Compare public interface declarations with concrete implementation experience. Imported references are leads, not endorsements or proof of runtime behavior.
Source reference: [Feat]: Actor-chain extension: a standard payload shape for on-behalf-of delegation
## Is your feature request related to a problem?
A2A v1.0 carries no principal in the payload. Authentication is out-of-band (`SecurityScheme` declarations plus transport mechanisms), and neither `Message`, `Task`, nor the agent card has a field for the human or upstream agent a request is made on behalf of. `tenant` is routing-only, and `metadata` is untyped, so every implementation that needs delegation context invents a private schema there.
The gap shows up as soon as agents delegate to agents. If agent C receives work from agent B, which received it from agent A acting for user U, C see
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: PyPI ownership validation broken - marker visible but validator rejects it
Package: braxis 3.0.4
Marker on PyPI: ✓ https://pypi.org/project/braxis/3.0.4/ (first line)
Format: mcp-name: io.github.jaykrishna316/braxis
Server name: io.github.jaykrishna316/braxis
Status: REJECTED despite marker being visible and in correct format
The validator keeps returning: "The server name must appear as 'mcp-name: io.github.jaykrishna316/braxis' in the package README"
But it IS there - verified on PyPI public page.
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Use case: llms.txt on local network devices (IoT, routers, appliances)
Local devices (routers, printers, smart plugs, NAS) already run a web server but are opaque to agents. Serving `/llms.txt` on the device itself, describing what it is and how to use its HTTP API, lets an agent on the same LAN operate it with no cloud, app or SDK.
What a device profile would need, all optional and plain Markdown:
- **Discovery:** an HTML comment + `<link rel="describedby" href="/llms.txt">` on `/` (see #93), since agents land on a bare IP, not a known domain.
- **Actions:** method, path and params per action, inline or via `## Skills` (#116).
- **Authentication:** state wheth
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: PyPI ownership validation broken - marker visible but validator rejects it
Package: braxis 3.0.4
Marker on PyPI: ✓ https://pypi.org/project/braxis/3.0.4/ (first line)
Format: mcp-name: io.github.jaykrishna316/braxis
Server name: io.github.jaykrishna316/braxis
Status: REJECTED despite marker being visible and in correct format
The validator keeps returning: "The server name must appear as 'mcp-name: io.github.jaykrishna316/braxis' in the package README"
But it IS there - verified on PyPI public page.
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Add a dark-mode toggle for comfortable nighttime reading
Hi! Could you add a light/dark theme toggle to llmstxt.org?
The site has plenty of useful material to read, but the bright background is uncomfortable at night, especially with low screen brightness and macOS Night Shift enabled. A warm dark theme would make longer reading sessions much more pleasant.
As a quick experiment, I asked an AI to create a tiny local Chrome extension for this. The result is a CSS-only theme with:
- Warm charcoal backgrounds and soft off-white text.
- Muted sand-colored links and readable navigation icons.
- Dark code blocks with distinct syntax-highlighting colors
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: [Feat]: ACTS coverage for AUTH_REQUIRED retrieval on a fresh connection
### Is your feature request related to a problem? Please describe.
## Problem
In the ACTS corpus on `conformance-spec-adjustments`, `SEC-AUTH-005` checks entry into `TASK_STATE_AUTH_REQUIRED`, but does not retrieve that pending task through `GetTask` on an independent connection.
The format currently has no unary-step field requiring an independent client connection/pool. Repeating the operation through the same dispatcher cannot establish connection isolation.
This is a test-coverage and runner-format proposal; no failing production SDK implementation is claimed.
## Proposed solution
Ad
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Extension proposal: DANE-anchored identity for Agent Cards (DNSSEC TLSA binding for the signing key)
## Abstract
This proposes an A2A extension that lets an Agent Card prove its signing key belongs to the agent's domain by anchoring that key in DNS, as a DNSSEC-signed DANE-EE TLSA record. Verification runs from the DNS root, with no central identity issuer and no prior key exchange. The agent keeps its own self-sovereign key. DANE only answers the question the current design leaves open: does this key provably belong to this domain.
I run [Whisper Security](https://whisper.online) and operate [AS219419](https://as219419.net), and we have this deployed in production DNS today. There is a liv
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Provenance audit: 38/398 top-graded servers' repository URLs point at renamed or transferred repos
### Audit: 38 of 398 top-graded registry entries point at renamed/moved GitHub repos
[MCP Queen](https://mcpqueen.com) continuously probes and grades every remote server in the official registry. As part of a provenance audit (2026-07-28) we checked the `repository.url` of the 398 highest-graded remote servers against GitHub.
**Result: 0 hard 404s, but 38 entries (9.5%) reference repos that have been renamed or transferred.** GitHub's REST API follows the redirect, but GraphQL consumers resolve these as nonexistent (`Could not resolve to a Repository`), so any tooling built on GraphQL — and
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Extension proposal: Autonomy Envelope + liveness-gated authority (bounded delegation that suspends when an agent goes dark)
Following the extension governance process, this is a Proposal Phase issue: an abstract, the motivation, and an initial technical approach. I am gauging whether maintainers see this as in scope before doing more work in this direction.
### Abstract
An A2A extension that lets an agent present, and a counterparty verify, two things the protocol does not carry today:
1. **An Autonomy Envelope**: a principal-signed, attenuable statement of what the agent may do *unsupervised*: permitted actions, resource patterns, a per-transaction cap and a windowed cumulative budget in a declared unit, allowe
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: please follow RFC 5785
RFC 5785 registered the /.well-known/ space for information such as this and provides an IANA registry to prevent collisions with other well known data.
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: §3.1.5: should CancelTask on an already-canceled task return the task or TaskNotCancelableError? SDKs disagree
## Summary
SDKs disagree on what `CancelTask` returns for a task that is **already canceled**, and the specification and most SDKs say different things.
**Specification:** section 3.1.5 lists `TaskNotCancelableError` for a task that is "not in a cancelable state (e.g., already completed, failed, or canceled)". The error table in 3.3.2 names `TASK_STATE_CANCELED` explicitly.
**SDKs today:**
| SDK | Cancel an already-canceled task |
|---|---|
| a2a-python 1.2.2 | `TaskNotCancelableError` (-32002) |
| a2a-go v2.6.0 | returns the canceled task (`distributedManager.Cancel` short-circuits on `TA
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: [Extension Proposal] CRATB-Auth: Claim Rich Agent Task Bound Authentication
> **What we are proposing:** an A2A **extension**.
> **Governance:** [Extension & Binding Governance, Proposal Phase](https://a2a-protocol.org/latest/topics/extension-and-binding-governance/#proposal-phase)
> **Requested tier:** Experimental, as `experimental-ext-cratb-auth`
> **Protocol baseline:** A2A v1.0.0
> **License:** Apache 2.0 (all artifacts)
> **Spec draft:** v0.1.4, complete (to be shared with this issue; see §5)
---
## 1. Abstract
Today, a server agent in A2A cannot ask a client agent to **autonomously prove its identity inside the task itself** . Transport security (TLS) prot
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Proposal: Cost and budget propagation extension for multi-agent delegation
## Abstract
An extension for propagating budget constraints from caller to callee and reporting incurred cost back up the chain. Aligns with OTel GenAI semantic conventions so A2A metadata maps directly to span attributes without translation.
## Problem
I've been working on cost observability in OTel GenAI and kept running into the same wall. You can observe what a single operation costs, but the moment you cross a delegation boundary in A2A, that information vanishes. The caller sends work downstream and has no idea what it cost until (maybe) someone checks a billing dashboard days later.
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Deprecate io.github.ProntoHQ/mcp-pronto (GitHub org renamed to Pipecorn)
Our GitHub organization ProntoHQ was renamed to Pipecorn, so nobody can authenticate for the io.github.ProntoHQ namespace anymore (mcp-publisher status returns 403).
Could you mark all versions of io.github.ProntoHQ/mcp-pronto as deprecated with the message: "Moved to com.pipecorn/mcp at https://mcp.pipecorn.com/mcp"?
The server has been republished as com.pipecorn/mcp (same remote URL). We can prove ownership through the Pipecorn GitHub org or the pipecorn.com domain.
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: [Feat]: Introduce normative A2A Client API specification with code generation support
## Is your feature request related to a problem? Please describe.
The A2A specification currently defines a single `A2AService` in `a2a.proto`. This service describes operations that an individual agent *server* exposes. Client libraries are generated directly from that service definition — meaning the "client API" is by definition identical to the server API, constrained to operations that can be modelled as a direct RPC call to a single server, and carrying server-level routing concerns (e.g. `tenant`) that have no meaning in application code.
This conflation creates several problems:
- *
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Feature request: re-check published entries periodically (more than 1 in 8 have a problem the registry doesn't catch)
## Summary
I measured every latest entry in the registry (38,977 entries from 23,016 publisher namespaces, registry snapshot 2026-10-04) against what npm, PyPI and GitHub reported on 2026-10-06. **5,435 entries (13.9%; 3,169 publisher namespaces, 13.8%) have at least one problem the registry doesn't catch** — most commonly a repository link that isn't publicly reachable, or a listed package version that is withdrawn upstream or can't be installed. Part of that count is a design choice rather than a problem (see the `websiteUrl` note below); setting that part aside, the figure is still at leas
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: [Extension Proposal] Sanction Gate — bounded human authorisation for irreversible actions
## Abstract
We propose an A2A extension that adds **bounded human authorisation** to task
execution. It lets an agent classify a requested action by its reversibility,
require a recorded sanction from one or more named human stewards before the
action takes effect, and emit a tamper-evident receipt of every gate crossing —
admissions and refusals alike.
It is a profile extension with a state-machine component. It adds no RPC
methods, defines no new task states, and modifies no core data structure. All
extension data lives in `metadata` maps on existing objects and in `DataPart`
payloads, per
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Measured llms.txt adoption twice, six weeks apart. One failure mode the spec may want to address.
I fetched every llms.txt listed in the public directories in August, 1,563 files, and re-ran the identical crawl today. Data and code are open: https://doi.org/10.5281/zenodo.22859104
The part I think is relevant here: 60 of those URLs now return an HTML page rather than text, up from 32 six weeks ago. They respond 200 and look fine to a status check, but an agent fetching them gets markup. That's roughly double in six weeks, and it's the failure mode most likely to be invisible to whoever published the file.
Separately, 30 sites return 403 to a research crawler that identifies itself, for a
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Dual-namespace ownership: a package published under both io.github.* and a verified domain has no way to be recognized as one publisher
## The case
`rust-faf-mcp` resolves under two ownership namespaces for the same underlying package, and they have drifted out of sync as a direct result:
- `one.faf/rust-faf-mcp` → **v0.4.2** (current, matches crates.io's `newest_version`)
- `io.github.Wolfe-Jam/rust-faf-mcp` → **v0.3.1** (stale, several releases behind)
Publishing either namespace requires a token scoped to that specific namespace; there is no way to hold both simultaneously, and no path to link the two identities as the same publisher. In practice that friction is enough that the `io.github.*` entry simply stopped being r
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: [Extension Proposal] CRATB-Auth: Claim Rich Agent Task Bound Authentication
> **What we are proposing:** an A2A **extension**.
> **Governance:** [Extension & Binding Governance, Proposal Phase](https://a2a-protocol.org/latest/topics/extension-and-binding-governance/#proposal-phase)
> **Requested tier:** Experimental, as `experimental-ext-cratb-auth`
> **Protocol baseline:** A2A v1.0.0
> **License:** Apache 2.0 (all artifacts)
> **Spec draft:** v0.1.4, complete (to be shared with this issue; see §5)
---
## 1. Abstract
Today, a server agent in A2A cannot ask a client agent to **autonomously prove its identity inside the task itself** . Transport security (TLS) prot
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Proposal: optional security scan metadata field for registered MCP servers
This issue proposes adding optional security scan metadata to MCP server registry entries, so that users browsing the registry can see whether a given MCP server has been scanned by community detection tools and what the result was. The proposal is intentionally narrow and is meant to start a conversation, not lock in a design.
Background. Static security scanning of MCP server packages and skill bundles is becoming a common practice. The Agent Threat Rules project is an open detection standard for AI agent threats published under the MIT license at https://github.com/Agent-Threat-Rule/agent-
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Free remote URL https://api.wsystem.dev/mcp/ held by io.github.zifengw/eu-business-data-mcp (repo moved to org)
Our repo moved from github.com/zifengw to the W System organization: https://github.com/wsystemdev/eu-business-data-mcp (same owner; zifengw is the org owner).
GitHub OIDC now only allows publishing `io.github.wsystemdev/*`, and publishing `io.github.wsystemdev/eu-business-data-mcp` (v1.0.3) fails with:
```
remote URL https://api.wsystem.dev/mcp/ is already used by server io.github.zifengw/eu-business-data-mcp
```
Could you remove or transfer the old entry `io.github.zifengw/eu-business-data-mcp` (versions 1.0.0–1.0.2) so the remote URL can be used by the new name? We're happy to deprecate
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Feature request: re-check published entries periodically (more than 1 in 8 have a problem the registry doesn't catch)
## Summary
I measured every latest entry in the registry (38,977 entries from 23,016 publisher namespaces, registry snapshot 2026-10-04) against what npm, PyPI and GitHub reported on 2026-10-06. **5,435 entries (13.9%; 3,169 publisher namespaces, 13.8%) have at least one problem the registry doesn't catch** — most commonly a repository link that isn't publicly reachable, or a listed package version that is withdrawn upstream or can't be installed. Part of that count is a design choice rather than a problem (see the `websiteUrl` note below); setting that part aside, the figure is still at leas
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: [Epic] Multi-turn interaction gaps — state acceptance rules, interruptibility, and task lifecycle
## Multi-turn interaction gaps — state acceptance rules, interruptibility, and task lifecycle
Section 3.4 of the A2A specification defines the foundations of multi-turn interaction: `contextId` and `taskId` semantics, the `INPUT_REQUIRED` pattern, follow-up message references, and context inheritance. However, several practical scenarios are left unspecified. This epic tracks the gaps.
## Gaps
### 1. No normative rules for which states accept a follow-up message
§3.4.3 states that clients *can* send additional messages with a `taskId` reference, but the spec does not define:
- Which task
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Proposal: Cost and budget propagation extension for multi-agent delegation
## Abstract
An extension for propagating budget constraints from caller to callee and reporting incurred cost back up the chain. Aligns with OTel GenAI semantic conventions so A2A metadata maps directly to span attributes without translation.
## Problem
I've been working on cost observability in OTel GenAI and kept running into the same wall. You can observe what a single operation costs, but the moment you cross a delegation boundary in A2A, that information vanishes. The caller sends work downstream and has no idea what it cost until (maybe) someone checks a billing dashboard days later.
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Specify Content-Type header
The draft specification (https://llmstxt.org/) does not mention the `Content-Type` header. Should it be `text/markdown` or `text/plain`?
I do not think the choice matters much, but it will help reduce "bike shedding" if the spec provides a recommendation. Or even if the spec mentions that either one is acceptable.
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Please deprecate io.github.traffiycom-ui/paidsync (orphan record, dead /sse endpoint)
The record `io.github.traffiycom-ui/paidsync` (version 1.0.0, still marked latest) points at `https://mcp.paidsync.ai/sse`, which returns HTTP 404 (SSE transport retired), and describes "200+ tools, 3 platforms".
The GitHub user `traffiycom-ui` was renamed to `PaidSync`, so no login can publish under the old namespace to deprecate it ourselves. Ownership proof: `https://github.com/traffiycom-ui/paidsync-mcp-server` redirects to the PaidSync organization.
The current record is `io.github.PaidSync/paidsync` 2.3.1 (`https://mcp.paidsync.ai/mcp`, streamable-http).
Could a maintainer mark `io.gi
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Data: 52 of 109 latest-version servers do not complete an anonymous MCP handshake, and 33 of those refusals return a body a JSON-RPC client cannot branch on
I measured every server the registry currently serves at `?version=latest`, and I think one field is missing from the listing. Data first, proposal second, provenance and limits last.
**What was run.** One anonymous conformance battery per server: no credential, no tool call. Window 2026-10-14T23:25:09Z - 2026-10-15T01:08:19Z. Source `https://registry.modelcontextprotocol.io/v0.1/servers?version=latest`, 109 records. Per server: `POST initialize` (streamable HTTP, JSON-RPC), a `GET` of the same URL, `tools/list` where initialize succeeded, an unknown-method probe, and capture of the response
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Running implementation of agent identity, delegation, and enforcement — addressing #1497, #1472, #1501
**Status, 2026-09-03.** Added by the author. The February 2026 text below is unchanged.
Two claims in the original body have been re-checked against the current release and are now out of date.
**Version and tests.** The current release is agent-passport-system 5.0.3. At that tag `npm test` reports 4,819 tests: 4,810 passing, 9 skipped, 0 failing.
**Revocation.** The February references to "cascade revocation", including "Revoking a parent cascades to all children instantly", do not describe 5.0.3. The former stateful revocation helpers remain exported for source compatibility but throw whe
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Request to be added to the directories list
Hi Jeremy and the llms.txt team,
Thank you for creating and maintaining the llms.txt proposal.
I maintain [Agent Web Map](https://agentwebmap.com/), and I’d like to ask whether you would consider including it in the [Directories section](https://llmstxt.org/#directories).
Agent Web Map discovers, rechecks and organizes public llms.txt files. People can browse publishers and explore shared file headings through an interactive point cloud, while agents can query the same index through our [free JSON API and MCP server](https://agentwebmap.com/docs). Public discovery requires no account or API
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Publisher request: mark 3 io.github.jfortier93 servers deleted (project shut down, repos removed)
I am the publisher of these three servers under the io.github.jfortier93 namespace:
- io.github.jfortier93/verified-numbers-mcp (v1.0.0)
- io.github.jfortier93/statement-normalizer-mcp (v1.0.1)
- io.github.jfortier93/verified-wages-mcp (v1.0.0)
I have permanently shut this project down. The GitHub repositories backing all three entries are deleted, the marketplace listings are removed, and the hosted endpoints are being torn down with the hosting provider's support. The registry entries now point at deleted repositories and services that are going away.
Since publishers cannot delete their
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Extension proposal: Autonomy Envelope + liveness-gated authority (bounded delegation that suspends when an agent goes dark)
Following the extension governance process, this is a Proposal Phase issue: an abstract, the motivation, and an initial technical approach. I am gauging whether maintainers see this as in scope before doing more work in this direction.
### Abstract
An A2A extension that lets an agent present, and a counterparty verify, two things the protocol does not carry today:
1. **An Autonomy Envelope**: a principal-signed, attenuable statement of what the agent may do *unsupervised*: permitted actions, resource patterns, a per-transaction cap and a windowed cumulative budget in a declared unit, allowe
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Data: 52 of 109 latest-version servers do not complete an anonymous MCP handshake, and 33 of those refusals return a body a JSON-RPC client cannot branch on
I measured every server the registry currently serves at `?version=latest`, and I think one field is missing from the listing. Data first, proposal second, provenance and limits last.
**What was run.** One anonymous conformance battery per server: no credential, no tool call. Window 2026-10-14T23:25:09Z - 2026-10-15T01:08:19Z. Source `https://registry.modelcontextprotocol.io/v0.1/servers?version=latest`, 109 records. Per server: `POST initialize` (streamable HTTP, JSON-RPC), a `GET` of the same URL, `tools/list` where initialize succeeded, an unknown-method probe, and capture of the response
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: docs: add Mestre Prático & NutriPreço to the partners list
### What
Add Mestre Prático & NutriPreço to `docs/partners.md`.
### Who
Mestre Prático (https://mestrepratico.com.br) & NutriPreço (Holding Arthur Luis Vieira dos Santos, CNPJ: 69.423.752/0001-61) is a sovereign Brazilian retail commodities, official fuel price oracle (ANP), and pharmaceutical maximum price index (CMED / ANVISA).
### A2A surface today
- **Agent Card:** https://mestrepratico.com.br/.well-known/agent-card.json (Protobuf / JSON schema compliant, RFC 8615). It declares A2A 1.0 in `supportedInterfaces` and dual Protobuf / snake_case & camelCase field naming.
- **Protocol version:
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: [Epic] Multi-turn interaction gaps — state acceptance rules, interruptibility, and task lifecycle
## Multi-turn interaction gaps — state acceptance rules, interruptibility, and task lifecycle
Section 3.4 of the A2A specification defines the foundations of multi-turn interaction: `contextId` and `taskId` semantics, the `INPUT_REQUIRED` pattern, follow-up message references, and context inheritance. However, several practical scenarios are left unspecified. This epic tracks the gaps.
## Gaps
### 1. No normative rules for which states accept a follow-up message
§3.4.3 states that clients *can* send additional messages with a `taskId` reference, but the spec does not define:
- Which task
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Data: 52 of 109 latest-version servers do not complete an anonymous MCP handshake, and 33 of those refusals return a body a JSON-RPC client cannot branch on
I measured every server the registry currently serves at `?version=latest`, and I think one field is missing from the listing. Data first, proposal second, provenance and limits last.
**What was run.** One anonymous conformance battery per server: no credential, no tool call. Window 2026-10-14T23:25:09Z - 2026-10-15T01:08:19Z. Source `https://registry.modelcontextprotocol.io/v0.1/servers?version=latest`, 109 records. Per server: `POST initialize` (streamable HTTP, JSON-RPC), a `GET` of the same URL, `tools/list` where initialize succeeded, an unknown-method probe, and capture of the response
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: My MCP server io.github.meemoprasad/meeba-brain was successfully published to the Official MCP Registry as version 1.0.1 and is returned by the registry API, but it does not appear
My MCP server io.github.meemoprasad/meeba-brain was successfully published to the Official MCP Registry as version 1.0.1 and is returned by the registry API, but it does not appear in GitHub's MCP discovery search for "meeba" or "meeba brain". Could you please check whether the GitHub MCP discovery index has synced this server?
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Extension Proposal: experimental-ext-settlement — settlement semantics for A2A tasks (seeking maintainer sponsor)
## Abstract
This defines interoperable settlement semantics for economic obligations tied to A2A task states. It does not define a payment rail. x402, AP2, hosted escrow, stablecoins, card rails, or internal ledgers can all move the value.
## Motivation
A2A discovers agents and runs tasks. It does not define when an economic obligation is discharged. Settlement sits above the payment rail and tells it when to move, so x402 or AP2 can be the rail underneath.
Anyone can publish an extension at their own URI. Settlement semantics only interoperate if release, refund, and dispute mean the same
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Proposal: Multi-turn conversation semantics — STATE_INPUT_REQUIRED + context persistence
## Summary
The A2A protocol defines `contextId` as a correlation key for grouping tasks, but it does not specify **multi-turn conversation semantics** — what happens when a client sends multiple `message/send` calls with the same `contextId`.
This proposal defines a convention for multi-turn conversations using two mechanisms already present in the spec:
1. **`STATE_INPUT_REQUIRED`** — a new terminal task state signaling the agent expects a follow-up
2. **History injection** — a non-normative convention for prepending prior conversation context
**Update (7/20):** Incorporated feedback from
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Preventing tool poisoning: save signatures of possible tool calls
One potential benefit of a centralized registry is that we could have `server.json` submitters list out all the possible tools their server may ever invoke, fingerprint them, and store those fingerpoints for MCP client consumption.
A third party vendor could scan and approve these fingerprints as devoid of security risks, like tool poisoning attacks.
MCP clients could then use the fingerprints to avoid tool poisoning attacks that get surfaced due to hidden dynamic tool calls or supply chain attacks.
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Reclaim remote URL https://marketnow.site/api/mcp from deprecated entry; deprecate stale io.github.edgarfloresguerra2011-a11y/marketnow versions
## Summary
We maintain MarketNow (https://marketnow.site) and just published the current server to the registry under our org namespace: **`io.github.alicelabs-llc/marketnow` v1.15.0** (npm `marketnow-mcp` 1.15.0 + remote `streamable-http`).
Three older entries were published from a previous personal GitHub account (`edgarfloresguerra2011-a11y`) that we no longer use:
| Entry | Version | Status | Notes |
|---|---|---|---|
| `io.github.edgarfloresguerra2011-a11y/marketnow-mcp` | 1.0.0 | deprecated (latest) | holds remote `https://marketnow.site/api/mcp` (type `sse`) |
| `io.github.edgarflore
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: HTTP authentication verification fails due to unreachable verification endpoint / missing egress IP documentation
## Describe the bug
HTTP authentication login fails because the MCP Registry cannot fetch the public key verification file from the registered domain.
The domain is correctly configured according to the HTTP authentication flow:
- `/.well-known/mcp-registry-auth` is publicly accessible
- The response format is correct (`v=MCPv1; k=ed25519; p=...`)
- The endpoint returns HTTP 200
- The same endpoint is reachable from multiple networks
However, during the authentication flow, the Registry backend fails to fetch the verification file and returns a timeout error.
This appears to be related to
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Request: delete io.github.Norcalnappy/atlasofplantbased-pct (1 version), orphaned after GitHub rename Norcalnappy -> AtlasDigitalDesign, holding the remote URL
Hi,
My GitHub account was renamed from `Norcalnappy` to `AtlasDigitalDesign` on October 23, 2026. The one server I had published, `io.github.Norcalnappy/atlasofplantbased-pct` (version 1.0.0, published October 14), is now orphaned: GitHub OIDC resolves to `io.github.AtlasDigitalDesign`, so no credential I hold can deprecate or update the old record.
Republishing under the new namespace with the same remote failed on the remote URL rule:
```
Publishing io.github.AtlasDigitalDesign/atlasofplantbased-pct@1.0.1 to https://registry.modelcontextprotocol.io...
Error: publish failed: server returne
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
Source reference: Registry accepts server.json with empty "repository": {} though schema requires url + source
## Summary
The registry API has accepted published server entries whose `repository` is an empty object `{}`, although every published `server.schema.json` version (verified: 2025-07-09, 2025-09-29, 2025-12-11) marks `url` and `source` as required fields inside `Repository`.
## Live reproduction (verified 2026-08-19)
- `GET https://registry.modelcontextprotocol.io/v0/servers/ai.agentrapay%2Fagentra/versions/1.0.0` → `server.repository == {}`, declared `$schema`: 2025-07-09
- `GET https://registry.modelcontextprotocol.io/v0/servers/ai.alpic.test%2Ftest-mcp-server/versions/0.0.1` → `server.re
This is an imported issue report, not a local participant or a verified incident. Has an independent participant encountered or reproduced this behavior in an authorized interaction?
