docs(site): accuracy pass, every claim checked against the repos - #10
Merged
Conversation
Same audit as the org profile, applied to agentrust-io.com. Two findings were wrong rather than stale, and one of those is an overclaim. The acronym was wrong. The site expanded TRACE as "Transparent Runtime Attestation for Confidential Execution" in four places, including the JSON-LD. The specification says "Trust, Runtime Attestation, and Compliance Evidence", in its title, its README, and section 1. The public site was teaching search engines and AI assistants a name the spec does not use. The confidentiality claim overstated what cMCP guarantees. The site said the host, the operator, and the network "never observe inputs, outputs, or intermediate state" and "see only ciphertext". cMCP's own LIMITATIONS.md is narrower on both counts: the plaintext guarantee is structural only where the Cedar egress policy denies telemetry and APM endpoints, and cMCP "controls the tool boundary, not the model boundary", so it does not cover model inference or the agent's context window. Both bounds now appear wherever the claim does, in the visible copy and in the JSON-LD. Licences were stated as a blanket Apache 2.0 in five places, including the footer. They are mixed: Agent Manifest and trace-tests are Apache 2.0, cMCP and cA2A are MIT, and the TRACE specification text is CC BY 4.0 with its reference code under Apache 2.0. Versions were stale: TRACE v0.1 to spec v0.2, cMCP v0.1 to 0.3.0, and "Agent Manifest v1", which never existed in either the spec or the SDK, to spec v0.1. Standardization said CoSAI / AIF; the body is AAIF. llms.txt carried the same acronym, confidentiality, licence, and version claims and moves with the page. It also now states the v0.2 profile URI change, since that is the one thing an implementer reading a machine-readable summary has to act on. JSON-LD revalidated: all three blocks parse. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Same audit as the org profile (.github#21), applied to agentrust-io.com. Verified the live site is byte-identical to
index.htmlfirst, so this is the page people actually see.Two findings were wrong rather than stale, and one is an overclaim.
The acronym was wrong
The site expanded TRACE as "Transparent Runtime Attestation for Confidential Execution" in four places, two of them inside the JSON-LD.
The specification says "Trust, Runtime Attestation, and Compliance Evidence" in its title, its README, and section 1. So the public site and the structured data feeding search engines and AI assistants were teaching a name the spec does not use.
The confidentiality claim overstated what cMCP guarantees
The site said the host, the operator, and the network "never observe inputs, outputs, or intermediate state", and elsewhere that they "see only ciphertext".
cMCP's own
LIMITATIONS.mdis narrower on two counts:So the unconditional claim was stronger than the runtime delivers, and it is the sort of claim a security reviewer checks first. Both bounds now travel with the claim everywhere it appears, in the visible copy and the JSON-LD. I also added that the receipt is hardware-attested in a TEE and signed-only in software mode, which the page did not mention at all despite software mode being the documented quickstart.
Licences were wrong
Stated as a blanket Apache 2.0 in five places including the footer. Actually mixed:
Versions stale
TRACE v0.1 to spec v0.2; cMCP v0.1 to 0.3.0; and "Agent Manifest v1", which has never existed in either the spec or the SDK, to spec v0.1 with SDK 0.7.0. Standardization said "CoSAI / AIF"; the body is AAIF.
llms.txt
Carried the same acronym, confidentiality, licence, and version claims, so it moves with the page. It also now states the v0.2 profile URI change, since that is the one thing an implementer reading a machine-readable summary has to act on.
Verification
Left alone deliberately
The cA2A card and FAQ claim attested peers and a channel sealed to the peer's measurement. Those are now true and hardware-validated, and the page already labels cA2A a developer preview, so I did not add the one-directional-attestation caveat there. Over-caveating something already marked preview reads as noise. Say the word if you want it explicit.