From 721c29806a18d7e1b42bc3f1df9794337071e5e8 Mon Sep 17 00:00:00 2001 From: Allan Scott Date: Wed, 17 Jun 2026 05:10:40 -0400 Subject: [PATCH] =?UTF-8?q?tech-debt-backlog=20=C2=A77.17:=20gloss=20`tool?= =?UTF-8?q?s/call`=20as=20MCP=20jargon=20in=20README?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The `### Trust Boundary` subsection's opening sentence in README.md referred to `tools/call` without explaining what it is; a reader new to the MCP protocol would not know it is the JSON-RPC method the MCP spec defines for tool invocation. Took the wording prescribed in §7.17 verbatim: the sentence now reads "There is no auth check on the JSON-RPC `tools/call` method (the MCP-standard tool-invocation entry point) — any client …". No test pins the README prose, so the print-only change is safe; full suite green (1282 passed, 8 skipped). The companion §7.16 forward-link stays open: it depends on an MCP-error-handling section that does not yet exist in README.md, so landing the anchor is wider than §7.17 scope. Co-Authored-By: Claude Opus 4.7 --- README.md | 12 ++++++------ openspec/changes/tech-debt-backlog/tasks.md | 15 ++++++++++++++- 2 files changed, 20 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index 36acd42..6062d09 100644 --- a/README.md +++ b/README.md @@ -865,12 +865,12 @@ Add to your Claude Code settings (`~/.claude/settings.json` or project `.claude. ### Trust Boundary -The server speaks JSON-RPC over **stdio only**. There is no auth check on -`tools/call` — any client that can connect to the stdio pipe can invoke any -tool, including the two that spend on an LLM provider (`generate_machine`, -`refine_machine`). This is intentional: under stdio the client is a local -process the user already started, so the OS process boundary is the trust -boundary. +The server speaks JSON-RPC over **stdio only**. There is no auth check on the +JSON-RPC `tools/call` method (the MCP-standard tool-invocation entry point) — +any client that can connect to the stdio pipe can invoke any tool, including +the two that spend on an LLM provider (`generate_machine`, `refine_machine`). +This is intentional: under stdio the client is a local process the user +already started, so the OS process boundary is the trust boundary. This property is invisible from the outside, so operators (and anyone wiring the server up to a new transport) should know: diff --git a/openspec/changes/tech-debt-backlog/tasks.md b/openspec/changes/tech-debt-backlog/tasks.md index 7fe81dc..0279dcf 100644 --- a/openspec/changes/tech-debt-backlog/tasks.md +++ b/openspec/changes/tech-debt-backlog/tasks.md @@ -1549,7 +1549,7 @@ picked up. (Source: 2026-05-28 PR #76 review log, `logs/pr-review-2026-05-28.log`, "forward-link to §4.3".) -- [ ] 7.17 **Gloss `tools/call` as MCP jargon on first use in +- [x] 7.17 **Gloss `tools/call` as MCP jargon on first use in the README.** Severity: LOW. Surface: `README.md`, the `### Trust Boundary` subsection ("There is no auth check on `tools/call` — any client that can connect…"). A reader new @@ -1563,6 +1563,19 @@ picked up. (Source: 2026-05-28 PR #76 review log, `logs/pr-review-2026-05-28.log`, "gloss `tools/call` as MCP jargon".) + Took the prescribed wording verbatim. The `### Trust Boundary` + subsection's opening sentence in `README.md` now reads "There + is no auth check on the JSON-RPC `tools/call` method (the + MCP-standard tool-invocation entry point) — any client that + can connect to the stdio pipe can invoke any tool…", glossing + the JSON-RPC method name and naming MCP as the standard that + defines it. No test pins the README prose (`grep -n + 'tools/call\|Trust Boundary' tests/` returns nothing in + `tests/test_mcp_server.py` except the sanitizer-related code + paths it covers), so the print-only change is safe. The + follow-up forward-link from §7.16 stays open: it depends on + an MCP-error-handling section that does not yet exist in + `README.md`, so adding the anchor is wider than §7.17 scope. - [ ] 7.18 **Tighten the prior-Claude-review check from substring to author identity in `pr-review-prompt.txt`.**