{"vulnerability": "CVE-2025-54136", "sightings": [{"uuid": "e29c20cc-0c4c-4aa6-8fd6-7fe5d43ba4ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54136", "type": "seen", "source": "https://bsky.app/profile/cti-news.bsky.social/post/3lvnrhfhdms26", "content": "", "creation_timestamp": "2025-08-05T13:03:46.930932Z"}, {"uuid": "7d6e8681-4c5f-43eb-beff-5154cb93aa79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54136", "type": "seen", "source": "https://bsky.app/profile/LLMs.activitypub.awakari.com.ap.brid.gy/post/3lvnw7fadh6k2", "content": "", "creation_timestamp": "2025-08-05T14:32:37.482708Z"}, {"uuid": "add09c89-5d72-48ad-9501-4d92f7629389", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54136", "type": "seen", "source": "https://bsky.app/profile/LLMs.activitypub.awakari.com.ap.brid.gy/post/3lvnx2jh6sp22", "content": "", "creation_timestamp": "2025-08-05T14:46:35.149976Z"}, {"uuid": "44b35679-b748-4668-b1f1-43877e154f68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54136", "type": "seen", "source": "https://bsky.app/profile/pigondrugs.bsky.social/post/3lvo3gd7mcp2i", "content": "", "creation_timestamp": "2025-08-05T16:02:07.969293Z"}, {"uuid": "b4754608-b249-40a6-8817-26c838e34d49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54136", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3lvo5fvan4k2h", "content": "", "creation_timestamp": "2025-08-05T16:37:43.394412Z"}, {"uuid": "960177f6-3c78-4b31-b060-f0dd1db52a9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54136", "type": "seen", "source": "https://thehackernews.com/2025/08/cursor-ai-code-editor-vulnerability.html", "content": "", "creation_timestamp": "2025-08-05T11:01:00.000000Z"}, {"uuid": "5f3ab69f-9938-4828-89d2-ec315f43207d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54136", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3lvoujqir6o2a", "content": "", "creation_timestamp": "2025-08-05T23:31:26.500041Z"}, {"uuid": "11a6ff4b-0440-4de8-ae8c-e7d85e1e7cc8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54136", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3lvpo364rrw2r", "content": "", "creation_timestamp": "2025-08-06T07:08:34.840387Z"}, {"uuid": "53263f82-f608-44b2-a020-e1a3948f1cc4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54136", "type": "seen", "source": "https://infosec.exchange/users/edwardk/statuses/114981709495083968", "content": "", "creation_timestamp": "2025-08-06T12:00:51.643198Z"}, {"uuid": "d6b00545-a4fc-47aa-9fa1-371107a5d7a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54136", "type": "seen", "source": "https://threatintel.cc/2025/08/06/cve-mcpoison-cursor-ide-persistent.html", "content": "", "creation_timestamp": "2025-08-06T10:00:44.000000Z"}, {"uuid": "a68e5f6c-6f4e-4200-819a-24478427142c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54136", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3lvuoy232du25", "content": "", "creation_timestamp": "2025-08-08T07:08:01.618599Z"}, {"uuid": "371ddfc4-9a8a-4540-b127-4a5323958869", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2025-54136", "type": "seen", "source": "https://bsky.app/profile/flarestart.bsky.social/post/3mgajjp2g4n22", "content": "", "creation_timestamp": "2026-03-04T14:45:35.078465Z"}, {"uuid": "0ed7da81-5532-46b0-833f-41a60bda42cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54136", "type": "published-proof-of-concept", "source": "https://t.me/cKure/15169", "content": "\ud83d\udc69\u200d\ud83d\udcbb \ud83d\udcf1 CVE-2025-54136 \u2013  MCPoison Cursor IDE: Persistent Code Execution via MCP Trust Bypass.\n\nhttps://research.checkpoint.com/2025/cursor-vulnerability-mcpoison/", "creation_timestamp": "2025-08-05T19:10:10.000000Z"}, {"uuid": "625e78e2-3c05-49a9-aa11-b6fc09719944", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54136", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/7284", "content": "\ud83d\udea8 A high-severity flaw in Cursor AI (CVE-2025-54136) let attackers hijack trusted MCP configs\u2014triggering remote code execution every time you opened the project.\n\nNo re-prompt. No warning. Just silent compromise by modifying a config file you already trusted.\n\nLearn more \u2192 https://thehackernews.com/2025/08/cursor-ai-code-editor-vulnerability.html", "creation_timestamp": "2025-08-05T13:03:45.000000Z"}, {"uuid": "6e707827-5a73-41e1-92bf-8fc7563abb6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54136", "type": "seen", "source": "https://bsky.app/profile/hasamba72.bsky.social/post/3mkl4nscgnc2l", "content": "", "creation_timestamp": "2026-04-28T17:35:17.635113Z"}, {"uuid": "c4cd2de0-2431-4c1a-a580-856c29bc496c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54136", "type": "published-proof-of-concept", "source": "https://t.me/TopCyberTechNews/567", "content": "Top Security News for Today\n\nSurveilling Your Children with AirTags  \nhttps://www.schneier.com/blog/archives/2025/08/surveilling_your_children_with_airtags.html\n\nHTTP Request Smuggling Explained: with seasoned bug bounty hunter NahamSec and world-class researcher James Kettle  \nhttps://portswigger.net/blog/http-request-smuggling-explained-with-seasoned-bug-bounty-hunter-nahamsec-and-world-class-researcher-james-kettle\n\n3 Custom VT-x Hypervisors in C \u2013 EPT Cloaking, CPUID/MSR Spoofing & VMX Control  \nhttps://www.reddit.com/r/lowlevel/comments/1mi5txt/3_custom_vtx_hypervisors_in_c_ept_cloaking/\n\nDutch Caribbean islands respond to cyberattacks on courts, tax departments  \nhttps://therecord.media/aruba-curacao-governments-cyberattacks\n\nCVE-2025-54136 \u2013 MCPoison Cursor IDE: Persistent Code Execution via MCP Trust Bypass  \nhttps://research.checkpoint.com/2025/cursor-vulnerability-mcpoison/\n\nTaiwan\u2019s TSMC fires engineers over suspected theft of semiconductor secrets  \nhttps://therecord.media/tsmc-fires-engineers-over-semiconductor-secrets-theft\n\nVietnamese-speaking hackers appear to be running global data theft operation through Telegram  \nhttps://therecord.media/pxa-infostealer-telegram-bots-vietnamese-speaking-hackers\n\nOdooMap - A Pentesting Tool for Odoo Applications  \nhttps://www.reddit.com/r/netsec/comments/1micsmu/odoomap_a_pentesting_tool_for_odoo_applications/\n\nElevate your protection with expanded Microsoft Defender Experts coverage  \nhttps://techcommunity.microsoft.com/blog/microsoftsecurityexperts/elevate-your-protection-with-expanded-microsoft-defender-experts-coverage/4439134\n\nBipartisan Senate duo wants answers from UnitedHealth over Episource data breach  \nhttps://therecord.media/episource-data-breach-questions-senators-cassidy-hassan\n\nFollow Top Cyber News at https://t.me/TopCyberTechNews Feel free to DM me at https://twitter.com/ShayaFeedman", "creation_timestamp": "2025-08-06T09:30:20.000000Z"}, {"uuid": "4ed092db-95a6-4a64-8bc1-eeda0622d4b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54136", "type": "published-proof-of-concept", "source": "Telegram/xqO0_PWLKtVwwojJCjCsYYBEBGCE-dt2EY-S6CjM_MXq4w", "content": "", "creation_timestamp": "2025-08-05T16:50:01.000000Z"}, {"uuid": "41cfb9c8-73c9-443b-bd69-ea73d618e8b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54136", "type": "seen", "source": "https://t.me/ctinow/235987", "content": "CVE-2025-54136 \u2013\u00a0 MCPoison Cursor IDE: Persistent Code Execution via MCP Trust Bypass\nhttps://ift.tt/XfQd1mH", "creation_timestamp": "2025-08-05T13:05:09.000000Z"}, {"uuid": "900b34c0-bae3-4345-b0f1-a57b6b3b9d8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54136", "type": "seen", "source": "Telegram/_qFyWwPBG5YYrYVJCuvS8pNkDyhJdlaykHNtl_KVjYImn64", "content": "", "creation_timestamp": "2026-07-16T19:00:16.869670Z"}, {"uuid": "370f4b2b-96c6-476b-9d57-1c7434434d22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54136", "type": "seen", "source": "Telegram/_qFyWwPBG5YYrYVJCuvS8pNkDyhJdlaykHNtl_KVjYImn64", "content": "", "creation_timestamp": "2026-07-17T00:00:32.280412Z"}, {"uuid": "1a249387-83ff-4c5e-9e13-20978b9fc478", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54136", "type": "published-proof-of-concept", "source": "Telegram/_qFyWwPBG5YYrYVJCuvS8pNkDyhJdlaykHNtl_KVjYImn64", "content": "", "creation_timestamp": "2026-07-18T00:00:33.715594Z"}, {"uuid": "bb1b52c1-5743-47d5-adec-8ff7856de50a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54136", "type": "published-proof-of-concept", "source": "https://t.me/ckuRED/626", "content": "\ud83d\udc69\u200d\ud83d\udcbb \ud83d\udcf1 CVE-2025-54136 \u2013  MCPoison Cursor IDE: Persistent Code Execution via MCP Trust Bypass.\n\nhttps://research.checkpoint.com/2025/cursor-vulnerability-mcpoison/", "creation_timestamp": "2026-07-21T13:00:07.290711Z"}, {"uuid": "c2ed9644-fbe1-4429-8388-fc318ad8b2ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54136", "type": "published-proof-of-concept", "source": "https://t.me/ckuRED/626", "content": "\ud83d\udc69\u200d\ud83d\udcbb \ud83d\udcf1 CVE-2025-54136 \u2013  MCPoison Cursor IDE: Persistent Code Execution via MCP Trust Bypass.\n\nhttps://research.checkpoint.com/2025/cursor-vulnerability-mcpoison/", "creation_timestamp": "2026-07-22T00:00:24.132156Z"}, {"uuid": "b716fca6-ac8c-481e-97fe-3fc3389b5c83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-54136", "type": "seen", "source": "https://gist.github.com/elang2/7aeddf9eecc4e5e9f880d2ed041b6168", "content": "# Scope: Tool-Definition Integrity (Option #1)\n\n## Summary\n\nA canonical form for MCP tool definitions, cross-language conformance vectors that prove byte-identical digests, and a drift-detection chain record emitted when the gateway observes a tool definition change mid-session. Packaged as a gateway feature + vector corpus + SEP draft.\n\n---\n\n## 1. What needs canonicalization\n\nAn MCP tool definition (from `tools/list` response) has these fields:\n\n| Field | Type | Required | Divergence risk |\n|-------|------|----------|-----------------|\n| `name` | string | yes | Unicode normalization, astral-plane characters |\n| `description` | string | no | Unicode, trailing whitespace, newline variants |\n| `inputSchema` | object (JSON Schema) | yes | Key ordering, float defaults, nested objects, $ref resolution |\n| `annotations` | ToolAnnotations | no | Boolean hints, key ordering, optional fields absent vs. present |\n\n**ToolAnnotations fields:** `readOnlyHint`, `destructiveHint`, `idempotentHint`, `openWorldHint`, `title` (all optional, boolean/string).\n\n**inputSchema is the main minefield:**\n- JSON Schema allows `default`, `minimum`, `maximum`, `multipleOf`, `exclusiveMinimum`, `exclusiveMaximum` \u2014 all potentially floats\n- `properties` is an object with arbitrary key ordering\n- Nested `items`, `additionalProperties`, `oneOf`/`anyOf`/`allOf` produce deep structures\n- `enum` values can be any JSON type including floats and null\n- `$ref` may or may not be resolved before hashing (different implementations differ)\n\n---\n\n## 2. Canonical form design\n\n### Recommendation: Use RFC 8785 JCS for tool-definition digests\n\n**Rationale:** This is the same canonicalization split already proven for audit records:\n\n| Layer | Form | Handles floats? | Purpose |\n|-------|------|-----------------|---------|\n| Signing form (audit records) | Tuple-array, M/L tags, integer-only | No | Chain integrity, attestation signatures |\n| Content digests (request/response) | RFC 8785 JCS | Yes | Binding payloads to records |\n| **Tool-definition digests (NEW)** | **RFC 8785 JCS** | **Yes** | **Pinning tool schemas** |\n\nTool definitions contain arbitrary JSON Schema which allows floats. The signing form (`canonicalizeValue()`) rejects floats by design. Forcing float-to-string conversion would make the digest non-obvious to verify (a consumer would need to know about the pre-encoding). JCS handles floats natively (IEEE 754 double \u2192 shortest representation) and is already well-understood.\n\n**The digest computation:**\n\n```\ntoolDefinitionDigest = SHA-256(JCS(toolDefinition))\n```\n\nWhere `toolDefinition` is the full tool object as returned by `tools/list` (name + description + inputSchema + annotations), canonicalized with RFC 8785 before hashing.\n\n**Why not `canonicalizeValue()`:**\n- It would work for the name/description/annotations (no floats there)\n- It breaks on inputSchema if any numeric constraints exist\n- Using two different forms for one digest would be confusing\n- JCS is the standard answer for \"deterministic hash of arbitrary JSON\"\n\n**Cross-language guarantee:** JCS is specified by RFC 8785 with explicit test vectors. Python has `canonicaljson`, JS has multiple implementations. The remaining divergence risk is in inputs JCS itself doesn't normalize (lone surrogates, $ref resolution, absent-vs-null). Our vectors test those.\n\n### What `canonicalizeValue()` still provides\n\nThe gateway's signing form is used for the **chain record** itself (the drift-detection record is signed and chained like any other). The tool-definition digest is a content hash that appears as a field within that signed record \u2014 same pattern as `extensionsDigest` and `decisionContextDigest`.\n\n---\n\n## 3. Drift detection record design\n\nNew record type in the chain: `tool_drift`\n\n```typescript\ninterface ToolDriftRecord {\n  id: string;\n  type: \"tool_drift\";\n  timestamp: string;\n  toolName: string;\n  namespace: string;\n  previousDefinitionDigest: string;  // SHA-256 of JCS(previousToolDef)\n  newDefinitionDigest: string;       // SHA-256 of JCS(currentToolDef)\n  detectedAtRecord: number;          // which call number noticed the change\n  previousHash: string;              // chain linkage\n  attestation?: string;              // signed by gateway\n}\n```\n\n**Integration with existing chain:**\n- Chained like checkpoint and chain_break records (has `previousHash`)\n- Signed with the same signer (Ed25519 or HMAC)\n- Canonical form follows the same tuple-array pattern as other record types\n- Gateway emits this BEFORE the tool call that noticed the drift (the call itself proceeds; the drift record is evidence, not enforcement)\n\n**Detection mechanism:**\n1. On startup, gateway calls `tools/list` and computes `SHA-256(JCS(tool))` for each tool \u2192 stores as baseline\n2. Periodically (configurable) or on each `tools/call`, gateway re-fetches `tools/list`\n3. If any tool's digest differs from baseline, emit a `tool_drift` record into the chain\n4. Update baseline to new digest\n\n**Configuration:**\n\n```yaml\ntoolIntegrity:\n  enabled: true\n  checkInterval: \"every_call\" | \"periodic\" | \"session_start\"\n  periodicIntervalMs: 30000\n  action: \"record\" | \"record_and_block\"  # block = deny calls to drifted tools\n```\n\n---\n\n## 4. Conformance vectors\n\nFile: `test/vectors/tool-definition-canonicalization.json`\n\n### Positive vectors (expected digest must match across JS and Python):\n\n| # | Description | Tests |\n|---|-------------|-------|\n| P1 | Minimal tool (name + inputSchema only) | Baseline |\n| P2 | Tool with all fields populated | Full coverage |\n| P3 | Tool with nested inputSchema (properties with objects) | Deep key sorting |\n| P4 | Tool with inputSchema containing float default (0.1) | JCS float handling |\n| P5 | Tool with inputSchema containing integer default (42) | Integer vs float distinction |\n| P6 | Tool with annotations (all boolean hints) | Optional field handling |\n| P7 | Tool with Unicode description (astral-plane emoji \ud835\udd73) | Surrogate pair handling |\n| P8 | Tool with BMP Unicode in name (caf\u00e9) | Common non-ASCII |\n\n### Negative vectors (MUST NOT produce the same digest / must reject):\n\n| # | Description | Tests |\n|---|-------------|-------|\n| N1 | Same tool with keys in different source order | Key-order independence |\n| N2 | Tool with `description: null` vs `description` absent | null vs missing distinction |\n| N3 | Tool with trailing whitespace in description | Whitespace significance |\n| N4 | Tool with lone surrogate in name (U+D800) | Must reject / error |\n| N5 | Tool with integer 1 vs float 1.0 in default | Type distinction under JCS |\n| N6 | Tool with NaN in inputSchema minimum | Must reject (NaN not valid JSON) |\n| N7 | Tool with duplicate keys in inputSchema | Implementation-defined behavior |\n| N8 | Tool with empty properties {} vs properties absent | Structural distinction |\n| N9 | Tool with -0 as a default value | JCS normalizes to 0 |\n| N10 | Tool with very large integer (> 2^53) | Safe-integer boundary |\n| N11 | Two tools differing only in annotation order | Key-order independence in nested |\n| N12 | Tool with $ref unexpanded vs $ref resolved inline | Expansion policy |\n\n### Drift vectors (paired before/after definitions):\n\n| # | Description | Tests |\n|---|-------------|-------|\n| D1 | Description text changed | Drift detected |\n| D2 | inputSchema property added | Drift detected |\n| D3 | Annotation value flipped (readOnlyHint: false \u2192 true) | Drift detected |\n| D4 | Key order changed but content identical | Drift NOT detected (same JCS output) |\n\n---\n\n## 5. SEP draft structure\n\n**Title:** SEP-XXXX: Tool Definition Integrity via Deterministic Digests\n\n**Sections:**\n\n1. **Abstract** \u2014 One paragraph: intermediaries and clients need a deterministic way to detect tool-definition changes. This SEP specifies a canonical digest computation and a notification mechanism.\n\n2. **Motivation** \u2014 CVE-2025-54136, OWASP MCP03:2025, Invariant Labs recommendations all assume hash-pinning works but don't specify how. Cross-language JSON serialization diverges on key order, floats, Unicode.\n\n3. **Specification**\n   - 3.1 Digest computation: SHA-256 over RFC 8785 JCS canonical form of the full tool object\n   - 3.2 Scope: the digest covers `name`, `description`, `inputSchema`, and `annotations` (the complete tool object from `tools/list`)\n   - 3.3 Normalization: `$ref` MUST be resolved before canonicalization (no external references in the digested form). Absent optional fields are omitted (not null).\n   - 3.4 Constraints: lone surrogates MUST be rejected. NaN/Infinity MUST be rejected.\n   - 3.5 Server capability: servers MAY advertise `toolDefinitionDigests: true` in capabilities\n   - 3.6 Digest field: `tools/list` response MAY include a `digest` field per tool (server-computed)\n   - 3.7 Drift notification: new notification type `notifications/tools/definitionChanged` with fields `toolName`, `previousDigest`, `newDigest`\n\n4. **Conformance** \u2014 Cross-language test vectors as normative. Two independent verifiers (JS + Python) MUST produce byte-identical digests for all positive vectors.\n\n5. **Security considerations** \u2014 Rug-pull detection guarantees. What this does NOT prevent (first-use trust). Relationship to ETDI (complements, does not replace OAuth-level trust).\n\n6. **References** \u2014 RFC 8785, OWASP MCP Top 10, CVE-2025-54136, Invariant Labs advisory, mcp-audit-gateway DOI\n\n---\n\n## 6. Deliverables and timeline\n\n| Deliverable | Description | Effort |\n|-------------|-------------|--------|\n| **Gateway feature** | `tool_drift` record type, JCS digest computation for tools, periodic/per-call checking, config option | 3-4 days |\n| **Conformance vectors** | `tool-definition-canonicalization.json` with ~25 vectors (positive + negative + drift pairs), JS verifier, Python verifier | 2-3 days |\n| **SEP draft** | Markdown document following MCP SEP template, referencing vectors and implementation | 1-2 days |\n| **Paper reference** | Update README/paper to mention tool-definition integrity as second use case | 0.5 days |\n\n**Total: ~2 weeks (part-time)**\n\n**Dependencies:**\n- Need a JCS library for the JS implementation (candidates: `canonicalize` npm package, or implement the small subset needed)\n- Python: `canonicaljson` package\n- No external dependencies for the SEP draft\n\n**Sequence:**\n1. Implement JCS digest for tool definitions in gateway (validates the approach works)\n2. Write vectors simultaneously (TDD: vectors define expected behavior)\n3. Implement `tool_drift` record type and chain integration\n4. Write Python verifier for vectors\n5. Draft SEP referencing shipped implementation + vectors\n6. Open discussion/PR on modelcontextprotocol repo\n\n---\n\n## Key design decision: $ref handling\n\nThe biggest open question is whether `$ref` must be resolved before hashing. Two options:\n\n**Option A: Require resolution** (recommended)\n- Pro: Deterministic \u2014 two servers returning the same logical schema always produce the same digest regardless of whether they use $ref or inline\n- Con: Requires a $ref resolver in the canonical form computation\n- Implementation: Simple for MCP since $ref in tool schemas is typically internal (no external URLs)\n\n**Option B: Hash as-is**\n- Pro: Simple \u2014 just hash whatever the server returned\n- Con: Same logical schema with/without $ref produces different digests \u2014 false drift alarms\n- This would make drift detection unreliable across server versions that refactor schemas\n\n**Recommendation: Option A** \u2014 resolve internal $ref before canonicalization. External $ref (URLs) MUST be rejected (the digest must be self-contained).\n", "creation_timestamp": "2026-08-23T21:05:56.661865Z"}]}