2aea5dc6beCarve the schema-bearing parts of SEP-1913 into three independent experimental extensions, per @localden's "narrower first cut" ask and the Tool Annotations IG's 2026-05-28 extension-first decision: - io.modelcontextprotocol/trust-annotations (headline): narrow data-classification taxonomy (sensitive, untrusted) + open-ended evidenceRef pointer. - io.modelcontextprotocol/action-metadata: carries forward SEP-2061 (inputMetadata/returnMetadata/outcomes + requiresReview). - io.modelcontextprotocol/ifc-fides: FIDES information-flow control as a profile of evidenceRef, not a wire root. Adds repo meta (README, MAINTAINERS, CONTRIBUTING, LICENSE) and docs (sep-disposition, intent-comment, decisions, open-questions, trust-model, related-work). FIDES demoted to a profile; DataClass and requiresReview rehomed; maliciousActivityHint and propagation parked on the SEP-1913 umbrella. Citations index on public sources only. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2.7 KiB
2.7 KiB
Related work
External references and prior art relevant to the IG's trust / privacy annotation work. Several were surfaced in IG meetings (notably 2026-05-28).
SEPs
- SEP-1913 — Trust and Sensitivity Annotations — the umbrella this work carves from.
- SEP-2061 — Action Security Metadata — carried forward as
action-metadata. - SEP-1862 — Tool Resolution / pre-flight checks — core-protocol, composes with these extensions.
- SEP-2133 — Extensions — the framework this repo incubates under.
- SEP-2127 — Server Cards — precedent for the Standards→Extensions Track refactor.
- SEP-2787 — Tool Call Attestation — candidate
evidenceRefprofile.
Research
- FIDES — Information-flow control for LLM agents. arXiv:2505.23643. Basis for the
ifc.fides.v1profile. - Design Patterns for Securing LLM Agents — IBM/Google/Microsoft. arXiv:2506.08837. Plan-Then-Execute, Dual LLM, Map-Reduce, etc.
- Trail of Bits — prompt-injection via hidden content in GitHub issues. blog.
- OpenAI Auto Review — https://alignment.openai.com/auto-review/ (shared in IG chat).
Implementations & tooling
kapil8811/mcp-trust-annotations— reference Python SDK PoC fortrust-annotations.github-mcp-server— public MCP server; emitter candidate forifc-fides(knows repo visibility + collaborators).- Ethyca data-labeling docs — https://www.ethyca.com/docs (shared in IG chat).
- GitHub Next agentic-workflows research on data labeling — to be documented as issues in this repo (IG action item, @gokhanarkan / @joannakl).
Adjacent community proposals (from the SEP-1913 thread)
- SINT Protocol (capability-token constraint enforcement) — pshkv.
- in-toto attestations as a trust-annotation substrate.
- OVERT 1.0 envelope shape for runtime evidence.
- Caller/tool cosigning model — viftode4.
- Sequence-shape policies — marras0914.
These are exactly the models that evidenceRef's open type is designed to
accommodate as profiles.