experimental-ext-tool-annot.../docs/intent-comment.md
Sam Morrow b799af5bea
spec(ifc-fides): address review; reframe action-metadata for SEP-2061 closure
ifc-fides (review by @JoannaaKL):
- confidentiality is public/private only on the wire; drop the reader-list
  (logins aren't uniform across servers, are themselves access-restricted,
  and reader sets can be huge)
- add Reader-set resolution section: two private markers aren't equal, the
  confidentiality join is the intersection and isn't computable from opaque
  wire markers, so hosts resolve to concrete reader sets at decision time
- integrity join is total/wire-computable; confidentiality join is not
- emitter MUST classify per resource, not per repository (public repos serve
  non-world-readable sub-resources), making github-mcp-server a real proof point

action-metadata / docs:
- SEP-2061 closed 2026-06-13 in favour of this extension; this draft is now the
  canonical home. Updated action-metadata.mdx, README, sep-disposition,
  related-work, and intent-comment status accordingly.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-06-15 23:29:44 +02:00

3.3 KiB

Intent comments (posted)

Both comments below have been posted. Kept here as the source of record, in sync with sep-disposition.md.

  • SEP-1913 umbrella comment — posted 2026-06-10.
  • SEP-2061 coordination note — posted 2026-06-10; @localden then closed SEP-2061 on 2026-06-13 in favour of the action-metadata extension.

For SEP-1913

Intent: split this SEP and migrate to the Extensions Track

A note on direction for everyone following this thread. When SEP-1913 was first framed, the Extensions Track (SEP-2133) and the experimental-ext-* incubation process didn't exist in their current form. They now do, and they're a better fit for this work than a single Standards Track SEP.

Two things pushed us here:

  • @localden's review ask for a narrower first cut — the concern that a broad taxonomy with array-or-scalar polymorphism is hard to remove or change once it lands.
  • The Tool Annotations IG's May 28 decision to pursue trust/privacy as an experimental extension first, gather adoption evidence, then ask core maintainers to absorb anything.

So the plan is to **split this proposal into a few small, independently-shippable extensions**, each with its own io.modelcontextprotocol/… identifier, reference implementation, and path to an Extensions Track SEP. Incubation is in experimental-ext-tool-annotations.

Kicking off with a few draft extensions in the tool annotations repo — not sure yet whether they'd each need separate repos eventually, or whether grouping them in one is fine. That's part of what incubation is for.

Extension Scope
trust-annotations The narrow data-classification taxonomy (sensitive, untrusted) + an open-ended evidenceRef pointer for richer, out-of-band evidence.
action-metadata Tool I/O + outcome contract (folds in @rreichel3's SEP-2061).
ifc-fides Information-flow control (arXiv:2505.23643) as one profile of evidenceRef, not a wire root — the public/private-repo confidentiality case, with github-mcp-server as an emitter example.

Deliberately removed: maliciousActivityHint (the structural concerns raised here are unresolved) and session-level propagation rules.

This follows the same Standards-Track → Extensions-Track refactor pattern as SEP-2127 (#2893). This PR will eventually pivot to the trust-annotations piece itself, with the other schema-bearing pieces moving out into their own extensions. Everything is still in the incubation phase, so naming, design, and the choice of what to put forward as an extension are all open for discussion in the IG.


For SEP-2061 (coordination note)

@rreichel3 — splitting this out into an independent extension as discussed: https://github.com/modelcontextprotocol/modelcontextprotocol/pull/1913#issuecomment-4675047154