Verification register Security & Identity
Current reading
Readiness band and full integer triple
AI-assisted assembly · derived results
Readiness band
Ready
Primary summary from verified readiness
- Confidence
- 69% · stale
- Computed at
- 2026-08-20T10:52:39.621838+00:00
- Claimed
- 80
- Reported
- 74
- Verified
- 65
- Gap
- +15
Public ambition and stated capability
Observed practitioner reporting
Independently supported evidence
Claimed leads verified
Evidence strength Strong
Decision
What the current evidence supports
Human editorial judgment · 2026-08-20
Adopt with guardrails
- Why
- This is a ratified spec with very-high real-world adoption that directly governs how our agent MCP tools authenticate — but the optionality plus the confused-deputy/token-passthrough footguns mean we must implement the specific MUSTs and consent gates deliberately, not assume the profile is safe by default.
- Next
- Audit our MCP servers against the 2025-11-25 normative MUSTs: RFC 9728 Protected Resource Metadata + WWW-Authenticate 401, mandatory audience validation (reject tokens not issued for us), S256 PKCE enforcement, and explicit-no-token-passthrough to upstream APIs; prefer Client ID Metadata Documents / pre-registration over DCR.
Constraints
Blockers
No named blocker is present in the current public projection.
Evidence summary
Derived counts
AI-assisted assembly
- Total
- 12
- Tier 1
- 0
- Tier 2
- 4
- Tier 3
- 8
- Supports
- 6
- Contradicts
- 4
- Context
- 2
- Latest observed
- 2026-04-01
Counts and dates only. Raw signals, private excerpts, trust records, and internal corpus material are not published here.
Publication record
Revisions
Initial public reading
- 2026-07-19 Reading moved from ready to ready.