Projects · Agent control · Research prototype · OBSERVED

mcp-authority-boundary

What this establishes

That authorization at an agent's tool boundary is several properties that fail independently, and that mediation can hold while the binding between the authorized operation and the executed one does not.

What this does not establish

Policy adequacy, meaning whether a policy expresses the authority its author intended. Two counterexamples covering that are retained unfixed. Effect verification is also not established by the shipped evidence: independent fixture read-back exists for two tools only, and the version-one ledger executed neither, so its stage-four checks were record consistency rather than observation of the world.

Trusted base

The Cedar policy engine, the Model Context Protocol SDK, Node, and the assumption that whoever launches the server chooses the session identity. Authentication is not provided and a hostile local actor who can spawn the process is not contained.

Method

A Cedar-enforced Model Context Protocol server mediates six tools across 25 adversarial scenarios, writing every decision to a hash-chained ledger that an independently written replay verifier reads back. Four properties are separated and reported one by one: mediation, binding, policy adequacy, effect verification.

Result

In version one, 66 of 66 tests passed, replay returned VERIFIED, a checked complete-mediation invariant held, and a write of 100,000 bytes executed under a 4,096-byte cap. The resolver measured the payload as a string and substituted zero bytes for a non-string; the executor coerced the same argument and wrote it. The repair binds execution to one validated immutable operation.

Negative controls. Two counterexamples are retained unfixed to keep policy adequacy visibly unestablished. A test fails the build if a released effect-verification claim is again paired with a ledger that exercises no read-back tool.

Reproduce

npm install && ./run.sh

Toolchain

TypeScript, Node, Cedar, the Model Context Protocol SDK; no network

Verified at

https://github.com/repowazdogz-droid/mcp-authority-boundary@03854ddc (2026-08-17)

This pass. Confirmed by source read at commit 03854ddc; not re-executed in this pass.

Independent reproduction

None known.

Prior art and positioning

Complete mediation is a classical protection principle, and confused-deputy problems are long documented. The contribution here is the separation of four properties that are usually reported as one, on a working agent tool boundary, with the counterexamples kept rather than fixed.

Links

• Source: https://github.com/repowazdogz-droid/mcp-authority-boundary
• Finding: A write of 100,000 bytes executed under a policy that capped writes at 4,096 bytes, while 66 of 66 tests passed, an independent replay verifier returned VERIFIED, and a checked complete-mediation invariant held.