modelcontextprotocol/experimental-ext-tool-annotations
Watch
1
0
Fork
You've already forked experimental-ext-tool-annotations
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
experimental-ext-tool-annot.../docs/open-questions.md
Sam Morrow 70ec91c5f7
 docs: drop jargon, make repo docs descriptive 
Replace 'carve'/'headline' throughout; reframe the front-facing docs
(README, spec drafts, related-work) to describe what the repo contains
and link to it rather than narrate the process. Process framing stays in
the decision log and the intent-comment/sep-disposition planning docs.
Live SEP-1913/SEP-2061 comments updated to match.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-06-11 00:12:30 +02:00

2 KiB
Raw Blame History

Open questions

Tracked here rather than in the spec drafts, so the drafts stay non-temporal.

Cross-cutting

  • Where does the policy-enforcement engine live across different user universes (cross-org, cross-domain)? Engines work well within one universe; cross-domain is the hard case. (IG 2026-05-28.)
  • Cross-domain integrity verification — is asymmetric crypto for domain identity in scope for a future extension, or out of scope entirely? CLI tools remain a persistent gap for enforcing these constraints.
  • evidenceRef.type registry — who curates the list of well-known profile types, and how do we coordinate with attestation SEPs (e.g. SEP-2787) so values don't collide?

trust-annotations

  • Is sensitive the right single coarse signal, or do we need the data-class.v1 profile from day one?
  • Content-block-level vs. result-level attachment — does the draft need a worked multi-result example before it's implementable?
  • list_changed: confirmed response-level annotations don't participate; revisit only if trust vocabulary ever attaches to tool definitions.

action-metadata

  • Coexistence vs. replacement of legacy destructiveHint / readOnlyHint / idempotentHint / openWorldHint.
  • Open strings vs. closed enums for destination / source / sensitivity.
  • Does requiresReview need a machine-readable reason for good client UX?

ifc-fides

  • Inline _meta.ifc for low-friction adoption vs. always behind evidenceRef.
  • GitHub Enterprise internal repo visibility → public/private/reader-set mapping (audience is the whole org, broader than collaborators).

Parked (SEP-1913 umbrella)

  • maliciousActivityHint — if it returns, it is per-ContentBlock with spans, driven by the host's own detection, not a server-attested boolean.
  • Session-level propagation rules — escalation semantics and the sequence-shape gap ("this was call N in a flagged sequence" has no response annotation surface today).