$ the-wire · showcase
Unsigned MCP receipts rejected, Linux sandbox denies tightened
By RepoJournal · Filed · About Agent Security · Composed from the cited sources · methodology
Two operator-visible fixes landed today: MCP receipt verification stops validating unsigned chains and empty signer lists, and Linux sandbox write denies now catch dangerous subdirectory names at any depth.
fix(mcp-receipts): reject unsigned chains and empty signer trust microsoft/agent-governance-toolkit
The offline verifier used to accept unsigned receipts and report valid signatures while the library rejected the same chain, and it treated trusted_keys=[] as unrestricted trust. Each unsigned CLI receipt is now a verification error with exit code 1 and passed: false, and an empty trusted-key list rejects every signer.
linux: deny every dangerous name of a subdirectory, not only those three levels down anthropics/sandbox-runtime
Mandatory write denies below the working directory were built from one rg --files --max-depth run, so names like sub/.git/hooks/pre-commit and sub/.claude/commands/x.md slipped past and could be lost entirely. Every dangerous subdirectory name is now denied regardless of depth or what else the tree holds.
feat: honor tool_output.parallel and tool_input.parallel for per-tool rails NVIDIA-NeMo/Guardrails
rails.tool_output.parallel and rails.tool_input.parallel are now actually honored for per-tool checks through the existing _run_rails_parallel path; previously IORails ignored the flag with a warning even when per_tool rails were configured. Scoped to the per-tool loop, not the fixed global tool call validation.
fix(agent-mesh): return structured 503 when PolicyProviderHandler engine evaluation fails microsoft/agent-governance-toolkit
Policy engine evaluation failures in the PolicyProviderHandler ASGI endpoint now return a structured HTTP 503 instead of 500, matching server/policy_server.py and keeping evaluation failures distinct from allow/deny decisions. If your client retries on 5xx, unusable policy state is now signalled as transient.
Raise the supported Node floor to 22.12, and move CI to Node 22 anthropics/sandbox-runtime
engines.node moves from >=20.11.0 to >=22.12.0 and CI moves from Node 20 to Node 22, since Node 20 is EOL and 22.12.0 is the first 22.x release where JSON modules and import attributes are no longer experimental. The packed-package check now runs on Node 22 only.
Action items
- → Require Node 22.12.0 or newer before upgrading anthropics/sandbox-runtime; Node 20 is no longer supported anthropics/sandbox-runtime [plan]
