mcp_schema: agent-observed vs reference-observed catalog divergence

[blitzcrieg1]

Why

r/mcp feedback (2026-08). Today the sensor sees a catalog only when an agent lists tools, so the trail is bounded by which surfaces were covered and whether anyone opened their editor that day. The coverage attestation already admits this.

A reference observation taken on our own schedule, with a known auth state, would give a baseline that does not depend on someone working.

The interesting part is not the extra coverage. It is the comparison: if the reference observation and the agent observation disagree for the same server at the same time, that is a server presenting one catalog to a scanner and another to the real agent. That is much louder than a digest moving on its own, and no amount of fingerprinting a single vantage point will surface it.

Same shape as #104 but at the listing layer rather than at call time.

The constraint this runs into

mcp_schema.py states the rule plainly:

It does not spawn MCP servers. npx -y on a five-minute beat would fetch and run whatever the registry currently serves, which is the attack, performed by the recorder.

That reasoning holds for stdio, where talking to a server means executing it. It does not hold for remote transports, where we connect rather than spawn. The proxy is stdio-only today; SSE and streamable HTTP are on the roadmap without an issue.

Proposal

Design first, and explicitly scoped:

• Stdio: not doing this. The existing reasoning stands and should be quoted wherever this is discussed, so it does not get relitigated.
• Remote transports: gather a reference observation once that transport exists, on our schedule, with recorded auth state.
• Divergence as its own signal, distinct from a digest move. Needs a severity and a rule id.
• Reference observations must be marked as such in the trail. A reference baseline is a different kind of evidence from what an agent was actually handed, and attestation depends on not blurring the two.

Blocked on

Remote transport support in mcp_audit_proxy. Filing now so the divergence idea is not lost inside that work.

Source

Peer review on https://www.reddit.com/r/mcp/comments/1vvinyo/

[hossainzarif23]

Hi, can I get assigned to this?

[blitzcrieg1]

Thanks for offering, and I would rather be straight with you than hand you this one.

#112 cannot be started yet. The divergence signal needs two observations of the same catalog to compare: what the agent was handed, and what a reference fetch on our own schedule returns. The second source does not exist. The proxy is stdio only, and talking to a stdio server means spawning it, which means npx -y on a schedule fetching and executing whatever the registry currently serves. That is the attack, performed by the recorder, so it is a deliberate no rather than a gap.

Remote transports are different, because there you connect instead of execute. So #112 unblocks when HTTP and SSE MCP support lands, and it is filed now only so the idea does not get buried inside that work. Assigning it to you today would mean assigning you to something you cannot begin.

If you want the MCP area, the unblocked piece is the transport itself: SSE and streamable HTTP in tools/mcp_audit_proxy.py. That is real work rather than a starter task, it has no issue yet, and it is the thing standing between #112 and everyone else's ability to start it. Say so and I will write it up properly with the constraints, because there are a few that are not obvious from the outside.

If you would rather start smaller, three that are genuinely open and useful:

• cli: add agentmetry disposition for detection triage #100, a agentmetry disposition CLI command. Self-contained, and the single most useful thing anyone could add right now: closing a detection currently requires the dashboard or a raw API call, which is why untriaged findings pile up and threaten the beta gate.
• Grow the detection benchmark corpus with more benign sessions #25 or Six of fifteen built-in rules have no benchmark corpus coverage #36, benchmark corpus coverage. Two of the fifteen rules have no corpus case. Recorded benign sessions are worth more than invented attack ones, and a case that makes a rule fire when it should not is the highest-value thing this project receives.
• CLI: agentmetry detections <correlation_id> #8, agentmetry detections <correlation_id>. Small, well-defined, labelled good first issue.

Pick whichever appeals and I will assign it. If none do, tell me what you actually want to work on and I will tell you honestly whether it is ready.