mcp-trust-broker

name	mcp-trust-broker
description	Vet a third-party MCP server before it can run: install-card completeness (manifest, provenance, permission label, health check, disable/repair/uninstall, usage trace), signature verification, least-privilege capability mapping, a sandbox smoke test, quarantine-until-reviewed, and team allow/approve/block policy. Use when a new MCP server is discovered or proposed for the fleet's tool palette, when a server requests to exit quarantine and run for real, or when auditing whether an MCP install card meets the minimum contract. NOT for general ocap/mTLS/capability-crypto theory (use agentic-zero-trust-security), building your own MCP server from scratch (a separate authoring concern this skill does not cover), proving a sandbox boundary itself withstands adversarial attack (use sandboxed-adversarial-test-harness), or the event-trigger-to-agent-spawn trust gate for inbound webhooks/email/SMS (use fleet-event-spawn-trust).
license	Apache-2.0
allowed-tools	Read,Write,Edit,Bash,Grep,Glob
metadata	{"category":"Security & Trust","tags":["mcp","admission-control","provenance","least-privilege","quarantine"],"provenance":{"kind":"first-party","owners":["port-daddy"]},"pairs-with":[{"skill":"agentic-zero-trust-security","reason":"Supplies the signed-envelope, capability, and mTLS vocabulary this broker's provenance and least-privilege checks build on."},{"skill":"sandboxed-adversarial-test-harness","reason":"Proves the sandbox boundary itself holds under attack; this skill only checks that a smoke test was run and passed before exit."},{"skill":"fleet-event-spawn-trust","reason":"Shares the classify-then-gate shape for a different trust surface — inbound event triggers rather than installed MCP servers."}],"io-contract":{"kind":"deliverable","consumes":["[Truncated]","[Truncated]"],"produces":["[Truncated]","[Truncated]"]}}

MCP Trust Broker

Decide whether a third-party MCP server is safe to admit into the fleet's tool palette — not just whether it installs.

Use This For

• Reviewing a newly discovered or proposed MCP server's install card against the minimum MCP contract before it ever runs.
• Deciding whether a quarantined server's request to exit quarantine is backed by proven provenance, a passed sandbox smoke test, and a least-privilege scope — not just a publisher's say-so.
• Setting or auditing team admission policy (allow / approve / block) for a given server.
• Confirming every write-capable tool a server exposes routes through daemon policy rather than executing directly.
• Re-auditing a previously-admitted server after its manifest or binary changes.

Do Not Use This For

• General ocap/mTLS/signed-envelope cryptography theory for agent-to-agent communication (agentic-zero-trust-security).
• Building an MCP server from scratch, or its tool/schema design — this skill only vets a server someone else built.
• Adversarially proving a sandbox's isolation boundary holds against SSRF, path traversal, or resource exhaustion (sandboxed-adversarial-test-harness) — this skill checks that a smoke test happened and passed, not how sound the sandbox itself is.

Admission Decision

flowchart TD
  A[Server discovered / proposed] --> B[Quarantine by default]
  B --> C[Build install card: manifest, provenance, scope, health, lifecycle, usage trace]
  C --> D{Minimum contract complete?}
  D -->|No| E[Keep quarantined; request missing evidence]
  D -->|Yes| F{Quarantine exit requested?}
  F -->|No| G[Stay quarantined; track pending signals]
  F -->|Yes| H[Check all 4 exit legs: signed+verified, smoke passed, least-privilege, policy not block]
  H --> I{All 4 proven?}
  I -->|No| J[Block exit; report which leg failed]
  I -->|Yes| K[Admit; route writes through daemon policy; wire usage trace]
  K --> L[Re-audit on any manifest/binary change]

1. Default to quarantine. Every newly discovered or proposed MCP server starts under review, with nothing granted yet.
2. Build the install card. Populate all six minimum-contract fields: manifest presence, provenance + signature verification, declared permission scope, sandbox smoke test result, health check, disable/repair/uninstall, usage trace. See references/mcp-minimum-contract.md.
3. Check the minimum contract unconditionally. A missing manifest blocks review outright; missing health check, lifecycle controls, or usage trace are contract gaps regardless of quarantine state.
4. If quarantine exit is not yet requested, track pending signals (undeclared scope, not-run smoke test) without blocking — that's what quarantine is for. See .