Table of Contents

Return to the Secure AI Agents and MCP Course

Your capstone is a security decision package for Patch Clerk. Another reviewer should reach the same deployment decision from your artifacts and evidence.

Scenario Change

Patch Clerk now reads synthetic issues, reads repository files, proposes a patch, and applies a reviewed patch in a test repository. A product owner requests a new post_comment tool. The tool would publish text to a fictional issue system.

Your job is to decide whether post_comment enters the first release. Treat publication as an external side effect.

Required Package

Create capstone/ with these files:

capstone/
  system-map.md
  authority-matrix.md
  mcp-security-contract.md
  event-example.json
  detection-plan.md
  attack-test.md
  deployment-decision.md

Each file has one purpose:

  • system-map.md names components, trust boundaries, data origins, and owners.
  • authority-matrix.md lists operations, identities, approval, and evidence.
  • mcp-security-contract.md defines inputs, outputs, limits, errors, and side effects.
  • event-example.json shows the decision event format without storing unnecessary raw content.
  • detection-plan.md maps signals to stop and recovery actions.
  • attack-test.md records the hostile fixture, expected result, observed result, and retest.
  • deployment-decision.md states approve, approve with conditions, or reject.

Build the Review

  1. Copy your lesson artifacts into capstone/.
  2. Add post_comment to the authority matrix as proposed.
  3. Define a 2,000-character limit and one approved issue target.
  4. Require a preview and trusted host-held, single-use approval bound to the comment digest and target-state precondition. A caller-supplied digest is not approval.
  5. Give the tool a dedicated identity restricted to comment creation on the approved test project.
  6. Add rate limits and a stop rule for repeated publication requests.
  7. Run the local comment policy simulator with python3 comment_policy_lab.py. Record all nine expected and observed decisions in attack-test.md. Include the hostile denial, valid would_post decision, replay denial, forged self-approval denial, target and length denials, identity denial, changed-state denial, and rate-limit denial.
  8. Record your decision and residual risks.

Do not connect a live issue service. Treat the capstone as a design and local policy test.

Decision Rubric

Area0 points1 point2 points
AuthorityBroad shared identityNarrow identity with gapsDedicated least-privilege identity
InputFree-form unchecked payloadLength or target checkTyped input, target allowlist, and length limit
ApprovalNoneApproval before final payloadPreview and digest-bound single-use approval
EvidenceModel transcript onlyHost eventHost, server, and downstream correlation
Attack testNo hostile fixtureExpected result onlyObserved local denial plus positive test
RecoveryRestart onlyRevoke or restoreStop, revoke, preserve, restore, repair, retest

A score below 10 out of 12 fails the release review. Any zero in authority, approval, or attack test also fails.

Reference Answer

The reference decision is approve with conditions for a test environment.

Required conditions:

  1. post_comment uses a dedicated test-project identity.
  2. The host shows issue identifier and final comment text.
  3. A trusted host records approval with a random, single-use token bound to the action digest and expiry. Untrusted content cannot mint approval.
  4. The server rejects any other project, issue, or payload over 2,000 characters. Approval binds the preview and current target-state digest.
  5. The event stream records preview, approval, call, and downstream result under one run ID.
  6. A hostile issue instruction fails before the downstream request.
  7. A valid approved comment returns would_post in the synthetic positive test. The local simulator prints 9/9 passed and makes no downstream request.

Production release stays out of scope until a real authorization test, downstream audit review, and incident exercise produce evidence.

Expected Result

Your package scores at least 10. It contains no real secrets or external connections. The decision states who owns remaining risk and which evidence is still missing for production.

Troubleshooting

  • The package repeats chat transcripts: Replace narrative with maps, contracts, events, diffs, and test results.
  • The comment identity reaches every project: Restrict the downstream account before relying on server input checks.
  • Approval lacks a payload digest: Bind approval to the final issue target and comment text.
  • The attack test blocks valid comments: Add a positive test and repair the narrow policy path.
  • Residual risk has no owner: Assign a named role with a review date and acceptance decision.

Verify Completion 

find capstone -maxdepth 1 -type f -print | sort
python3 -m json.tool capstone/event-example.json
grep -Ein "decision|owner|residual|approval|digest" capstone/deployment-decision.md

Pass when all seven files exist, JSON parses, the rubric score reaches ten, no core area scores zero, and the decision separates observed local evidence from future production tests.

Return to the course hub or review the MCP 2026-07-28 release notes before adapting the package to a real implementation.