diff --git a/README.md b/README.md index 0d6bcf1..c7b3df3 100644 --- a/README.md +++ b/README.md @@ -417,7 +417,8 @@ blank — so the endpoint is inert except during a submission window. ## Deploy The deployment binary is **self-contained**: the connect/landing HTML, CSS, and SVG -(`src/assets/`) and the reference docs (`static/`) are compiled in with `include_str!`, +(`src/assets/` and `crates/imcp2-core/src/assets/`) and the reference +docs (`crates/imcp2-core/static/`) are compiled in with `include_str!`, so nothing has to ship next to it (both are build-time inputs only). The only runtime file is the OAuth clients store, which the server always uses: it reads the file on startup and writes it (best-effort) as client registrations change, so @@ -557,7 +558,8 @@ II handshake renders as a **nicely formatted, on-brand screen** — an editorial headline, a best-effort diagnostic ("your client may be out of date; remove and re-add the connector", etc.), and always the line *"If this error is unexpected, please contact mcp@dfinity.org to report it."* — rather than a raw JSON blob. The -shared shell lives in `src/assets/connect-error.html` + `src/assets/connect.css` (reused from +shared shell lives in `src/assets/connect-error.html` + +`crates/imcp2-core/src/assets/connect.css` (reused from the connect callback page: same parchment grid, serif display, foot-of-page "Hosted by" mark, light/dark theming) and is fully self-contained under a strict, nonce'd, non-scripted, unframeable CSP that reflects no request value. Authorize errors diff --git a/docs/anthropic-directory-submission.md b/docs/anthropic-directory-submission.md index df07360..273cee2 100644 --- a/docs/anthropic-directory-submission.md +++ b/docs/anthropic-directory-submission.md @@ -37,7 +37,11 @@ details (e.g. exact icon dimensions) not published in the docs. ## Readiness: requirements already met -Verified against the live production deployment (2026-07-31): +Transport and auth rows were verified against the live production +deployment (2026-07-31). The tool-surface rows (annotations, counts, names, +schemas) describe `main` — the build the next release deploys and the one +under submission; the live pre-release build still serves the old surface +(see blocker 4), so re-verify them against production after that release: | Requirement | Status | |---|---| @@ -49,7 +53,7 @@ Verified against the live production deployment (2026-07-31): | Discovery documents (RFC 8414 + RFC 9728, path-scoped + root fallback) | ✅ all four live, `WWW-Authenticate` on the 401 points at the resource metadata | | Every tool: `title` + `readOnlyHint`/`destructiveHint` (+ `idempotentHint`, `openWorldHint`) | ✅ on all 11 tools, enforced by a unit test ([`crates/imcp2-core/src/tools.rs`](../crates/imcp2-core/src/tools.rs)) | | No catch-all read/write tool; reads and writes are separate tools | ✅ 10 of the 11 tools are read-only; the one write is `canister_update_call`. | -| Tool names ≤ 64 chars | ✅ longest is 30 | +| Tool names ≤ 64 chars | ✅ longest on `main` (the build to submit) is 23 (`get_canister_oql_schema`); the live pre-release build's longest is 30 — both within the limit | | `outputSchema` + structured content on every tool | ✅ enforced by a unit test | | Certificates from a recognized authority | ✅ Let's Encrypt via Caddy | | OAuth endpoint latency ≤ 10 s (discovery/registration/token) | ✅ all sub-second in probes | @@ -127,10 +131,11 @@ server actually does, it should cover at least: Publication venue: `https://mcp.internetcomputer.org/privacy-policy`, served by the MCP server itself. The page and its route shipped in [#112](https://github.com/dfinity/imcp2/pull/112) (effective date August 3, -2026) and the landing page's footer links it, so what remains is the -**production release**: staging serves it now, production at the next -`release-*` tag — cut on or after August 3 so the live page and its stated -effective date agree. Then enter that URL in the portal. The reviewed source +2026), the landing page's footer links it, and the page is live on +production (verified 2026-08-27: HTTP 200). What remains: enter that URL in +the portal, and cut the next `release-*` first — the live text is one +revision behind `main` (the current draft's identifier-linkability wording +lands with that release). The reviewed source text is [`icp-mcp-privacy-policy-draft.md`](icp-mcp-privacy-policy-draft.md). ### 2. Financial-transactions policy (resolved in code) @@ -207,9 +212,12 @@ cycles balance is needed: the connector has no canister-management tools.) ### 4. Production is behind `main` -The live server reports commit `48f1ed6`; `main` carries later hardening -(e.g. #98, #99, #107, #108). Cut a `release-*` tag so the deployment under -review includes them. +The live server reports commit `bbf0844` (v0.1.1, tag +`release-2026-08-18-0.1.1`), which predates the entire compliance chain +(#153, #154, #155, #157, #158): it still serves the old 26-tool surface, +including the funding and management tools this document says do not exist. +Cut a `release-*` tag from current `main` and deploy it BEFORE submitting — +every attestation here describes `main`, not what is currently live. ### 5. Icon asset — ready @@ -226,7 +234,7 @@ both light and dark listing backgrounds. Regenerate with the Chromium rasteriser if the source ever changes (lighter rasterisers mis-render its `linearGradient` with a `rotate` transform). This is the *listing* icon only: the served pages keep using the DFINITY wordmark -([`src/assets/dfinity-logo.svg`](../src/assets/dfinity-logo.svg)) for their +([`crates/imcp2-core/src/assets/dfinity-logo.svg`](../crates/imcp2-core/src/assets/dfinity-logo.svg)) for their "Hosted by" footer. ## Portal field drafts @@ -246,8 +254,8 @@ Paste-and-adapt; portal limits in parentheses. > The official connector between Claude and the Internet Computer, hosted by > DFINITY. Sign in once with Internet Identity — no keys or seed phrases in - > the chat — and Claude can work with the IC directly: identify what a - > canister is, fetch its Candid interface, read app data via typed queries + > the chat — and Claude can work with the IC directly: fetch a canister's + > Candid interface, read app data via typed queries > or OQL, and discover the canisters behind any IC app from its name or URL. > With your consent it can also act as your Internet Identity accounts at a > specific app. Financial transactions are not supported: token-ledger @@ -352,8 +360,8 @@ conversation beyond tool arguments and generates no media. ## Submission-day checklist -- [ ] Dedicated ICP MCP privacy policy live at `https://mcp.internetcomputer.org/privacy-policy` (page + landing-page link merged; needs the production release) and entered in the portal (blocker 1) -- [ ] Reply received from mcp-review@anthropic.com settling the financial-transactions and first-party-API acknowledgments (asked 2026-07-31; blocker 2) +- [ ] Privacy policy entered in the portal — the page is already live at `https://mcp.internetcomputer.org/privacy-policy` (verified 2026-08-27); the next `release-*` refreshes its text to the current draft (blocker 1) +- [x] Financial-transactions question resolved in code (blocker 2) — no mcp-review reply is needed; if one arrives, answer with the shipped posture. The first-party-API/data-handling question was NOT in the 2026-07-31 email: raise it with mcp-review only if the portal's data-handling options don't fit - [x] Reviewer access settled: self-serve Internet Identity, instructions in the test-credentials field (blocker 3) — if a reviewer asks for a populated account, provision a demo-app account (no funding needed: there are no funding or canister-management tools) - [ ] `release-*` tag cut; `/version` on production shows the intended commit (blocker 4) - [x] Square PNG icon exported — `docs/assets/icp-logo-{1024,512}.png` (blocker 5) diff --git a/docs/openai-directory-submission.md b/docs/openai-directory-submission.md index ff01bde..b7b8a0a 100644 --- a/docs/openai-directory-submission.md +++ b/docs/openai-directory-submission.md @@ -57,9 +57,9 @@ add details not published in the docs. | Tools explicitly annotated `readOnlyHint` / `destructiveHint` / `openWorldHint` — "incorrect or missing action labels are a common cause of rejection" | ✅ set on all 11 tools. The unit test enforces annotation presence and the `readOnlyHint`/`destructiveHint` values; `openWorldHint` is declared everywhere but not asserted by the test, so re-check it in the portal's Scan Tools step | | Tool names "human-readable, specific, and descriptive"; accurate descriptions; minimum-information requests | ✅ reviewed against the same bar for the Anthropic listing | | Public HTTPS production endpoint, stable and complete ("trial or demo plugins will not be accepted") | ✅ production deployment | -| Privacy policy disclosing "categories of personal data collected, purposes of use, categories of recipients, data retention timelines" | ⏳ **pending the production release**: the rewritten policy matches these four required disclosures exactly and is live on staging, but `https://mcp.internetcomputer.org/privacy-policy` serves nothing until the next `release-*` tag ships it (see the checklist) | -| Customer support contact (OpenAI asks for a URL) | ✅ `https://mcp.internetcomputer.org/support` — ships with this PR (live at the next release); routes users to , the status dashboard, id.ai access management, GitHub issues, and the security policy | -| Terms of Service URL | ✅ `https://mcp.internetcomputer.org/terms` — ships with this PR (live at the next release); Swiss-law terms covering the non-custodial model, user responsibility for authorized actions, irreversibility of network actions, as-is/liability limits with the Art. 100 CO carve-out. Needs the same legal pass as the privacy policy | +| Privacy policy disclosing "categories of personal data collected, purposes of use, categories of recipients, data retention timelines" | ✅ the rewritten policy matches these four required disclosures exactly and `https://mcp.internetcomputer.org/privacy-policy` is live (verified 2026-08-27); the next `release-*` refreshes its text to the current draft | +| Customer support contact (OpenAI asks for a URL) | ✅ `https://mcp.internetcomputer.org/support` — merged and live on production; routes users to , the status dashboard, id.ai access management, GitHub issues, and the security policy | +| Terms of Service URL | ✅ `https://mcp.internetcomputer.org/terms` — merged and live on production; Swiss-law terms covering the non-custodial model, user responsibility for authorized actions, irreversibility of network actions, as-is/liability limits with the Art. 100 CO carve-out. Needs the same legal pass as the privacy policy | | Logo | ✅ [`docs/assets/icp-logo-1024.png`](assets/icp-logo-1024.png) | Note the legacy redirect `chatgpt.com/connector_platform_oauth_redirect` is @@ -75,7 +75,7 @@ if a reviewer reports a failure. The portal requires proving control of the host: an endpoint at `https:///.well-known/openai-apps-challenge` must return **only** the verification token revealed during submission ("do not return JSON, a list of -tokens, or multiple tokens"). The route ships with this PR: it serves +tokens, or multiple tokens"). The route is merged and deployed: it serves `$OPENAI_APPS_CHALLENGE_TOKEN` verbatim as `text/plain` (trimmed, so unit-file whitespace can't break OpenAI's exact-match check) and 404s while the variable is unset, so it is inert until a submission is in flight. When the portal @@ -106,8 +106,7 @@ financial-transfers prohibition: - Prohibited: "Crypto or NFT offerings involving **speculation, consumer deception**". IMCP2 offers no speculation product — no trading, prices, or - markets. Cycles funding is metered compute credit for the user's own - canisters. + markets. - Commerce rules ("only for physical goods", no digital-goods selling, no embedded checkout) govern *selling through the app*; IMCP2 sells nothing. - The attestation "my plugin does not initiate or execute money transfers, @@ -177,8 +176,9 @@ Negative: - [ ] OpenAI Platform organization verified (business verification) - [ ] Submitter holds the Apps Management write permission -- [ ] Repository secret `OPENAI_APPS_CHALLENGE_TOKEN` set to the portal's token and deployed; `curl https://mcp.internetcomputer.org/.well-known/openai-apps-challenge` returns exactly the token (blocker 1 — the route itself ships with this PR) -- [ ] Privacy policy live at `https://mcp.internetcomputer.org/privacy-policy` (same release as the Anthropic listing needs) +- [ ] Production runs a release cut from current `main`: `curl https://mcp.internetcomputer.org/version` reports a commit that contains #153–#158 — verify immediately before submitting, since the deploy workflow also accepts older tags/SHAs (rollbacks), so a deployed challenge token alone does not prove the compliant build is live +- [ ] Repository secret `OPENAI_APPS_CHALLENGE_TOKEN` set to the portal's token and deployed; `curl https://mcp.internetcomputer.org/.well-known/openai-apps-challenge` returns exactly the token (blocker 1 — the route is merged and deployed; it 404s until the variable is set, by design) +- [x] Privacy policy live at `https://mcp.internetcomputer.org/privacy-policy` (verified 2026-08-27; the next release refreshes its text to the current draft) - [ ] Tools re-scanned in the portal after any server change; annotations verified in the scan - [ ] 5+ positive and 3+ negative test cases entered, verified on web and mobile - [ ] Starter prompts entered; country availability chosen