The Model Context Protocol (MCP) enables Large Language Models (LLMs) to act as autonomous agents that orchestrate complex workflows over distributed systems, while MCP resolves integration bottlenecks by standardizing agent-to-resource communication. Its current registry relies on an unverified pointer architecture, exposing agentic workflows to supply chain poisoning and dynamic capability mutation (“Rug Pull”) attacks. This paper identifies this gap and proposes a three-layer architectural framework for a Trustworthy MCP Registry. The novelty of our contribution lies not in the individual standards employed (RFC 8615, Sigstore, and JCS/JWS are established technologies), but in their specific composition to address MCP’s unique runtime security requirements: (1) RFC 8615 Well-Known URIs for decentralized server discovery and domain-bound identity; (2) Sigstore Keyless signing to bind server artifacts to audited CI/CD environments without managing long-lived keys; and (3) JSON Canonicalization Scheme (RFC 8785) combined with JWS to provide deterministic, per-message integrity verification of live capability updates. We present a prototype implementation and an experimental evaluation conducted in a controlled, synthetic environment. Results indicate that the cryptographic overhead averages 0.61 ms per signing operation and that the Layer 3 mechanism correctly rejects all 100 simulated Rug Pull attempts, as expected by construction, since an attacker without the server’s private key cannot produce a valid signature. These findings suggest that the proposed approach is feasible and warrants further evaluation in real-world deployment settings.
Mas et al. (Mon,) studied this question.