants to perform a risky write against a remote system, what portable artifacts should the relying party verify before allowing the action? The current `v0.1` wedge is verifier-centered and focuses on `AL2` external di This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: feat: search should also match against server description field ## Problem The `?search=` parameter on `/v0/servers` only matches against `server_name` (via ILIKE substring match). It does **not** search the `description` field. This was explicitly requested in #135 (now closed) but only the name-search portion was implemented. ## Impact AI agents and users searching for servers by what they **do** (e.g., "weather", "database", "GitHub integration") cannot find relevant servers unless they already know the exact server name. The description field — which contains the most useful discovery information — is completely ignored by search. ## Current behav This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Bug]: Links / Check PR links (pull_request) fails ### What happened? Links / Check PR links (pull_request) fails in #2278 and other PRs ### Relevant log output ```shell ``` ### Code of Conduct - [x] I agree to follow this project's Code of Conduct This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Bug]: §8.4.1 canonicalization is under-determined - two SDKs produce different bytes for the same card, and neither reproduces the section's own worked example **What happened?** Section 8.4.1 requires Agent Cards to be canonicalized per RFC 8785 before signing. Two first-party SDKs implement this and they produce different bytes for the same card, so a signed card that verifies under one is rejected by the other. A third implementation, written from the section text rather than from either SDK, would produce a third answer, because the section's summary of RFC 8785 does not match RFC 8785 and its field-presence rule cannot be satisfied by the serializer ADR-001 makes normative. I am filing this against the specification rather than against either S This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: docs: introduce the A2A CLI on the docs site The A2A CLI (`a2a`, https://github.com/a2aproject/a2a-cli) is the official command-line client for A2A agents but isn't mentioned anywhere on the docs site. Add: - A home page entry pointing at it. - A short blog post introducing it: the gap it fills, install options, and a hands-on `--exec` walkthrough that turns a plain script into a demo A2A server. Will open a PR against this issue. This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Bug]: §8.4.1 canonicalization is under-determined - two SDKs produce different bytes for the same card, and neither reproduces the section's own worked example **What happened?** Section 8.4.1 requires Agent Cards to be canonicalized per RFC 8785 before signing. Two first-party SDKs implement this and they produce different bytes for the same card, so a signed card that verifies under one is rejected by the other. A third implementation, written from the section text rather than from either SDK, would produce a third answer, because the section's summary of RFC 8785 does not match RFC 8785 and its field-presence rule cannot be satisfied by the serializer ADR-001 makes normative. I am filing this against the specification rather than against either S This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Idea: link each server to its observed tool-change history The registry is a metadata catalog and leaves enrichment to sub-registries and clients. I maintain heldfast (Apache-2.0), which reads every server in the official registry (about 9,700 npm packages and 19,700 hosted endpoints), keeps each tool definition it was shown, grades each change, and seals each day. First-week report: https://github.com/rufat325/heldfast/blob/v0.2.3/docs/FIRST-WEEK.md Two thirds of the registry is hosted, so there is no package to scan, and what those servers tell agents can change without a release. Idea: a sub-registry or client links each server to its observed cha This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Feat]: Add /.well-known/agent-card-list.json for providers serving multiple agents - [x] As required by the [Code of Conduct](https://github.com/a2aproject/A2A/blob/main/CODE_OF_CONDUCT.md), the description, docs, and comments (words meant for humans) are written by a human, not by an LLM. # Add `/.well-known/agent-card-list.json` for providers serving multiple agents ## Problem An `AgentCard` describes **one** agent. A single `/.well-known/agent-card.json` resource therefore cannot represent a provider that operates several distinct agents, and the protocol currently offers no alternative location for enumerating them. This gap hurts along two independent axes. ### 1. This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Listing intent: agent-commerce unlock packs (Shieldz Base USDC) + llms.txt Alliance Desk (`foundry.desk@agentmail.to`). Looking for the correct publisher path to make agent-buyer digital unlocks discoverable. We publish: - llms.txt: https://literally-blogs-roulette-sally.trycloudflare.com/llms.txt - catalog.llm.json: https://literally-blogs-roulette-sally.trycloudflare.com/storefront/catalog.llm.json - Tip shop: https://literally-blogs-roulette-sally.trycloudflare.com/storefront/?v=convert1f - MILE unlock: https://shieldz.cash/unlock/-EpY0ZxQQ75Mrpbnfoqu ($7.99 USDC Base) - A2A unlock: https://shieldz.cash/unlock/D3tYLH_fX_ZG0IvRbb6z ($29) Honesty: LIVE · UNVERIFIE This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Release orphaned io.github.Bahamas1717/aibvf-mcp after GitHub account rename Please mark all versions of `io.github.Bahamas1717/aibvf-mcp` as `deleted`, with the status message `Moved to io.github.Craig-Horton/aibvf-mcp`, and release its reservation of `https://mcp.aibvf.com/api/mcp`. If a supported ownership migration is preferable, please transfer the old namespace authority to the current publisher. The GitHub account now uses Craig-Horton. The current package listing is `io.github.Craig-Horton/aibvf-mcp` version 0.14.14, while the old listing still reports version 0.12.0 and reserves the working hosted endpoint. ### Ownership evidence - Current source: https://g This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Link Checker Report # Summary | Status | Count | |----------------|-------| | 🔍 Total | 28951 | | ✅ Successful | 28664 | | ⏳ Timeouts | 0 | | 🔀 Redirected | 55 | | 👻 Excluded | 195 | | ❓ Unknown | 0 | | 🚫 Errors | 37 | | ⛔ Unsupported | 0 | ## Errors per input ### Errors in site/blog/2026/03/12/a2a-protocol-ships-v10-production-ready-standard-for-agent-to-agent-communication/index.html * [ERROR] <error:> | Error building URL for "/llms.txt" (Attribute: Some("href")): Cannot convert path '/llms.txt' to a URI: To resolve root-relative links in local files, This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Feat]: SDK in OCaml SDK in OCaml is under development in my repo. https://github.com/GildedHonour/a2a Will you guys refer to it? This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: docs: add MusedIn to the partners list ### What Add MusedIn to `docs/partners.md`. ### Who [MusedIn](https://musedin.com) is a job network for AI agents: agents keep a profile, apply to roles and job posts, get hired, and post their work to a public feed. Agent documentation: https://musedin.com/muse.txt ### A2A surface today - Agent card (A2A 0.3.0, JSONRPC transport): https://musedin.com/.well-known/agent-card.json (also at `/.well-known/agent.json`) - A2A endpoint: `POST https://musedin.com/a2a`, JSON-RPC 2.0. `message/send` returns a completed task for three skills: `find_jobs`, `find_people`, `join_musedin`; `tasks/get` r This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Search bar pushed far below the fold by Recently Updated section **Describe the bug** The “Recently Updated” section appears above the search bar and can contain a large number of server cards. This pushes the search bar far down the page, making it difficult to find and requiring substantial scrolling before users can search the registry. **To Reproduce** 1. Open https://registry.modelcontextprotocol.io/. 2. Wait for the server listings to load. 3. When the “Recently Updated” section contains many entries, observe that it occupies several screenfuls above the search bar. 4. Scroll past those entries to reach the search bar. **Expected behavior** The sear This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Where should verifier-side trust / permit / receipt artifacts for risky external actions live relative to A2A? ## Issue author’s update — 5 October 2026 The question remains where verifier-side admission and receipt semantics should live relative to A2A. VATE is a discussion-draft contract for the relying party’s `allow / attenuate / deny` decision, explicit request narrowing, and linked post-execution evidence. The current versioned review anchor is [v0.4.1](https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelope/releases/tag/v0.4.1); the runnable example below was published later. ### Working direction The [VATE A2A profile draft](https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelop This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: docs: add ADEXTO to the partners list ### What Add ADEXTO to `docs/partners.md`. ### Who [ADEXTO](https://adexto.xyz/agents) runs bonding-curve token markets on Monad, Arbitrum One, Base, Robinhood Chain and 0G, and lets agents launch and buy them over A2A. ### A2A surface today - Agent card: https://adexto.xyz/.well-known/agent-card.json - JSON-RPC endpoint `https://adexto.xyz/api/a2a`, protocol versions 1.0 and 0.3 - Skills: `launch_market`, `buy_token`, `list_markets`, `get_market` - `buy_token` uses the a2a-x402 extension (v0.2, Standalone Flow): USDC on Base via an EIP-3009 authorization signed by the buyer PR: #2303 This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: editorial: §14.2.1 and §14.2.2 cite §3.2.5, which mentions neither header The IANA registration entries for both A2A headers name a section that does not mention them. §14.2.1 and §14.2.2 (`docs/specification.md`, lines 3294 and 3315 at tag `v1.0.1`) both say: > **Specification document:** Section 3.2.5 of the A2A Protocol Specification §3.2.5 is **Metadata** — "A flexible key-value map for passing additional context or parameters with operations" — and mentions neither header. §14.2 is the text an implementer reaches from the IANA registry rather than from the table of contents, so the pointer is where a wrong number costs most. Both headers are declared one su This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Feat]: Add message sender attribution to Message and Task timeline ## Is your feature request related to a problem? Please describe. `Message.role` only distinguishes `user` vs `agent` — there is no sender identity on a message. This creates three concrete gaps: 1. **Task timeline / history**: An observer calling `GetTask` cannot tell *which* human or system sent each `user` message. All user turns look identical. 2. **Multi-sender tasks**: Nothing in the protocol prevents two users from sending to the same non-terminal task via `SendMessage` (using a known `taskId`/`contextId`). The agent receives these messages with no way to distinguish who sent what — This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Search bar pushed far below the fold by Recently Updated section **Describe the bug** The “Recently Updated” section appears above the search bar and can contain a large number of server cards. This pushes the search bar far down the page, making it difficult to find and requiring substantial scrolling before users can search the registry. **To Reproduce** 1. Open https://registry.modelcontextprotocol.io/. 2. Wait for the server listings to load. 3. When the “Recently Updated” section contains many entries, observe that it occupies several screenfuls above the search bar. 4. Scroll past those entries to reach the search bar. **Expected behavior** The sear This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Proposal: Cost and budget propagation extension for multi-agent delegation ## Abstract An extension for propagating budget constraints from caller to callee and reporting incurred cost back up the chain. Aligns with OTel GenAI semantic conventions so A2A metadata maps directly to span attributes without translation. ## Problem I've been working on cost observability in OTel GenAI and kept running into the same wall. You can observe what a single operation costs, but the moment you cross a delegation boundary in A2A, that information vanishes. The caller sends work downstream and has no idea what it cost until (maybe) someone checks a billing dashboard days later. This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: DNS/HTTP auth: cluster resolver returns NXDOMAIN for a valid domain (daboons.net) Trying to republish an existing server under a DNS-verified namespace (`net.dabloons/dabloons`). Both `login dns` and `login http` fail because the registry's resolver insists the domain does not exist: ``` failed to fetch keys: failed to lookup DNS TXT records: lookup daboons.net on 34.118.224.10:53: no such host failed to fetch key: Get "https://daboons.net/.well-known/mcp-registry-auth": lookup daboons.net on 34.118.224.10:53: no such host ``` What I checked from outside: - The apex TXT record (`v=MCPv1; k=ed25519; p=...`) and A records resolve fine via Cloudflare, Google, and Quad9 DoH. This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Request: hard removal of accidentally published version (private repository URL leaked) Hi, we accidentally published a server.json version containing the repository.url of our private GitHub repository: - Server: com.mocoapp.api/mcp - Version: 1.0.0 (status: deleted/flagged) - Leaked field: "repository": { "url": "https://github.com/everii-Group/mocoapp", ... } The repository is private, but we'd prefer the org/repo name not to be exposed in the public registry at all. We've already re-published a clean version (1.0.1) and set 1.0.0 to deleted via the publisher CLI — could you hard-delete version 1.0.0 from the registry database? Thanks! (Happy to verify domain ownership for This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Bug]: §8.4.1 canonicalization is under-determined - two SDKs produce different bytes for the same card, and neither reproduces the section's own worked example **What happened?** Section 8.4.1 requires Agent Cards to be canonicalized per RFC 8785 before signing. Two first-party SDKs implement this and they produce different bytes for the same card, so a signed card that verifies under one is rejected by the other. A third implementation, written from the section text rather than from either SDK, would produce a third answer, because the section's summary of RFC 8785 does not match RFC 8785 and its field-presence rule cannot be satisfied by the serializer ADR-001 makes normative. I am filing this against the specification rather than against either S This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Extension proposal: Autonomy Envelope + liveness-gated authority (bounded delegation that suspends when an agent goes dark) Following the extension governance process, this is a Proposal Phase issue: an abstract, the motivation, and an initial technical approach. I am gauging whether maintainers see this as in scope before doing more work in this direction. ### Abstract An A2A extension that lets an agent present, and a counterparty verify, two things the protocol does not carry today: 1. **An Autonomy Envelope**: a principal-signed, attenuable statement of what the agent may do *unsupervised*: permitted actions, resource patterns, a per-transaction cap and a windowed cumulative budget in a declared unit, allowe This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Millet cleaning **Describe the bug** A clear and concise description of what the bug is. **To Reproduce** Steps to reproduce the behavior: 1. **Expected behavior** A clear and concise description of what you expected to happen. **Logs** If applicable, add logs to help explain your problem. **Additional context** Add any other context about the problem here. This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Proposal: Cost and budget propagation extension for multi-agent delegation ## Abstract An extension for propagating budget constraints from caller to callee and reporting incurred cost back up the chain. Aligns with OTel GenAI semantic conventions so A2A metadata maps directly to span attributes without translation. ## Problem I've been working on cost observability in OTel GenAI and kept running into the same wall. You can observe what a single operation costs, but the moment you cross a delegation boundary in A2A, that information vanishes. The caller sends work downstream and has no idea what it cost until (maybe) someone checks a billing dashboard days later. This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Listing intent: agent-commerce unlock packs (Shieldz Base USDC) + llms.txt Alliance Desk (`foundry.desk@agentmail.to`). Looking for the correct publisher path to make agent-buyer digital unlocks discoverable. We publish: - llms.txt: https://literally-blogs-roulette-sally.trycloudflare.com/llms.txt - catalog.llm.json: https://literally-blogs-roulette-sally.trycloudflare.com/storefront/catalog.llm.json - Tip shop: https://literally-blogs-roulette-sally.trycloudflare.com/storefront/?v=convert1f - MILE unlock: https://shieldz.cash/unlock/-EpY0ZxQQ75Mrpbnfoqu ($7.99 USDC Base) - A2A unlock: https://shieldz.cash/unlock/D3tYLH_fX_ZG0IvRbb6z ($29) Honesty: LIVE · UNVERIFIE This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Bug]: §8.4.1 canonicalization is under-determined - two SDKs produce different bytes for the same card, and neither reproduces the section's own worked example **What happened?** Section 8.4.1 requires Agent Cards to be canonicalized per RFC 8785 before signing. Two first-party SDKs implement this and they produce different bytes for the same card, so a signed card that verifies under one is rejected by the other. A third implementation, written from the section text rather than from either SDK, would produce a third answer, because the section's summary of RFC 8785 does not match RFC 8785 and its field-presence rule cannot be satisfied by the serializer ADR-001 makes normative. I am filing this against the specification rather than against either S This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Request: hard removal of accidentally published version (private repository URL leaked) Hi, we accidentally published a server.json version containing the repository.url of our private GitHub repository: - Server: com.mocoapp.api/mcp - Version: 1.0.0 (status: deleted/flagged) - Leaked field: "repository": { "url": "https://github.com/everii-Group/mocoapp", ... } The repository is private, but we'd prefer the org/repo name not to be exposed in the public registry at all. We've already re-published a clean version (1.0.1) and set 1.0.0 to deleted via the publisher CLI — could you hard-delete version 1.0.0 from the registry database? Thanks! (Happy to verify domain ownership for This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: AgentCard signing example cannot be verified as published Section 8.4 publishes a canonicalization example, a JOSE protected header and an ES256 signature. I checked the canonicalization example independently against the proto presence rules and that part reproduces. The signature example is not independently checkable, though. There is no verification key published with it, and the `jku` points to `example.com`. It also does not say which payload the signature covers. The canonical form in 8.4.1 is for a small fragment, and 8.4.2 only says "given a canonical Agent Card payload". That means an implementation can test canonicalization, but cannot ve This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Measurement: 8.6% of listed entries with a remote endpoint answer HTTP but not MCP Hello — this is a measurement report, not a bug report or a feature request. I have been probing the registry nightly and thought the numbers might be useful. No action requested. ## Method Every night at 03:00 UTC I fetch the full registry, then send a plain JSON-RPC `initialize` to every entry that declares a `remotes[]` endpoint, followed by `tools/list`. Failures are recorded with a reason, so "refused us" is never conflated with "is not there". Both streamable-http and legacy SSE are attempted, and three protocol versions are tried before an entry is written off. ## Results, 2026-09-07 This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Proposal] New experimental repository: experimental-cpb-websocket # WebSocket Custom Protocol Binding for A2A - Proposal ## Abstract This proposal requests the creation of an `experimental-cpb-websocket` repository under the `a2aproject` GitHub organization to host the **WebSocket** custom protocol binding for A2A. The binding carries the **existing** A2A method inventory - the same operations, request/response shapes, and server-streaming semantics defined by the core specification and used by the JSON-RPC binding - over a single, long-lived [WebSocket](https://datatracker.ietf.org/doc/html/rfc6455) connection. It is layered: - **Transport:** WebSocket This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: GitHub auth: org namespace permission not granted despite public membership + OAuth restrictions removed ## Summary GitHub device-flow login consistently grants only the personal namespace (`io.github.<user>/*`) and never the organization namespace (`io.github.<org>/*`), even after satisfying the documented requirements. ## Environment - mcp-publisher: latest release binary (Windows amd64, downloaded 2026-08-19) - Auth: `mcp-publisher login github` (device flow) - User: `yusufcemres` — **owner** of org `sololabstr` - Target name: `io.github.sololabstr/uisight` ## Steps taken (in order, re-logging-in after each change) 1. Initial publish → 403: *"You have permission to publish: io.github.yusu This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Proposal: Cost and budget propagation extension for multi-agent delegation ## Abstract An extension for propagating budget constraints from caller to callee and reporting incurred cost back up the chain. Aligns with OTel GenAI semantic conventions so A2A metadata maps directly to span attributes without translation. ## Problem I've been working on cost observability in OTel GenAI and kept running into the same wall. You can observe what a single operation costs, but the moment you cross a delegation boundary in A2A, that information vanishes. The caller sends work downstream and has no idea what it cost until (maybe) someone checks a billing dashboard days later. This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Proposal: Cryptographic Agent Identity extension (CTEF v0.3.1-aligned) ## Abstract Proposal for an A2A extension carrying cryptographic agent identity claims aligned with the CTEF v0.3.1 substrate (live at [`/.well-known/cte-test-vectors.json`](https://agentgraph.co/.well-known/cte-test-vectors.json), commit `agentgraph-co/agentgraph@69ad94d`). Claims declare a `claim_type` discriminator over the closed set `{identity, transport, authority, continuity}` (reserved: `envelope`), with per-layer composition rules and structural-before-semantic error codes (`INVALID_CLAIM_SCOPE`, `INVALID_COMPOSITION`). ## Motivation A2A's existing `AgentCardSignature` (Section 4.4 This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Moderation: ~2,365 near-identical servers registered under `io.github.sadri-dridi/*` Hi, I maintain SniffMCP (https://github.com/SomehowLiving/sniffmcp), an open-source scanner that crawls the registry daily. Flagging a pattern that seems to match the moderation policy's spam examples ("the same server being submitted multiple times under different names"). **What we observed (2026-10-09 → 10-11):** - **2,365** latest entries under `io.github.sadri-dridi/*` (e.g. `aba-ok`, `abnf-ok`, `abs-ok`), all pointing at one remote host: `agent-observatory-sensor.nolimit-observatory.workers.dev/s/<name>/mcp`. - Of 302 we probed (list calls only), every one exposes the **same generic t This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Proposal: Cost and budget propagation extension for multi-agent delegation ## Abstract An extension for propagating budget constraints from caller to callee and reporting incurred cost back up the chain. Aligns with OTel GenAI semantic conventions so A2A metadata maps directly to span attributes without translation. ## Problem I've been working on cost observability in OTel GenAI and kept running into the same wall. You can observe what a single operation costs, but the moment you cross a delegation boundary in A2A, that information vanishes. The caller sends work downstream and has no idea what it cost until (maybe) someone checks a billing dashboard days later. This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Add Google Artifact Registry as docker registry **Is your feature request related to a problem? Please describe.** Our server is deployed in GAR. As of now, it seems like MCP registry only supports the official Docker registry. **Describe the solution you'd like** Supporting GAR. ``` "registry_type": "oci", "registry_base_url": "https://artifactregistry.googleapis.com", "identifier": "<region>-docker.pkg.dev/<repo>/...", "version": "1.0.0", "file_sha256": "filesha256", "tag": "latest", // it will be great to support tag as well. ``` **Describe alternatives you've considered** N/A **Additional context* This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Bug]: 8.4.1 canonicalization example is not a valid Agent Card and is unreproducible ### What happened? The example in _SPEC 8.4.1_ ("Example of Default Value Removal") uses an Agent Card that is **not valid** under the spec, and whose shown canonical output cannot be reproduced: - The input card has `"skills": []`, but skills is a REQUIRED array and _SPEC 5.7_ says _"Arrays marked as required MUST contain at least one element."_ So the example card is invalid. - Furthermore, it introduces empty `description:""`; It basically means that it wasn't provided, even though it is required field. - The input also omits other REQUIRED fields (`supportedInterfaces`, `version`, `defa This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: login dns/http: accept the private key from an environment variable or a file, not only --private-key `mcp-publisher login dns` and `login http` take the in-process signing key only as `--private-key <hex>`. In CI that puts the raw key in the process's arguments for as long as the login runs, where other processes on the host can read it (`ps`, `/proc/<pid>/cmdline`). GitHub Actions masks the secret in the log, but not in argv. What we checked, at `v1.8.1`: - `cmd/publisher/commands/login.go:128` registers `private-key` as a plain string flag, and `NewInProcessSigner` (`cmd/publisher/auth/common.go:49`) gets that string. - We found no `os.Getenv`, `LookupEnv`, file read or stdin read for the This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Feat]: Actor-chain extension: a standard payload shape for on-behalf-of delegation ## Is your feature request related to a problem? A2A v1.0 carries no principal in the payload. Authentication is out-of-band (`SecurityScheme` declarations plus transport mechanisms), and neither `Message`, `Task`, nor the agent card has a field for the human or upstream agent a request is made on behalf of. `tenant` is routing-only, and `metadata` is untyped, so every implementation that needs delegation context invents a private schema there. The gap shows up as soon as agents delegate to agents. If agent C receives work from agent B, which received it from agent A acting for user U, C see This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Where should verifier-side trust / permit / receipt artifacts for risky external actions live relative to A2A? ## Issue author’s update — 5 October 2026 The question remains where verifier-side admission and receipt semantics should live relative to A2A. VATE is a discussion-draft contract for the relying party’s `allow / attenuate / deny` decision, explicit request narrowing, and linked post-execution evidence. The current versioned review anchor is [v0.4.1](https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelope/releases/tag/v0.4.1); the runnable example below was published later. ### Working direction The [VATE A2A profile draft](https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelop This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Add a dark-mode toggle for comfortable nighttime reading Hi! Could you add a light/dark theme toggle to llmstxt.org? The site has plenty of useful material to read, but the bright background is uncomfortable at night, especially with low screen brightness and macOS Night Shift enabled. A warm dark theme would make longer reading sessions much more pleasant. As a quick experiment, I asked an AI to create a tiny local Chrome extension for this. The result is a CSS-only theme with: - Warm charcoal backgrounds and soft off-white text. - Muted sand-colored links and readable navigation icons. - Dark code blocks with distinct syntax-highlighting colors This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Feat]: Actor-chain extension: a standard payload shape for on-behalf-of delegation ## Is your feature request related to a problem? A2A v1.0 carries no principal in the payload. Authentication is out-of-band (`SecurityScheme` declarations plus transport mechanisms), and neither `Message`, `Task`, nor the agent card has a field for the human or upstream agent a request is made on behalf of. `tenant` is routing-only, and `metadata` is untyped, so every implementation that needs delegation context invents a private schema there. The gap shows up as soon as agents delegate to agents. If agent C receives work from agent B, which received it from agent A acting for user U, C see This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Feature request: surface target changes between server versions (listing swaps) **Problem.** A user approves an MCP server by its registry name, but a client installs whatever that name resolves to today. Nothing tells the user when the *target* behind the name changes: a new remote domain, or a package now published by a different owner. **Data.** We compared the current version of every server in the official registry with the first version published under the same name (10 Oct 2026 dump: 142,002 versions of 41,351 servers). 1,075 servers now reach a different remote domain or package owner than their first version; 698 of those kept the same title and description. Mos This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: [Feat]: Optional context-binding profile for delegated authority ## TL;DR Should A2A define an optional profile for binding delegated authority to a specific A2A context? A valid grant can still be replayed or relayed into the wrong A2A task, session, or target. This would sit above existing A2A authentication. It is not a new authentication mechanism. Related: #153 discusses the confused-deputy problem. This issue focuses on binding valid delegation to a live A2A context. ## Problem Delegated agent flows often need one extra check: Is this delegation valid for this acting agent, this A2A context, this target, this scope, and this validity period? P This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?

Source reference: Add a dark-mode toggle for comfortable nighttime reading Hi! Could you add a light/dark theme toggle to llmstxt.org? The site has plenty of useful material to read, but the bright background is uncomfortable at night, especially with low screen brightness and macOS Night Shift enabled. A warm dark theme would make longer reading sessions much more pleasant. As a quick experiment, I asked an AI to create a tiny local Chrome extension for this. The result is a CSS-only theme with: - Warm charcoal backgrounds and soft off-white text. - Muted sand-colored links and readable navigation icons. - Dark code blocks with distinct syntax-highlighting colors This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?