The Trustworthy Model Context Protocol (MCP) Registry: An Architectural Blueprint for Cryptographic Provenance and Runtime Integrity

Lluis Mas (), Jordi Vilaplana, Josep Rius, Radu Spaimoc and Jordi Mateo ()
Additional contact information
Lluis Mas: Department of Computer Engineering and Digital Design, University of Lleida, Jaume II 69, 25001 Lleida, Spain
Jordi Vilaplana: Department of Computer Engineering and Digital Design, University of Lleida, Jaume II 69, 25001 Lleida, Spain
Josep Rius: Department of Computer Engineering and Digital Design, University of Lleida, Jaume II 69, 25001 Lleida, Spain
Radu Spaimoc: Department of Computer Engineering and Digital Design, University of Lleida, Jaume II 69, 25001 Lleida, Spain
Jordi Mateo: Department of Computer Engineering and Digital Design, University of Lleida, Jaume II 69, 25001 Lleida, Spain

Future Internet, 2026, vol. 18, issue 5, 1-26

Abstract: The Model Context Protocol (MCP) enables Large Language Models (LLMs) to act as autonomous agents that orchestrate complex workflows over distributed systems, while MCP resolves integration bottlenecks by standardizing agent-to-resource communication. Its current registry relies on an unverified pointer architecture, exposing agentic workflows to supply chain poisoning and dynamic capability mutation (“Rug Pull”) attacks. This paper identifies this gap and proposes a three-layer architectural framework for a Trustworthy MCP Registry. The novelty of our contribution lies not in the individual standards employed (RFC 8615, Sigstore, and JCS/JWS are established technologies), but in their specific composition to address MCP’s unique runtime security requirements: (1) RFC 8615 Well-Known URIs for decentralized server discovery and domain-bound identity; (2) Sigstore Keyless signing to bind server artifacts to audited CI/CD environments without managing long-lived keys; and (3) JSON Canonicalization Scheme (RFC 8785) combined with JWS to provide deterministic, per-message integrity verification of live capability updates. We present a prototype implementation and an experimental evaluation conducted in a controlled, synthetic environment. Results indicate that the cryptographic overhead averages 0.61 ms per signing operation and that the Layer 3 mechanism correctly rejects all 100 simulated Rug Pull attempts, as expected by construction, since an attacker without the server’s private key cannot produce a valid signature. These findings suggest that the proposed approach is feasible and warrants further evaluation in real-world deployment settings.

Keywords: Model Context Protocol (MCP); AI agents; cryptographic provenance; runtime integrity; cloud-edge continuum (search for similar items in EconPapers)
JEL-codes: O3 (search for similar items in EconPapers)
Date: 2026
References: Add references at CitEc
Citations:

Downloads: (external link)
https://www.mdpi.com/1999-5903/18/5/243/pdf (application/pdf)
https://www.mdpi.com/1999-5903/18/5/243/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jftint:v:18:y:2026:i:5:p:243-:d:1935157

Access Statistics for this article

Future Internet is currently edited by Ms. Afra Wang

More articles in Future Internet from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().