[aterga]

Summary

Third of three marketplace-compliance PRs (companions: #153 — top-up instructions-only, merged; #154 — the ledger-method guard and instructions-only canister creation, merged; this PR now targets main directly). It aligns everything a directory reviewer reads — README, tool/argument texts, the landing page, the crates.io metadata, and the submission docs — with the behavior the companions ship: financial transactions are not supported, stated plainly, instead of advertising DeFi/portfolio/trading use cases.

Related issues

None — part of the marketplace-compliance track. Goal: the OpenAI attestation "my plugin does not initiate or execute money transfers, crypto transfers, or investment trades on behalf of users" and Anthropic's financial-transactions acknowledgment, both answerable black-and-white.

Changes

• README: an up-front "Not for financial operations" statement (what is refused, that top-up and creation are instructions-only, and that users act in a wallet they control, e.g. oisy.com); "DeFi" dropped from the skills enumeration; example apps neutralized — DEX names (MULTI/DEX, ICPSwap) and, per review, financial-adjacent ones (NNS, Oisy) are no longer used as examples: the neutral example is https://opencloud.org, with Oisy kept only where a wallet is genuinely meant (the refusal recommendation).
• Tool/argument texts (tools.rs, discover.rs): the same example neutralization (including OpenAppArgs/FindAppArgs schema docs and the server-instruction walkthroughs), and "DeFi" removed from icp_list_skills' description. The financial policy itself lives in the server-level instructions via Refuse ledger transfer/approval methods in canister_update_call #154 — per review, no per-tool policy paragraphs.
• Landing page (src/assets/index.html bundled template): the wallet-balance chat mock becomes a neutral app-data read; portfolio/badge/NNS-neuron prompts become neutral app examples; the tool-group copy says creation and top-ups return CLI steps; the Trust section gains a "Not for financial operations" card. Only the embedded template line changed — the edit script asserts decoded-value equality around the re-encode.
• Submission docs (docs/anthropic-directory-submission.md, docs/openai-directory-submission.md): rewritten to the decided posture, per review — no counterexample lists, options, or open follow-ups: no tool initiates or executes a transfer of the user's funds (the guard refuses financial ledger methods; top-up and creation are instructions-only), so the attestation/acknowledgment sections state that plainly. Example prompts and test cases are financially neutral; the "standardized" qualifier is gone from submission-facing text.
• crates.io metadata (Cargo.toml): the cryptography::cryptocurrencies category is removed.

Testing

• cargo build --locked --all-targets
• cargo test --locked --all-targets (all pass, including after merging main with Refuse ledger transfer/approval methods in canister_update_call #154 + Stage 3: end-user setup, PocketIC login e2e, and the dist release pipeline #152)
• Landing-page bundle edit verified by decode/re-encode round-trip assertion
• npm test --prefix monitoring/mcp-status (dashboard unchanged)

Checklist

• I have read the Contributing guidelines.
• Docs (README / comments) updated for any user-visible change.
• No secrets, credentials, or internal-only information are included.

[Copilot]

Pull request overview

Aligns public messaging and marketplace submission materials around a non-financial-operations posture.

Changes:

• Removes financial and DeFi examples.
• Adds financial-operation disclaimers and refusal guidance.
• Updates marketplace metadata and submission documentation.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
README.md	Documents the intended non-financial posture.
Cargo.toml	Removes the cryptocurrency category.
crates/imcp2-core/src/tools.rs	Updates tool descriptions and server instructions.
crates/imcp2-core/src/discover.rs	Neutralizes app examples.
src/assets/index.html	Revises landing-page examples and trust messaging.
docs/openai-directory-submission.md	Updates OpenAI compliance guidance.
docs/anthropic-directory-submission.md	Updates Anthropic compliance guidance.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Suppressed comments (1)

docs/anthropic-directory-submission.md:51

• This row is marked as a verified success, but the current code still has only the 17 read-only tools listed in tools.rs:2425-2429; top-up remains destructive at tools.rs:1356-1362. Rebase onto #153 before recording 18 read-only tools as verified, or mark this row pending so the reviewer instructions match the actual tool annotations.

| No catch-all read/write tool; reads and writes are separate tools | ✅ 18 read-only tools with [#153](https://github.com/dfinity/imcp2/pull/153) (incl. the instructions-only top-up); writes split per operation |

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Suppressed comments (2)

docs/anthropic-directory-submission.md:351

• This negative reviewer test does not pass on the current branch: canister_update_call has no icrc1_transfer refusal and will continue to encode and submit the update. The section above conditionally assumes #153/#154 are merged, but these pasted test instructions do not preserve that condition. Rebase after #154 lands before presenting this as intended behavior, or mark the test as pending.

> 5. Financial operations are refused by design: asking the assistant to
>    transfer tokens (e.g. call `icrc1_transfer`) returns a policy message
>    directing the user to a wallet they control — that behavior is intended.

docs/openai-directory-submission.md:120

• The submission record calls these mitigations "shipped," but neither is in this PR's current base: top-up still executes management::top_up_canister, and the generic update handler has no financial-method guard. If this branch is merged first, the compliance record is factually wrong. Make #153/#154 blocking dependencies and rebase after both land, or describe them as pending rather than shipped.

- The attestation "my plugin does not initiate or execute money transfers,
  crypto transfers, or investment trades on behalf of users" is addressed by
  two shipped **mitigations** — not yet grounds to check the box:
  `canister_update_call` refuses the standardized ledger transfer/approval
  methods (ICRC-1/ICRC-2 and related standards, the ICP ledger's legacy
  `transfer`, the cycles ledger's `withdraw` and `create_canister` spends) on
  every canister and says so in its description
  ([#154](https://github.com/dfinity/imcp2/pull/154)), and
  `icp_top_up_canister` is instructions-only and executes nothing
  ([#153](https://github.com/dfinity/imcp2/pull/153)); README, landing page,

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

docs/anthropic-directory-submission.md:351

• “Financial operations are refused” contradicts the two remaining exposures documented above: icp_create_canister still executes the ICP conversion, and bespoke value-moving methods are not caught. Narrow this reviewer test instruction to the behavior the guard actually guarantees.

> 5. Financial operations are refused by design: asking the assistant to
>    transfer tokens (e.g. call `icrc1_transfer`) returns a policy message
>    directing the user to a wallet they control — that behavior is intended.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Suppressed comments (4)

docs/openai-directory-submission.md:149

• The PR description says the submission docs gain a “transfer is refused” negative test, but this revised negative-test list still contains only app resolution, authorization, authentication, and ownership failures. Add a standardized ledger-transfer prompt and its expected policy refusal so the control supporting the attestation is actually exercised during OpenAI review.

Negative:
1. "Open https://<a site with no Internet Computer presence>" → refused by
   the IC-evidence gate with guidance (web-search or ask the user for the
   real URL) rather than resolved to a wrong identity.

docs/anthropic-directory-submission.md:51

• There are now 19 read-only tools, not 18: the annotation regression test lists the previous 17 reads plus both icp_top_up_canister and the newly instructions-only icp_create_canister (tools.rs:2401-2408). This count would give directory reviewers an inaccurate tool inventory.

| No catch-all read/write tool; reads and writes are separate tools | ✅ 18 read-only tools ([#153](https://github.com/dfinity/imcp2/pull/153) merged; incl. the instructions-only top-up); writes split per operation |

docs/anthropic-directory-submission.md:340

• This repeats the unsupported “clean acknowledgment” claim in the submitter checklist. The implementation itself documents that arbitrary bespoke/forwarding methods bypass the name-based guard (compliance.rs:36-49), so canister_update_call can still execute a value-moving update. The checklist must preserve that limitation unless the generic update surface is restricted.

documentation. **Financial transactions** is a clean acknowledgment: no
tool initiates or executes a transfer of the user's funds — financial ledger
methods are refused, and top-up and canister creation are instructions-only.

docs/anthropic-directory-submission.md:319

• The read-only count must be 19 here as well. Both canister creation and top-up are now instructions-only/read-only, and tools.rs:2401-2408 enumerates 19 tools with read_only_hint = true.

>    "Questions only" exercises the 18 read-only-annotated tools; "Actions &
>    questions" additionally allows state-changing calls.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Suppressed comments (4)

docs/anthropic-directory-submission.md:51

• This count is stale. The annotation test’s read-only list contains 19 tools: #153 made icp_top_up_canister read-only, and the current #154-based tree also marks icp_create_canister read-only (tools.rs:2401-2408). Reporting 18 gives directory reviewers an incorrect tool inventory.

| No catch-all read/write tool; reads and writes are separate tools | ✅ 18 read-only tools ([#153](https://github.com/dfinity/imcp2/pull/153) merged; incl. the instructions-only top-up); writes split per operation |

docs/anthropic-directory-submission.md:319

• The current tool annotations expose 19, not 18, read-only tools: both icp_top_up_canister and icp_create_canister are now in the read-only set (tools.rs:2401-2408). The reviewer instructions should match the actual consent-screen inventory.

>    "Questions only" exercises the 18 read-only-annotated tools; "Actions &
>    questions" additionally allows state-changing calls.

docs/anthropic-directory-submission.md:176

• This unconditional attestation is not established by the shipped guard. canister_update_call still executes arbitrary update methods, while compliance.rs:36-49 explicitly says bespoke value-moving methods, forwarding intermediaries, and legacy DIP20/EXT methods remain reachable. This also contradicts the PR description’s promise to keep that caveat on record. Either restrict the generic update tool to a reviewed non-financial allow-list/drop it for the directory profile, or restore the caveat and leave the acknowledgment pending.

**Posture, stated plainly — the black-and-white answer the compliance step
needs:** no tool initiates or executes a transfer of the user's funds.
Financial ledger methods are refused, and the funding operations — top-up and
canister creation — are instructions-only. The financial-transactions
acknowledgment is made on that basis, without qualifications.

docs/openai-directory-submission.md:114

• The claim that no tool can execute a transfer is broader than the implementation. The name-based guard deliberately leaves bespoke value-moving methods, forwarding canisters, and legacy DIP20/EXT methods callable through canister_update_call (compliance.rs:36-49). This also conflicts with the PR description’s stated caveat. Either implement a reviewed non-financial allow-list/drop the generic update tool for this profile, or retain the caveat instead of declaring the attestation satisfied.

- The attestation "my plugin does not initiate or execute money transfers,
  crypto transfers, or investment trades on behalf of users" is satisfied by
  the shipped behavior — check it on that basis: no tool initiates or
  executes a transfer of the user's funds. `canister_update_call` refuses

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Suppressed comments (4)

Previously missed (2) — in code that hasn't changed since the last review.

docs/anthropic-directory-submission.md:136

• This heading says an answer is pending, but lines 178-183 say the topic is resolved and that no open compliance question remains. Use one status consistently so submitters do not treat a resolved item as a blocker.

### 2. Financial-transactions policy (mitigations shipped; answer pending)

docs/openai-directory-submission.md:149

• The angle-bracket placeholder is parsed as an HTML <a ...> tag in Markdown, so the example prompt can disappear or render as malformed markup. Phrase the placeholder as ordinary text instead.

1. "Open https://<a site with no Internet Computer presence>" → refused by
   the IC-evidence gate with guidance (web-search or ask the user for the
   real URL) rather than resolved to a wrong identity.

docs/openai-directory-submission.md:115

• This attestation is not supported by the shipped guard. compliance.rs:38-49 explicitly says the name blocklist is not a hermetic seal and deliberately permits legacy DIP20/EXT transfer/transferFrom/approve calls and bespoke forwarding/swap methods; canister_update_call then executes every unmatched update. An authenticated call can therefore still initiate a transfer from a user's custom-ledger account. A truthful absolute attestation requires removing/restricting the generic update tool (for example, a reviewed non-financial allowlist) or treating financial compliance as unresolved.

- The attestation "my plugin does not initiate or execute money transfers,
  crypto transfers, or investment trades on behalf of users" is satisfied by
  the shipped behavior — check it on that basis: no tool initiates or
  executes a transfer of the user's funds. `canister_update_call` refuses
  the financial ledger methods (ICRC-1/ICRC-2 and the ICRC-4/-7/-37

docs/anthropic-directory-submission.md:176

• The absolute claim that no tool can transfer user funds contradicts the guard's documented limits in compliance.rs:38-49: bespoke methods and legacy DIP20/EXT transfers on arbitrary canisters are deliberately allowed, and canister_update_call executes unmatched methods as the user's app principal. This also explains why line 159 still needs the “standardized” qualifier despite the PR description saying that qualifier was removed. Restrict/remove the generic update tool for the directory profile, or keep this acknowledgment unresolved rather than submitting the absolute claim.

**Posture, stated plainly — the black-and-white answer the compliance step
needs:** no tool initiates or executes a transfer of the user's funds.
Financial ledger methods are refused, and the funding operations — top-up and
canister creation — are instructions-only. The financial-transactions
acknowledgment is made on that basis, without qualifications.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Suppressed comments (1)

docs/anthropic-directory-submission.md:136

• This heading says the financial-transactions answer is pending, but the same section says the acknowledgment is made without qualification and that no open compliance question remains (lines 172–183). Mark it resolved so submitters do not receive contradictory status guidance.

### 2. Financial-transactions policy (mitigations shipped; answer pending)

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Suppressed comments (3)

Previously missed (2) — in code that hasn't changed since the last review.

docs/anthropic-directory-submission.md:159

• The PR description explicitly says the “standardized” qualifier was removed from submission-facing text, but this Anthropic submission still uses it. That weakens the stated black-and-white posture compared with lines 172–176; use the same “financial ledger methods” wording used elsewhere in this document.

- `canister_update_call` **refuses the standardized ledger methods** that

docs/anthropic-directory-submission.md:319

• A Questions-only session cannot exercise all 19 read-only-annotated tools: icp_canister_status is annotated read-only but explicitly requires “Actions & questions” because it uses an IC update call (crates/imcp2-core/src/tools.rs:1400-1402). Calling it under Questions-only is rejected, so the reviewer instructions need to state this exception rather than imply Actions only adds state-changing calls.

>    "Questions only" exercises the 19 read-only-annotated tools; "Actions &
>    questions" additionally allows state-changing calls.

docs/anthropic-directory-submission.md:182

• The submission-day checklist still leaves “Reply received … settling the financial-transactions … acknowledgment” unchecked at line 358, so this new “resolved in code / no open compliance question” status leaves the reviewer guide internally contradictory and does not meet the PR description’s promise of no open follow-up. Remove the financial-transactions portion from that checklist item (leaving the separately documented first-party API follow-up, if still required).

**Status: resolved in code.** An email to <mcp-review@anthropic.com>
(2026-07-31) had asked whether cycles funding and the general-purpose
`canister_update_call` pass review; the changes above made both questions
moot — funding no longer executes at all, and the update tool refuses
financial ledger methods. No open compliance question remains on this topic;