Issues

• Kill switch trip returns success before a delegated worker thread's protected side effect commits (drain does not stop worker threads)

  bug
  agentrust-io/cmcp#820 · Filter by author a1k7 opened on Oct 25, 2026

• cmcp_runtime.tee.nras: NRASClient accepts boolean/non-positive timeout and non-HTTPS endpoint, and crashes in try_appraise on non-dict EAR JSON or malformed report_data

  needs-review:MEDIUM
  agentrust-io/cmcp#814 · Filter by author drk-ram opened on Oct 25, 2026
  1

• cmcp_runtime.provenance: check_server_provenance accepts duplicate JSON keys and private JWK parameters, crashes on non-dict JSON or non-str fields, and meets() does not validate required_kind

  needs-review:MEDIUM
  agentrust-io/cmcp#813 · Filter by author drk-ram opened on Oct 25, 2026
  1

• cmcp_verify.tcg_event_log: _parse_spec_id and parse_event_log accept duplicate algorithm IDs, mismatched digest sizes for known algorithms, and trailing Spec ID bytes

  needs-review:MEDIUM
  agentrust-io/cmcp#812 · Filter by author drk-ram opened on Oct 25, 2026
  1

• cmcp_verify.sev_snp / tpm: verify_sev_snp_measurement does not validate measurement hex characters or report_data_hex format, and _valid_measurement accepts whitespace/uppercase hex

  needs-review:MEDIUM
  agentrust-io/cmcp#811 · Filter by author drk-ram opened on Oct 25, 2026
  1

• cmcp_verify.nv_certify / nv_policy: verify_gateway_measurement accepts duplicate JSON keys, boolean/float version, non-base64 chars, and non-canonical gateway_digest hex

  needs-review:MEDIUM
  agentrust-io/cmcp#810 · Filter by author drk-ram opened on Oct 25, 2026
  1

• fix(verify): enforce canonical base64url and reject private JWK members in kill_switch and claim verification

  needs-review:MEDIUM
  agentrust-io/cmcp#804 · Filter by author drk-ram opened on Oct 23, 2026
  1

• fix(policy,catalog): enforce canonical base64url signatures, strict decimal bundle versions, and duplicate-key rejection

  needs-review:MEDIUM
  agentrust-io/cmcp#802 · Filter by author drk-ram opened on Oct 23, 2026
  1

• fix(verify/azure_cvm): enforce minimal Base64urlUInt, reject private/duplicate HCLAkPub JWKs, and bound TPM quote parsing

  needs-review:MEDIUM
  agentrust-io/cmcp#801 · Filter by author drk-ram opened on Oct 23, 2026
  1

• fix(verify/tdx,embodied_action): enforce hex format in verify_tdx_measurement and guard non-dict inputs in verify_embodied_action_evidence

  needs-review:MEDIUM
  agentrust-io/cmcp#803 · Filter by author drk-ram opened on Oct 23, 2026
  1

• fix(runtime): enforce canonical base64url in agent_manifest and reject duplicate JSON keys across server, catalog, and inspection

  needs-review:MEDIUM
  agentrust-io/cmcp#798 · Filter by author drk-ram opened on Oct 23, 2026
  5

• Follow-ups from #779: seal after bundle verification, owner-auth wording, config-digest changelog

  agentrust-io/cmcp#782 · Filter by author imran-siddique opened on Oct 19, 2026
  2

  

• 3 of 6 InspectionResult values are declared but unreachable

  agentrust-io/cmcp#764 · Filter by author saintmalik opened on Oct 15, 2026
  2

• Define execution scope for protected effects and complete mediation

  agentrust-io/cmcp#736 · Filter by author omwei-org opened on Oct 8, 2026
  7

• Session identity is minted fresh on every open, so a restarted or peer instance cannot resume a session

  help wanted
  agentrust-io/cmcp#675 · Filter by author Yatsuiii opened on Sep 20, 2026
  3

• Define explicit authorization for releasing confidential data and derived outputs

  agentrust-io/cmcp#660 · Filter by author imran-siddique opened on Sep 18, 2026
  7

  

• Bind MCP Tasks and authenticated callbacks into cMCP evidence

  agentrust-io/cmcp#567 · Filter by author imran-siddique opened on Aug 24, 2026
  19

  

• Separate workload identity, represented user, and delegated authority claims

  agentrust-io/cmcp#568 · Filter by author imran-siddique opened on Aug 24, 2026
  6

  

• Bind progressive MCP discovery to versioned catalog checkpoints

  agentrust-io/cmcp#566 · Filter by author imran-siddique opened on Aug 24, 2026
  14

  

• feat(tee): seal the TRACE signing key to the gateway measurement (RFC P3)

  agentrust-io/cmcp#462 · Filter by author imran-siddique opened on Aug 1, 2026
  6

  

• [phase-2] Policy enforcement inside TEE — Cedar evaluation runs in the enclave, not at API boundary

  attestationphase-2security
  agentrust-io/cmcp#124 · Filter by author imran-siddique opened on Jun 6, 2026
  10