{
  "service": "MarketNow",
  "artifact": "OWASP MCP Cheat Sheet — alignment matrix",
  "version": "1.0.0",
  "generated_at": "2026-09-17",
  "source": "OWASP MCP Security Cheat Sheet (https://genai.owasp.org) — controls mapped to MarketNow implementations that exist and are verifiable in code",
  "methodology": "Every 'implemented' control cites the shipping component (npm package, endpoint, or artifact) that provides it. 'partial' means the control is covered for MarketNow-distributed surfaces but not enforced on arbitrary third-party servers.",
  "controls": [
    {
      "id": "OC-01",
      "name": "Verify tool descriptions haven't changed (tool poisoning / rug-pull detection)",
      "status": "implemented",
      "implementation": "TFP-1.0 tool fingerprinting — SHA-256 over RFC 8785 JCS canonical tool definitions + manifest fingerprint + drift report (added/removed/changed)",
      "evidence": "marketnow_fingerprint_tool (marketnow-mcp npm + /api/mcp hosted), pin_tool_surface / verify_tool_surface in @marketnow/cline-trust-plugin"
    },
    {
      "id": "OC-02",
      "name": "Capability declarations and least privilege",
      "status": "implemented",
      "implementation": "Every skill carries an inferred capability manifest (filesystem / network / shell / credentials / process) and an ATC capabilities block; the interceptor enforces allow/deny lists (denyActions, allowHosts)",
      "evidence": "ATC payload.capabilities in all 57 ledger cards; @marketnow/cline-trust-plugin config"
    },
    {
      "id": "OC-03",
      "name": "Credential and secret protection (env vars, key files)",
      "status": "implemented",
      "implementation": "Pre-exec interceptor blocks credential-file access (.env, .aws/credentials, .ssh/id_rsa, .npmrc, .git-credentials) as path segments, case-insensitive; submissions with embedded secrets are rejected (critical severity)",
      "evidence": "@marketnow/cline-trust-plugin R1; Sentinel submission scanner SECRET_PATTERNS"
    },
    {
      "id": "OC-04",
      "name": "Command injection / dangerous code execution",
      "status": "implemented",
      "implementation": "L1.7 malware scan flags eval/exec/spawn/curl|sh/rm -rf patterns; recursive deletes are blocked at the interceptor before execution",
      "evidence": "marketnow/aep-marketplace/lib/submit-core.mjs DANGEROUS_API; interceptor R2"
    },
    {
      "id": "OC-05",
      "name": "Server identity verification before trusting",
      "status": "implemented",
      "implementation": "Agent Trust Cards (ATC/2.0): Ed25519 (RFC 8032) over RFC 8785 JCS payload, sha256 signed_payload_hash pre-check, CA key registry with rotation history",
      "evidence": "GET /api/atc?action=verify; POST /api/trust {action:verify}; npm agent-trust-card; marketnow_verify_atc_spec / marketnow_verify_trust"
    },
    {
      "id": "OC-06",
      "name": "Revocation checking (fail-closed)",
      "status": "implemented",
      "implementation": "Signed CRL (MNR-CRL-1.0) + OCSP-style per-subject responder with nonce anti-replay; UNKNOWN/ERROR/EXPIRED/REVOKED all answer recommendation DENY",
      "evidence": "GET /api/crl, GET/POST /api/ocsp, /uta/revocations/{crl.json,registry-key.json} (registry key mn-revoc-002, rotated 2026-09-17)"
    },
    {
      "id": "OC-07",
      "name": "Prompt injection detection in tool metadata",
      "status": "implemented",
      "implementation": "Sentinel L1 scans name/description/system prompts against 15 injection patterns (critical severity blocks publication); markdown/XSS in rendered fields is rejected since 2026-09-17",
      "evidence": "lib/submit-core.mjs INJECTION_PATTERNS + MARKUP_PATTERNS; public submissions queue with findings"
    },
    {
      "id": "OC-08",
      "name": "Human-in-the-loop for sensitive actions",
      "status": "partial",
      "implementation": "Interceptor supports requireApprovalAbove (e.g. spend_usd > 1) and emits signed audit receipts on DENY; adoption is opt-in per deployment",
      "evidence": "@marketnow/cline-trust-plugin config.requireApprovalAbove"
    },
    {
      "id": "OC-09",
      "name": "Audit logging of tool-call decisions",
      "status": "implemented",
      "implementation": "Append-only Merkle tree audit log of every interceptor decision (DENY + PERMIT) with receipts",
      "evidence": "@marketnow/cline-trust-plugin get_audit_log"
    },
    {
      "id": "OC-10",
      "name": "Structured output and error taxonomy",
      "status": "implemented",
      "implementation": "All 15 MCP tools return {content:[{type:text}], isError} with INVALID_ARGUMENT / NOT_FOUND / UNKNOWN_TOOL error codes; strict JSON-Schema input validation (type+enum+pattern+bounds)",
      "evidence": "marketnow-mcp npm package (stdio) + /api/mcp (hosted)"
    },
    {
      "id": "OC-11",
      "name": "Supply chain / SBOM verification",
      "status": "partial",
      "implementation": "npm audit clean (0 vulnerabilities) on own packages; L4 SBOM checks run on catalog packages batch-side; per-tarball L2 sandbox scans cover the top 2,868 npm targets",
      "evidence": "scripts l4-sbom-check.py; certification-scans.json (2,839 scanned)"
    },
    {
      "id": "OC-12",
      "name": "Transport and session security",
      "status": "implemented",
      "implementation": "Hosted MCP endpoint is HTTPS-only with HSTS, nosniff, X-Frame-Options DENY, no-store on API responses; CORS open by design (public, key-less trust data); JSON-RPC 2.0 envelopes strictly validated",
      "evidence": "vercel.json headers; /api/mcp jsonrpc validation (since 1.12.0)"
    }
  ],
  "summary": {
    "implemented": 10,
    "partial": 2,
    "total": 12
  },
  "per_skill": {
    "how_to": "Call marketnow_fingerprint_tool with the server's tools/list output to pin its tool surface; call marketnow_get_skill for a skill's Sentinel score and capability data. The capability manifest (filesystem/network/shell/credentials/process) is part of every Agent Trust Card.",
    "fingerprint_format": "TFP-1.0"
  },
  "note": "This artifact is served as a static file (no lambda) — the compliance matrix is versioned with the repo and regenerated on each release."
}