{
  "report": "org.govp.agent.mcp-receiver-attested-interop/0.1-draft",
  "generated_at": "2026-07-30T10:04:09Z",
  "implementation": {
    "client_and_server_sdk": "@modelcontextprotocol/sdk",
    "version": "1.30.0",
    "language": "JavaScript",
    "source": "https://github.com/modelcontextprotocol/typescript-sdk",
    "transport": "stdio",
    "protocol_revision": "2025-11-25"
  },
  "overall": "receiver_attested_interoperability_pass",
  "checks": {
    "protocol_negotiation": {
      "status": "pass",
      "revision": "2025-11-25"
    },
    "tool_discovery": {
      "status": "pass",
      "tool": "inventory.reserve"
    },
    "request_evidence": {
      "status": "pass",
      "signature": "cryptographically_valid",
      "binding": [
        "json-rpc request id",
        "normalized action digest"
      ]
    },
    "receiver_execution": {
      "status": "pass",
      "effect": "ephemeral in-memory inventory changed from 10 to 8"
    },
    "result_evidence": {
      "status": "pass",
      "signature": "cryptographically_valid",
      "observation_class": "receiver_attested",
      "event_type": "tool.call_succeeded"
    },
    "causal_graph": {
      "status": "pass",
      "overall": "graph_valid"
    },
    "privacy": {
      "status": "pass",
      "raw_private_target_absent": true,
      "private_signing_keys_absent": true
    },
    "dependency_audit": {
      "status": "pass",
      "known_vulnerabilities": 0
    }
  },
  "reproduce": {
    "install": "npm ci",
    "run": "npm run demo:mcp-receiver",
    "test": "node --test test/receiver-attested-mcp.test.js"
  },
  "limitations": [
    "The receiver attests the mutation performed by its own ephemeral in-memory handler; no external inventory, database, payment, or cloud system effect is claimed.",
    "The requester and receiver use ephemeral demo keys explicitly trusted for one run, not durable organizational identities.",
    "This tests the MCP stdio transport and tools/call operation only.",
    "Production use still requires authenticated key distribution, authorization, replay controls, durable evidence storage, and evidence from the boundary that performs the real-world side effect."
  ]
}