Post-v1.8.1 security and protocol roadmap #558

Track Batesian improvements after v1.8.1. Prioritize trustworthy verdicts and authorization boundaries over rule count. Land related work in coherent PRs with vulnerable and protected fixtures. This issue does not schedule or authorize a release.

P1: Result integrity

Progress: PR #559, PR #560, and PR #561 complete P1. PR #562 completes expected-denial policy and the CI gate correction. PR #565 completes modern MCP Tasks coverage. PR #566 completes card-auth checks. PR #567 completes anonymous JSON-RPC task listing coverage. PR #568 completes shared HTTP+JSON tenant routing. PR #569 completed SDK binding validation and advisory coverage. PR #570 is open for CI documentation repair.

• Fix mcp-task-id-entropy-001 so deterministic UUID-shaped counters and repeated handles are not rated clean. Use genuinely random IDs and intentional request deduplication as controls; keep statistical claims appropriately qualified.
• Correct MCP OAuth discovery across token replay, DCR, confused-deputy, metadata-SSRF, and audience checks. Support RFC 9728 path-aware protected-resource metadata, validated issuer metadata, and challenge-advertised metadata. Preserve --oauth-origin consent and report blocked external discovery as not tested.
• Validate OAuth token_type before using an acquired token as Bearer. Test missing, unsupported, and case-insensitive Bearer values.
• Fix A2A cancel attribution on JSON-RPC and HTTP+JSON. An explicit denial followed by an independent task cancellation must not become a confirmed IDOR finding.
• Recalibrate findings that establish reachability but not a policy violation: public MCP prompts and completions, A2A task reads and cross-principal cancellation, and private push callbacks. Add public, shared-role, and protected controls. Keep observed behavior visible without calling it a confirmed exploit by default.

P2: Authorization and coverage

• Add an optional expected-protection policy for named principals, tenants, and operations. Only promote an access observation to confirmed authorization failure when the expected denied relationship is established.
• Test modern MCP Tasks tasks/get, tasks/update, and tasks/cancel with safe disposable tasks and explicit permission boundaries. A known task ID alone is not proof of IDOR.
• Extend A2A card-declared authentication checks to valid direct Message replies on JSON-RPC and HTTP+JSON. Reject malformed replies and request echoes.
• Report anonymous JSON-RPC ListTasks disclosure as an indicator when it exposes a scanner-created task. Avoid duplicating REST task-IDOR findings.
• Preserve distinct A2A HTTP+JSON interfaces that share a URL but advertise different tenants; verify request routing and mark ambiguous comparisons not tested.
• Expand official SDK and fixture validation across supported protocol versions and bindings. Maintain an advisory-to-rule matrix that distinguishes endpoint-observable behavior from client-only and log-only issues.
• Repair CI documentation: make coverage-gate examples runnable with their stated principal prerequisites, pass target URLs through environment variables instead of shell expression interpolation, avoid secret-bearing command-line examples, pin example actions, and update stale rule descriptions. Test examples where practical.

P3: Protocol evolution

• Prototype modern MCP cache-scope, subscription, and multi-round-trip state checks. Add rules only where a safe exploit oracle and protected control can be demonstrated.
• Review modern MCP named-method headers, capability-advertisement fallback, paginated tool discovery, PKCE issuer discovery, and legacy session cleanup for compatibility and honest not-tested outcomes.
• Assess demand, safety, and maintenance cost for A2A gRPC coverage against the official TCK before committing to another transport.

Review priority after each coherent PR. Do not cut v1.8.2 until separately approved.