From 127d2080cfe2e28c2adfc5eab7ca79ab965cc480 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 27 Aug 2026 20:47:15 +0000 Subject: [PATCH 1/3] Refresh submission docs against verified production state MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A post-merge audit checked both directory docs against the code at main (0a32373) and against live production. Fixes, all doc-only: - Production gap restated with today's facts: /version reports bbf0844 (v0.1.1), which predates the whole compliance chain (#153-#158) and still serves the old 26-tool surface — a release from current main must be deployed before either submission, since the attestations describe main. - The privacy policy, /support, and /terms are LIVE on production (verified HTTP 200), so the "pending the production release" rows and checklist items now say what actually remains: portal entry, plus the next release refreshing the live text to the current draft. - The mcp-review checklist row contradicted blocker 2's resolved-in-code body and wrongly claimed the first-party-API question was asked on 2026-07-31; it now matches the body. - The listing description claimed "identify what a canister is" — a capability of the unserved dashboard-lookup tool; it now leads with the served Candid fetch. - Stale figures and paths: longest served tool name is 23 chars (get_canister_oql_schema), not 30; the dfinity-logo.svg link and the README's connect.css / static/ paths now point into crates/imcp2-core/ where the files live; "ships with this PR" phrasing updated now that the PR is merged and deployed; the stale cycles-funding justification sentence is dropped (no funding tools exist). Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01LvwAVXfx5kLNc4SqKXkavk --- README.md | 6 ++++-- docs/anthropic-directory-submission.md | 30 +++++++++++++++----------- docs/openai-directory-submission.md | 15 ++++++------- 3 files changed, 28 insertions(+), 23 deletions(-) diff --git a/README.md b/README.md index 0d6bcf1..c7b3df3 100644 --- a/README.md +++ b/README.md @@ -417,7 +417,8 @@ blank — so the endpoint is inert except during a submission window. ## Deploy The deployment binary is **self-contained**: the connect/landing HTML, CSS, and SVG -(`src/assets/`) and the reference docs (`static/`) are compiled in with `include_str!`, +(`src/assets/` and `crates/imcp2-core/src/assets/`) and the reference +docs (`crates/imcp2-core/static/`) are compiled in with `include_str!`, so nothing has to ship next to it (both are build-time inputs only). The only runtime file is the OAuth clients store, which the server always uses: it reads the file on startup and writes it (best-effort) as client registrations change, so @@ -557,7 +558,8 @@ II handshake renders as a **nicely formatted, on-brand screen** — an editorial headline, a best-effort diagnostic ("your client may be out of date; remove and re-add the connector", etc.), and always the line *"If this error is unexpected, please contact mcp@dfinity.org to report it."* — rather than a raw JSON blob. The -shared shell lives in `src/assets/connect-error.html` + `src/assets/connect.css` (reused from +shared shell lives in `src/assets/connect-error.html` + +`crates/imcp2-core/src/assets/connect.css` (reused from the connect callback page: same parchment grid, serif display, foot-of-page "Hosted by" mark, light/dark theming) and is fully self-contained under a strict, nonce'd, non-scripted, unframeable CSP that reflects no request value. Authorize errors diff --git a/docs/anthropic-directory-submission.md b/docs/anthropic-directory-submission.md index df07360..efa04af 100644 --- a/docs/anthropic-directory-submission.md +++ b/docs/anthropic-directory-submission.md @@ -49,7 +49,7 @@ Verified against the live production deployment (2026-07-31): | Discovery documents (RFC 8414 + RFC 9728, path-scoped + root fallback) | ✅ all four live, `WWW-Authenticate` on the 401 points at the resource metadata | | Every tool: `title` + `readOnlyHint`/`destructiveHint` (+ `idempotentHint`, `openWorldHint`) | ✅ on all 11 tools, enforced by a unit test ([`crates/imcp2-core/src/tools.rs`](../crates/imcp2-core/src/tools.rs)) | | No catch-all read/write tool; reads and writes are separate tools | ✅ 10 of the 11 tools are read-only; the one write is `canister_update_call`. | -| Tool names ≤ 64 chars | ✅ longest is 30 | +| Tool names ≤ 64 chars | ✅ longest is 23 (`get_canister_oql_schema`) | | `outputSchema` + structured content on every tool | ✅ enforced by a unit test | | Certificates from a recognized authority | ✅ Let's Encrypt via Caddy | | OAuth endpoint latency ≤ 10 s (discovery/registration/token) | ✅ all sub-second in probes | @@ -127,10 +127,11 @@ server actually does, it should cover at least: Publication venue: `https://mcp.internetcomputer.org/privacy-policy`, served by the MCP server itself. The page and its route shipped in [#112](https://github.com/dfinity/imcp2/pull/112) (effective date August 3, -2026) and the landing page's footer links it, so what remains is the -**production release**: staging serves it now, production at the next -`release-*` tag — cut on or after August 3 so the live page and its stated -effective date agree. Then enter that URL in the portal. The reviewed source +2026), the landing page's footer links it, and the page is live on +production (verified 2026-08-27: HTTP 200). What remains: enter that URL in +the portal, and cut the next `release-*` first — the live text is one +revision behind `main` (the current draft's identifier-linkability wording +lands with that release). The reviewed source text is [`icp-mcp-privacy-policy-draft.md`](icp-mcp-privacy-policy-draft.md). ### 2. Financial-transactions policy (resolved in code) @@ -207,9 +208,12 @@ cycles balance is needed: the connector has no canister-management tools.) ### 4. Production is behind `main` -The live server reports commit `48f1ed6`; `main` carries later hardening -(e.g. #98, #99, #107, #108). Cut a `release-*` tag so the deployment under -review includes them. +The live server reports commit `bbf0844` (v0.1.1, tag +`release-2026-08-18-0.1.1`), which predates the entire compliance chain +(#153, #154, #155, #157, #158): it still serves the old 26-tool surface, +including the funding and management tools this document says do not exist. +Cut a `release-*` tag from current `main` and deploy it BEFORE submitting — +every attestation here describes `main`, not what is currently live. ### 5. Icon asset — ready @@ -226,7 +230,7 @@ both light and dark listing backgrounds. Regenerate with the Chromium rasteriser if the source ever changes (lighter rasterisers mis-render its `linearGradient` with a `rotate` transform). This is the *listing* icon only: the served pages keep using the DFINITY wordmark -([`src/assets/dfinity-logo.svg`](../src/assets/dfinity-logo.svg)) for their +([`crates/imcp2-core/src/assets/dfinity-logo.svg`](../crates/imcp2-core/src/assets/dfinity-logo.svg)) for their "Hosted by" footer. ## Portal field drafts @@ -246,8 +250,8 @@ Paste-and-adapt; portal limits in parentheses. > The official connector between Claude and the Internet Computer, hosted by > DFINITY. Sign in once with Internet Identity — no keys or seed phrases in - > the chat — and Claude can work with the IC directly: identify what a - > canister is, fetch its Candid interface, read app data via typed queries + > the chat — and Claude can work with the IC directly: fetch a canister's + > Candid interface, read app data via typed queries > or OQL, and discover the canisters behind any IC app from its name or URL. > With your consent it can also act as your Internet Identity accounts at a > specific app. Financial transactions are not supported: token-ledger @@ -352,8 +356,8 @@ conversation beyond tool arguments and generates no media. ## Submission-day checklist -- [ ] Dedicated ICP MCP privacy policy live at `https://mcp.internetcomputer.org/privacy-policy` (page + landing-page link merged; needs the production release) and entered in the portal (blocker 1) -- [ ] Reply received from mcp-review@anthropic.com settling the financial-transactions and first-party-API acknowledgments (asked 2026-07-31; blocker 2) +- [ ] Privacy policy entered in the portal — the page is already live at `https://mcp.internetcomputer.org/privacy-policy` (verified 2026-08-27); the next `release-*` refreshes its text to the current draft (blocker 1) +- [x] Financial-transactions question resolved in code (blocker 2) — no mcp-review reply is needed; if one arrives, answer with the shipped posture. The first-party-API/data-handling question was NOT in the 2026-07-31 email: raise it with mcp-review only if the portal's data-handling options don't fit - [x] Reviewer access settled: self-serve Internet Identity, instructions in the test-credentials field (blocker 3) — if a reviewer asks for a populated account, provision a demo-app account (no funding needed: there are no funding or canister-management tools) - [ ] `release-*` tag cut; `/version` on production shows the intended commit (blocker 4) - [x] Square PNG icon exported — `docs/assets/icp-logo-{1024,512}.png` (blocker 5) diff --git a/docs/openai-directory-submission.md b/docs/openai-directory-submission.md index ff01bde..863d52c 100644 --- a/docs/openai-directory-submission.md +++ b/docs/openai-directory-submission.md @@ -57,9 +57,9 @@ add details not published in the docs. | Tools explicitly annotated `readOnlyHint` / `destructiveHint` / `openWorldHint` — "incorrect or missing action labels are a common cause of rejection" | ✅ set on all 11 tools. The unit test enforces annotation presence and the `readOnlyHint`/`destructiveHint` values; `openWorldHint` is declared everywhere but not asserted by the test, so re-check it in the portal's Scan Tools step | | Tool names "human-readable, specific, and descriptive"; accurate descriptions; minimum-information requests | ✅ reviewed against the same bar for the Anthropic listing | | Public HTTPS production endpoint, stable and complete ("trial or demo plugins will not be accepted") | ✅ production deployment | -| Privacy policy disclosing "categories of personal data collected, purposes of use, categories of recipients, data retention timelines" | ⏳ **pending the production release**: the rewritten policy matches these four required disclosures exactly and is live on staging, but `https://mcp.internetcomputer.org/privacy-policy` serves nothing until the next `release-*` tag ships it (see the checklist) | -| Customer support contact (OpenAI asks for a URL) | ✅ `https://mcp.internetcomputer.org/support` — ships with this PR (live at the next release); routes users to , the status dashboard, id.ai access management, GitHub issues, and the security policy | -| Terms of Service URL | ✅ `https://mcp.internetcomputer.org/terms` — ships with this PR (live at the next release); Swiss-law terms covering the non-custodial model, user responsibility for authorized actions, irreversibility of network actions, as-is/liability limits with the Art. 100 CO carve-out. Needs the same legal pass as the privacy policy | +| Privacy policy disclosing "categories of personal data collected, purposes of use, categories of recipients, data retention timelines" | ✅ the rewritten policy matches these four required disclosures exactly and `https://mcp.internetcomputer.org/privacy-policy` is live (verified 2026-08-27); the next `release-*` refreshes its text to the current draft | +| Customer support contact (OpenAI asks for a URL) | ✅ `https://mcp.internetcomputer.org/support` — merged and live on production; routes users to , the status dashboard, id.ai access management, GitHub issues, and the security policy | +| Terms of Service URL | ✅ `https://mcp.internetcomputer.org/terms` — merged and live on production; Swiss-law terms covering the non-custodial model, user responsibility for authorized actions, irreversibility of network actions, as-is/liability limits with the Art. 100 CO carve-out. Needs the same legal pass as the privacy policy | | Logo | ✅ [`docs/assets/icp-logo-1024.png`](assets/icp-logo-1024.png) | Note the legacy redirect `chatgpt.com/connector_platform_oauth_redirect` is @@ -75,7 +75,7 @@ if a reviewer reports a failure. The portal requires proving control of the host: an endpoint at `https:///.well-known/openai-apps-challenge` must return **only** the verification token revealed during submission ("do not return JSON, a list of -tokens, or multiple tokens"). The route ships with this PR: it serves +tokens, or multiple tokens"). The route is merged and deployed: it serves `$OPENAI_APPS_CHALLENGE_TOKEN` verbatim as `text/plain` (trimmed, so unit-file whitespace can't break OpenAI's exact-match check) and 404s while the variable is unset, so it is inert until a submission is in flight. When the portal @@ -106,8 +106,7 @@ financial-transfers prohibition: - Prohibited: "Crypto or NFT offerings involving **speculation, consumer deception**". IMCP2 offers no speculation product — no trading, prices, or - markets. Cycles funding is metered compute credit for the user's own - canisters. + markets. - Commerce rules ("only for physical goods", no digital-goods selling, no embedded checkout) govern *selling through the app*; IMCP2 sells nothing. - The attestation "my plugin does not initiate or execute money transfers, @@ -177,8 +176,8 @@ Negative: - [ ] OpenAI Platform organization verified (business verification) - [ ] Submitter holds the Apps Management write permission -- [ ] Repository secret `OPENAI_APPS_CHALLENGE_TOKEN` set to the portal's token and deployed; `curl https://mcp.internetcomputer.org/.well-known/openai-apps-challenge` returns exactly the token (blocker 1 — the route itself ships with this PR) -- [ ] Privacy policy live at `https://mcp.internetcomputer.org/privacy-policy` (same release as the Anthropic listing needs) +- [ ] Repository secret `OPENAI_APPS_CHALLENGE_TOKEN` set to the portal's token and deployed; `curl https://mcp.internetcomputer.org/.well-known/openai-apps-challenge` returns exactly the token (blocker 1 — the route is merged and deployed; it 404s until the variable is set, by design) +- [x] Privacy policy live at `https://mcp.internetcomputer.org/privacy-policy` (verified 2026-08-27; the next release refreshes its text to the current draft) - [ ] Tools re-scanned in the portal after any server change; annotations verified in the scan - [ ] 5+ positive and 3+ negative test cases entered, verified on web and mobile - [ ] Starter prompts entered; country availability chosen From 28dafe15d9b64bd1ca66830a03fdd008fb1b2d73 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 28 Aug 2026 09:09:42 +0000 Subject: [PATCH 2/3] Distinguish main from the live build; gate OpenAI submission on /version MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review findings on #161: the tool-name-length row now gives both values (23 on main, the build to submit; 30 on the live pre-release build), and the OpenAI checklist gains an explicit item requiring production to run a release cut from current main, verified via /version immediately before submitting — the deploy workflow also accepts older tags/SHAs for rollbacks, so a deployed challenge token alone does not prove the compliant build is live. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01LvwAVXfx5kLNc4SqKXkavk --- docs/anthropic-directory-submission.md | 2 +- docs/openai-directory-submission.md | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/anthropic-directory-submission.md b/docs/anthropic-directory-submission.md index efa04af..8da432e 100644 --- a/docs/anthropic-directory-submission.md +++ b/docs/anthropic-directory-submission.md @@ -49,7 +49,7 @@ Verified against the live production deployment (2026-07-31): | Discovery documents (RFC 8414 + RFC 9728, path-scoped + root fallback) | ✅ all four live, `WWW-Authenticate` on the 401 points at the resource metadata | | Every tool: `title` + `readOnlyHint`/`destructiveHint` (+ `idempotentHint`, `openWorldHint`) | ✅ on all 11 tools, enforced by a unit test ([`crates/imcp2-core/src/tools.rs`](../crates/imcp2-core/src/tools.rs)) | | No catch-all read/write tool; reads and writes are separate tools | ✅ 10 of the 11 tools are read-only; the one write is `canister_update_call`. | -| Tool names ≤ 64 chars | ✅ longest is 23 (`get_canister_oql_schema`) | +| Tool names ≤ 64 chars | ✅ longest on `main` (the build to submit) is 23 (`get_canister_oql_schema`); the live pre-release build's longest is 30 — both within the limit | | `outputSchema` + structured content on every tool | ✅ enforced by a unit test | | Certificates from a recognized authority | ✅ Let's Encrypt via Caddy | | OAuth endpoint latency ≤ 10 s (discovery/registration/token) | ✅ all sub-second in probes | diff --git a/docs/openai-directory-submission.md b/docs/openai-directory-submission.md index 863d52c..b7b8a0a 100644 --- a/docs/openai-directory-submission.md +++ b/docs/openai-directory-submission.md @@ -176,6 +176,7 @@ Negative: - [ ] OpenAI Platform organization verified (business verification) - [ ] Submitter holds the Apps Management write permission +- [ ] Production runs a release cut from current `main`: `curl https://mcp.internetcomputer.org/version` reports a commit that contains #153–#158 — verify immediately before submitting, since the deploy workflow also accepts older tags/SHAs (rollbacks), so a deployed challenge token alone does not prove the compliant build is live - [ ] Repository secret `OPENAI_APPS_CHALLENGE_TOKEN` set to the portal's token and deployed; `curl https://mcp.internetcomputer.org/.well-known/openai-apps-challenge` returns exactly the token (blocker 1 — the route is merged and deployed; it 404s until the variable is set, by design) - [x] Privacy policy live at `https://mcp.internetcomputer.org/privacy-policy` (verified 2026-08-27; the next release refreshes its text to the current draft) - [ ] Tools re-scanned in the portal after any server change; annotations verified in the scan From 7d4e8b105c1c8d6733458f3fdccd9771686e8c95 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 28 Aug 2026 09:13:02 +0000 Subject: [PATCH 3/3] Scope the readiness table's verification claim Review finding on #161: the table header claimed live verification for every row, but the tool-surface rows (11 tools, one write, name lengths, schemas) describe main, not the pre-release build production currently runs. The header now says which rows were verified live (transport/auth, 2026-07-31) and that the tool-surface rows describe main pending the release, with a pointer to re-verify after deploying. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01LvwAVXfx5kLNc4SqKXkavk --- docs/anthropic-directory-submission.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/anthropic-directory-submission.md b/docs/anthropic-directory-submission.md index 8da432e..273cee2 100644 --- a/docs/anthropic-directory-submission.md +++ b/docs/anthropic-directory-submission.md @@ -37,7 +37,11 @@ details (e.g. exact icon dimensions) not published in the docs. ## Readiness: requirements already met -Verified against the live production deployment (2026-07-31): +Transport and auth rows were verified against the live production +deployment (2026-07-31). The tool-surface rows (annotations, counts, names, +schemas) describe `main` — the build the next release deploys and the one +under submission; the live pre-release build still serves the old surface +(see blocker 4), so re-verify them against production after that release: | Requirement | Status | |---|---|