From abcf78787edcbf797451a8af770c8f68359f9889 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 26 Oct 2026 10:45:07 +0000 Subject: [PATCH 1/5] Bring the Anthropic directory doc up to the current connector docs and record where the submission stands The doc still described the portal, the submitter requirement and the review model as they were on 2026-07-31. Re-verified against the official pages on 2026-10-23: the portal is now claude.ai/directory/manage, anyone on a paid Claude plan can submit, the status model for MCP connectors is Draft / In review / Changes requested / Not approved / Approved / Published (editing an Approved listing before publication returns it to Draft), a Verified review runs a functional test of each tool, and escalations to mcp-review should name the listing, the submitting organization and the status the portal shows. The test-credentials criterion is quoted in its current wording. A new "Submission log" near the top records the state: submitted 2026-09-28 as "Internet Computer" (slug internet-computer), In review since with no reviewer feedback as of 2026-10-23; the 2026-07-31 pre-submission email got only an automated acknowledgement (ticket #120537913) and its question is moot now that the funding tools are gone and ledger methods are refused; and the submission date fell inside the 2026-09-25 to 2026-10-01 OAuth disruption from the DCR-to-CIMD migration, so a reviewer who tried in that window would have failed at sign-in (the fix is live). The submission-day checklist ticks the privacy policy (entered) and the release cut (crates at 0.5.1, v0.5.1 tagged, rc/v scheme from #204 in place); the submitter item now states the paid-plan requirement. Sections that were still accurate are untouched. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Ui6YJGczXE8vZv2pjyxX2F --- docs/anthropic-directory-submission.md | 77 +++++++++++++++++++------- 1 file changed, 57 insertions(+), 20 deletions(-) diff --git a/docs/anthropic-directory-submission.md b/docs/anthropic-directory-submission.md index 1a918ae..be2f50a 100644 --- a/docs/anthropic-directory-submission.md +++ b/docs/anthropic-directory-submission.md @@ -6,8 +6,10 @@ the catalog that serves Claude.ai, Claude Desktop, Claude Mobile, Cowork, and Claude Code. Field drafts below are pre-filled from this repo and the live deployment; paste and adapt them in the portal. -Verified against the official docs on **2026-07-31**. The portal UI may add -details (e.g. exact icon dimensions) not published in the docs. +Verified against the official docs on **2026-10-23** (first written against +their 2026-07-31 versions; the portal, submitter and review-status facts +below are from the current pages). The portal UI may add details (e.g. exact +icon dimensions) not published in the docs. > **Server-state claims re-verified 2026-09-01.** Tool-surface numbers below > were regenerated from a live scan of a deployed instance of the current @@ -19,14 +21,37 @@ details (e.g. exact icon dimensions) not published in the docs. > through, but `/version` and `/status/` answer with a redirect at that edge — > the rows and steps below that relied on them say so inline. +## Submission log + +- **2026-09-28 — submitted** as **"Internet Computer"** (slug + `internet-computer`). Status **In review** ever since; no reviewer feedback + as of 2026-10-23. In the status model below, *In review* means a person is + checking the listing and the next move is Anthropic's — nothing is owed + from our side until the status changes or mcp-review writes. +- **The submission date fell inside an OAuth disruption** (2026-09-25 to + 2026-10-01) caused by the DCR-to-CIMD migration (CIMD became the default + registration mode in [#203](https://github.com/dfinity/imcp2/pull/203), + merged 2026-09-24): a user reported DCR failing with HTTP 400 "redirect URI + not permitted" on 2026-09-25, and OpenAI's reviewer could not complete the + sign-in flow on 2026-10-01. A reviewer who tried the connector in that + window would have failed at sign-in. The fix is live. If feedback cites a + sign-in failure, answer with this timeline and ask for a re-test. +- **2026-07-31 — pre-submission email** to , asking + ahead about the financial-transactions acknowledgment, got an automated + acknowledgement (ticket #120537913, from directory@mail.anthropic.com) and + no human reply. The question it asked is now moot: the funding tools it + described were removed and ledger methods are refused (blocker 2 below). +- **If the status does not move:** escalate to + with the listing name, the submitting organization, and the status the + portal shows — the channel and the three details the status doc asks for. + ## Where and how submission happens -- **Portal:** - (status/feedback afterwards at - ). -- **Who can submit:** an **Owner** (or, on Enterprise, a custom role with the - *Directory management* permission) of a Claude **Team or Enterprise - organization**. There is no submission path for individual plans. +- **Portal:** — the same page shows + each listing's status and reviewer feedback afterwards. +- **Who can submit:** anyone on a **paid Claude plan**, through the portal. + (The docs no longer restrict submission to an Owner of a Team or Enterprise + organization.) - **Governing documents:** [Anthropic Software Directory Policy](https://support.claude.com/en/articles/13145358) (effective 2026-04-15) and @@ -35,11 +60,19 @@ details (e.g. exact icon dimensions) not published in the docs. - **Process docs:** [Submission](https://claude.com/docs/connectors/building/submission), [Review criteria](https://claude.com/docs/connectors/building/review-criteria), - [Authentication](https://claude.com/docs/connectors/building/authentication). + [Authentication](https://claude.com/docs/connectors/building/authentication), + [Submission status](https://claude.com/docs/directory/submission-status). - **Review:** automated policy scan first, then listing as a *Community* - connector; Anthropic may escalate to a human *Verified* review on its own. - No published SLA ("review times vary with queue volume"). Escalations and - special requests: . + connector; Anthropic may escalate to a human *Verified* review on its own, + in which reviewers run a functional test of each tool. No published SLA + ("review times vary with queue volume"). Escalations and special requests: + — include the listing name, the submitting + organization, and the status the portal shows. +- **Listing status** (MCP connectors): *Draft*, *In review*, *Changes + requested*, *Not approved*, *Approved*, *Published*. *In review* means a + person is checking the listing and Anthropic acts next. Editing an + *Approved* listing before it is published returns it to *Draft* for another + review — so leave the listing alone once approved until it is published. - **Not required:** listing in the open MCP Registry (registry.modelcontextprotocol.io) — the directory docs state its domain-ownership proof "applies only to the open MCP Registry, not the @@ -150,7 +183,8 @@ current draft: the identifier-linkability wording and the updated third-party list). The MCP server no longer serves a copy: `https://mcp.internetcomputer.org/privacy-policy` answers with a permanent redirect to that home ([#165](https://github.com/dfinity/imcp2/pull/165); the -gateway front redirects it as well). Enter the canonical URL in the portal. +gateway front redirects it as well). The canonical URL is the one entered in +the portal (submission of 2026-09-28). The reviewed source text is [`icp-mcp-privacy-policy-draft.md`](icp-mcp-privacy-policy-draft.md). @@ -207,8 +241,10 @@ financial-transactions acknowledgment is made on that basis, without qualifications. **mcp-review thread:** an email to (2026-07-31) -asked ahead about this acknowledgment. No reply is needed to submit; if one -arrives, answer with the posture above. +asked ahead about this acknowledgment. It got an automated acknowledgement +(ticket #120537913) and no human reply, and the question it asked is moot — +the funding tools it described are gone (see the submission log). No reply +was needed to submit; if one arrives, answer with the posture above. Related point for the same step: the **model-readable metadata describes the surface and the constraints on using it, without attempting to manipulate @@ -254,8 +290,9 @@ device-bound, so a "shared account" would mean circulating a recovery phrase, and every read-only tool works against public network state, so a freshly-created identity exercises the bulk of the surface within a minute. -One tension to be ready for: the review criteria say *"Test credentials are -required and must be a fully populated account."* Self-serve sign-up is a +One tension to be ready for: the review criteria say *"Test credentials: +required, and they must be for a fully populated account,"* and a *Verified* +review runs a functional test of each tool. Self-serve sign-up is a reasonable answer for an authentication system nobody can pre-provision into, but a reviewer may still ask for a populated account — most plausibly to exercise `canister_update_call` against an app where the identity has data. @@ -432,10 +469,10 @@ conversation beyond tool arguments and generates no media. ## Submission-day checklist -- [ ] Privacy policy entered in the portal — enter `https://internetcomputer.org/icp-mcp/privacy-policy/`, the page's one home (live; the old mcp.internetcomputer.org URL permanently redirects there) (blocker 1) +- [x] Privacy policy entered in the portal — `https://internetcomputer.org/icp-mcp/privacy-policy/`, the page's one home (live; the old mcp.internetcomputer.org URL permanently redirects there) (blocker 1) - [x] Financial-transactions acknowledgment is a clean yes (blocker 2): the server does not support financial transactions. No mcp-review reply is needed; if one arrives, answer with the stated posture. The first-party-API/data-handling question was NOT in the 2026-07-31 email: raise it with mcp-review only if the portal's data-handling options don't fit - [x] Reviewer access settled: self-serve Internet Identity, instructions in the test-credentials field (blocker 3) — if a reviewer asks for a populated account, provision a demo-app account (no funding needed: there are no funding or canister-management tools) -- [ ] `vX.Y.Z` release cut (promoted from a staging candidate) and picked up by the gateway; production confirmed to run the intended commit by the operators — externally `/version` is cut off by the gateway front, so the check is on-host or via the deploy workflow's record (blocker 4) +- [x] `vX.Y.Z` release cut: the crates are at `0.5.1` (`v0.5.1` tagged), under the `rc-X.Y.Z-N` → `vX.Y.Z` scheme from [#204](https://github.com/dfinity/imcp2/pull/204) (an `rc-*` tag deploys the candidate to staging, the matching `v*` tag publishes the crates; production embeds the published crate). Externally `/version` is still cut off by the gateway front, so which commit production runs is checked on-host or via the deploy workflow's record (blocker 4) - [x] Square PNG icon exported — `docs/assets/icp-logo-{1024,512}.png` (blocker 5) - [ ] Every tool exercised once by the submitter (portal asks you to confirm this; MCP Inspector or a custom connector in Claude both count) -- [ ] Submitter has Owner / Directory-management access in DFINITY's Claude Team/Enterprise org +- [ ] Submitter is on a paid Claude plan (the docs no longer require an Owner of a Team/Enterprise org); follow-ups and escalations go from the same submitting organization the listing was filed under From 82fdf063ad5355e495dd139e84fdf22a7a5a930c Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 28 Oct 2026 09:43:11 +0000 Subject: [PATCH 2/5] Say that 0.5.1 predates the candidate scheme rather than passed through it The checklist's release-cut item described v0.5.1 as released under the rc-*/v* promotion from #204. The tag sits on the 0.5.1 bump (#205), which merged before #204, and #204 names 0.6.0 as the first release cut under the scheme, so 0.5.1 passed no staging-candidate gate. The item now says so and keeps the scheme as what applies from 0.6.0 on. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Ui6YJGczXE8vZv2pjyxX2F --- docs/anthropic-directory-submission.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/anthropic-directory-submission.md b/docs/anthropic-directory-submission.md index be2f50a..2386ac7 100644 --- a/docs/anthropic-directory-submission.md +++ b/docs/anthropic-directory-submission.md @@ -472,7 +472,7 @@ conversation beyond tool arguments and generates no media. - [x] Privacy policy entered in the portal — `https://internetcomputer.org/icp-mcp/privacy-policy/`, the page's one home (live; the old mcp.internetcomputer.org URL permanently redirects there) (blocker 1) - [x] Financial-transactions acknowledgment is a clean yes (blocker 2): the server does not support financial transactions. No mcp-review reply is needed; if one arrives, answer with the stated posture. The first-party-API/data-handling question was NOT in the 2026-07-31 email: raise it with mcp-review only if the portal's data-handling options don't fit - [x] Reviewer access settled: self-serve Internet Identity, instructions in the test-credentials field (blocker 3) — if a reviewer asks for a populated account, provision a demo-app account (no funding needed: there are no funding or canister-management tools) -- [x] `vX.Y.Z` release cut: the crates are at `0.5.1` (`v0.5.1` tagged), under the `rc-X.Y.Z-N` → `vX.Y.Z` scheme from [#204](https://github.com/dfinity/imcp2/pull/204) (an `rc-*` tag deploys the candidate to staging, the matching `v*` tag publishes the crates; production embeds the published crate). Externally `/version` is still cut off by the gateway front, so which commit production runs is checked on-host or via the deploy workflow's record (blocker 4) +- [x] `vX.Y.Z` release cut: the crates are at `0.5.1` and `v0.5.1` is tagged — cut on 2026-09-24, before the candidate scheme landed, so it passed no staging-candidate gate. From 0.6.0 on, releases follow the `rc-X.Y.Z-N` → `vX.Y.Z` promotion from [#204](https://github.com/dfinity/imcp2/pull/204) (an `rc-*` tag deploys the candidate to staging, the matching `v*` tag publishes the crates; production embeds the published crate). Externally `/version` is still cut off by the gateway front, so which commit production runs is checked on-host or via the deploy workflow's record (blocker 4) - [x] Square PNG icon exported — `docs/assets/icp-logo-{1024,512}.png` (blocker 5) - [ ] Every tool exercised once by the submitter (portal asks you to confirm this; MCP Inspector or a custom connector in Claude both count) - [ ] Submitter is on a paid Claude plan (the docs no longer require an Owner of a Team/Enterprise org); follow-ups and escalations go from the same submitting organization the listing was filed under From 1178ed0f488ba175e1559aed88dea584c76887da Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 28 Oct 2026 10:37:19 +0000 Subject: [PATCH 3/5] Log the OAuth disruption that overlapped the directory submission The submission log on main records the 2026-07-31 email and the 2026-09-28 submission but not that the submission date fell inside the 2026-09-25 to 2026-10-01 OAuth disruption from the DCR-to-CIMD migration (a user reported DCR failing with HTTP 400 "redirect URI not permitted" on 2026-09-25; OpenAI's reviewer could not complete the sign-in flow on 2026-10-01). A reviewer who tried in that window would have failed at sign-in, and the fix is live, so the log now says so and what to answer if feedback cites a sign-in failure. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Ui6YJGczXE8vZv2pjyxX2F --- docs/anthropic-directory-submission.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/docs/anthropic-directory-submission.md b/docs/anthropic-directory-submission.md index 9878414..af2a9a6 100644 --- a/docs/anthropic-directory-submission.md +++ b/docs/anthropic-directory-submission.md @@ -33,6 +33,14 @@ not published in the docs. - **2026-09-28** — submitted through the portal as **"Internet Computer"**, URL slug **`icp`** (manage page: ). Status **In review** since then; no reviewer feedback as of 2026-10-27. +- **2026-09-25 to 2026-10-01** — OAuth disruption overlapping the submission + date, caused by the DCR-to-CIMD migration (CIMD became the default + registration mode in [#203](https://github.com/dfinity/imcp2/pull/203), + merged 2026-09-24): a user reported DCR failing with HTTP 400 "redirect URI + not permitted" on 2026-09-25, and OpenAI's reviewer could not complete the + sign-in flow on 2026-10-01. A reviewer who tried the connector in that + window would have failed at sign-in. The fix is live; if feedback cites a + sign-in failure, answer with this timeline and ask for a re-test. ## Where and how submission happens From 83b1c3d558e511a40f9e1a7c694772ee94006c09 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 28 Oct 2026 11:34:49 +0000 Subject: [PATCH 4/5] Log the first reviewer feedback on the directory submission The Anthropic MCP Directory team's review email (received 2026-10-28) blocks the listing on one critical issue: the financial guard matches method names only, so update calls named transfer, withdraw and swap passed it and reached the target canister. They ask for value-moving capability to be detected from the canister's own interface (treat a declared canister exposing ICRC-1, ICRC-2 or ICP-ledger interfaces as a ledger and refuse its updates), for common non-standard value methods to be refused, for the server instructions to stop describing the guard as incomplete, and for a reply describing what the guard covers. Everything else passed, and the optional unknown-app suggestion was already addressed by #212. The submission log records all of that and the 2026-09-28 entry no longer claims there was no feedback. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Ui6YJGczXE8vZv2pjyxX2F --- docs/anthropic-directory-submission.md | 29 +++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/docs/anthropic-directory-submission.md b/docs/anthropic-directory-submission.md index af2a9a6..83a4572 100644 --- a/docs/anthropic-directory-submission.md +++ b/docs/anthropic-directory-submission.md @@ -32,7 +32,8 @@ not published in the docs. described were removed, and ledger methods are refused (blocker 2). - **2026-09-28** — submitted through the portal as **"Internet Computer"**, URL slug **`icp`** (manage page: ). - Status **In review** since then; no reviewer feedback as of 2026-10-27. + Status **In review** since then; the first reviewer feedback is the + 2026-10-28 entry below. - **2026-09-25 to 2026-10-01** — OAuth disruption overlapping the submission date, caused by the DCR-to-CIMD migration (CIMD became the default registration mode in [#203](https://github.com/dfinity/imcp2/pull/203), @@ -41,6 +42,32 @@ not published in the docs. sign-in flow on 2026-10-01. A reviewer who tried the connector in that window would have failed at sign-in. The fix is live; if feedback cites a sign-in failure, answer with this timeline and ask for a re-test. +- **2026-10-28** — first reviewer feedback, by email from the Anthropic MCP + Directory team (the portal status was not re-checked). One **critical** + issue blocks the review: the financial guard matches method names only. + The reviewers confirmed that `icrc1_transfer`, `icrc2_approve`, + `icrc2_transfer_from` and `manage_neuron` are refused before they reach + the network, but update calls named `transfer`, `withdraw` and `swap` + passed the guard and reached the target canister, which rejected them only + because those methods do not exist there; on a declared canister that + moves value under non-standard names the guard would not stop the call. + Asked of us: (1) detect value-moving capability from the canister itself, + not only from standard method names — for example treat any declared + canister that exposes ICRC-1, ICRC-2 or ICP-ledger interfaces as a ledger + and refuse its updates — and refuse common non-standard value methods such + as `transfer`, `withdraw` and `swap`; (2) update the server instructions + so they no longer describe the guard as incomplete (the "a safeguard, not + a complete filter" clause); (3) reply on the same thread with a short + description of what the guard covers and how it decides. The rest passed: + all 10 tools, all three example use cases end to end against YetToDo + (creating, verifying and deleting a test todo without touching other + data), the manifest opt-in model, and the app/identity pairing check; the + error messages were singled out as among the clearest the reviewers had + seen. One **optional** suggestion — the unknown-app error told the model + to run a web search; ask the user for the app's URL instead — was already + addressed by [#212](https://github.com/dfinity/imcp2/pull/212) (merged + 2026-10-28). The reviewers expect to move quickly once the guard change is + in place; blocker 2's description of the guard is to be updated with it. ## Where and how submission happens From 8c8d278cf5ff7de1c8dbbee1b743f178aab69eec Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 28 Oct 2026 15:03:56 +0000 Subject: [PATCH 5/5] Log that the guard change the reviewers asked for landed, and what is still pending #213 and #214 merged on 2026-10-28: a financial canister is now detected from the interface it publishes, a published and readable interface is required for any update call, and method names carrying a financial keyword are refused everywhere. The submission log says so and lists what still stands between here and the reply on the review thread: the server instructions' "not a complete filter" clause, a release reaching production, and the reviewers' test app publishing its interface. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Ui6YJGczXE8vZv2pjyxX2F --- docs/anthropic-directory-submission.md | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/docs/anthropic-directory-submission.md b/docs/anthropic-directory-submission.md index 06f517a..7ee1827 100644 --- a/docs/anthropic-directory-submission.md +++ b/docs/anthropic-directory-submission.md @@ -67,7 +67,21 @@ not published in the docs. to run a web search; ask the user for the app's URL instead — was already addressed by [#212](https://github.com/dfinity/imcp2/pull/212) (merged 2026-10-28). The reviewers expect to move quickly once the guard change is - in place; blocker 2's description of the guard is to be updated with it. + in place. +- **2026-10-28** — the guard change landed on `main`. + [#213](https://github.com/dfinity/imcp2/pull/213) detects a financial + canister from the interface it publishes (any `icrc1_*` / `icrc2_*` method + refuses every update to it) and makes a published, readable interface a + requirement for any update call, refusing on a failed read rather than + sending the call unchecked; [#214](https://github.com/dfinity/imcp2/pull/214) + refuses a method name carrying a financial keyword (`transfer`, `withdraw`, + `swap`, …) as a whole word on every canister. Blocker 2 describes the guard + as it now is. Still to do before replying on the review thread: the server + instructions still call the guard "a safeguard, not a complete filter" (the + reviewers' second ask); a release carrying the change has to reach + production, where the reviewers re-test; and the reviewers' test app must + publish its `candid:service`, since an update to a canister that publishes + none is now refused. ## Where and how submission happens