{"_canonicalization":{"envelope_id":"axm_ + sha256(envelope minus {signature, axiom_id, anchors})","envelope_signature":"ed25519(envelope minus {signature, axiom_id})","json":"sort_keys=True, separators=(',',':'), ensure_ascii=False, allow_nan=False, utf-8","leaf_hash":"sha256(0x00 || canonical_json(envelope_full))","seal_signature":"ed25519(seal minus {signature, sig_algorithm})"},"axiom_id":"axm_1595a9b7da0b073ce02e6c9b676e91550f2ac5246334f360c6de17ffb866e40b","bitcoin_anchor":{"bitcoin_attestations":[],"calendar_attestations":[],"ots_url":"","stamped_at":"","status":"pending_next_stamp"},"envelope":{"anchors":[{"chain":"crovia.axiom_graph","height":0,"merkle_proof":"spider_vendor_press_v1","root_at_anchor":"spider_vendor_press_v1"}],"axiom_id":"axm_1595a9b7da0b073ce02e6c9b676e91550f2ac5246334f360c6de17ffb866e40b","axiom_type":"AX.OBS","body":{"axiom_subtype":"news.vendor_press.v1","category":"news","fingerprint":"7e5eb5acd9884a5362e42299ef7a807a4b064aadfa08fdafecaebb2b8b3b5841","published":"Wed, 22 Jul 2026 00:00:00 -0400","receipt_hash":"7e5eb5acd9884a5362e42299ef7a807a4b064aadfa08fdafecaebb2b8b3b5841","schema":"spider.news.vendor_press.v1","spider":"vendor_press","spider_record":{"axiom_subtype":"news.vendor_press.v1","category":"news","decision_hint":"POSITIVE","envelope_target":"AX.OBS","fingerprint":"7e5eb5acd9884a5362e42299ef7a807a4b064aadfa08fdafecaebb2b8b3b5841","observed_at":"2026-07-22T04:43:18.261256Z","parent_run_hash":"4765c85b8b4b27ff9a690c1ae11c3b009baa2c60297295f395ad422f5afed68c","published":"Wed, 22 Jul 2026 00:00:00 -0400","runtime_version":"0.1.0","schema":"spider.news.vendor_press.v1","source_status":200,"source_url":"https://export.arxiv.org/rss/cs.AI","spider":"vendor_press","summary_excerpt":"arXiv:2603.07473v2 Announce Type: replace-cross \nAbstract: The Model Context Protocol (MCP) is an open and standardized interface that enables large language models (LLMs) to interact with external tools and services, and is increasingly adopted by AI agents. However, the security of MCP-based systems remains largely unexplored.In this work, we conduct a large-scale security analysis of MCP servers integrated within MCP clients. We show that treating MCP servers as trusted entities without authenticating the caller identity is fundamentally insecure. Since MCP servers often cannot distinguish who is invoking a request, a single authorization decision may implicitly grant access to multiple, potentially untrusted callers.Our empirical study reveals that most MCP servers rely on persistent authorization states, allowing tool invocations after an initial authorization without re-authentication, regardless of the caller. In addition, many MCP servers fail to enforce authentication at the p","title":"Give Them an Inch and They Will Take a Mile:Understanding and Measuring Caller Identity Confusion in MCP-Based AI Systems","url":"https://arxiv.org/abs/2603.07473","vendor":"arxiv_cs_ai"},"summary":"arXiv:2603.07473v2 Announce Type: replace-cross \nAbstract: The Model Context Protocol (MCP) is an open and standardized interface that enables large language models (LLMs) to interact with external tools and services, and is increasingly adopted by AI agents. However, the security of MCP-based systems remains largely unexplored.In this work, we conduct a large-scale security analysis of MCP servers integrated within MCP clients. We show that treating MCP servers as trusted entities without authenticating the caller identity is fundamentally insecure. Since MCP servers often cannot distinguish who is invoking a request, a single authorization decision may implicitly grant access to multiple, potentially untrusted callers.Our empirical study reveals that most MCP servers rely on persistent authorization states, allowing tool invocations after an initial authorization without re-authentication, regardless of the caller. In addition, many MCP servers fail to enforce authentication at the p","title":"Give Them an Inch and They Will Take a Mile:Understanding and Measuring Caller Identity Confusion in MCP-Based AI Systems","vendor":"arxiv_cs_ai"},"confidence":{"method":"deterministic"},"decision":"POSITIVE","issued_at":"2026-07-22T04:43:18Z","notes":"Spider vendor_press (news) news.vendor_press.v1","object":{"captured_by":"crovia.spider.vendor_press","primary_source_url":"https://arxiv.org/abs/2603.07473"},"predecessors":[],"schema":"crovia.axiom.v1","signature":"ed25519:787c566966da8235fafddea07da58b8dd9d132bc5b149e81d01dd3a2d7d25c2b457c53dd7af9f27f30b5b929962b98d4884d21c41b80cc25227343e3de796209","signer":"crovia.substrate","subject":{"observed_at":"2026-07-22T04:43:18Z","source_collector":"spider:vendor_press","target_id":"https://arxiv.org/abs/2603.07473"},"tsa":{"authority":"crovia.substrate.bootstrap","rfc3161_token":"{\"kind\":\"crovia.bootstrap.tsa\",\"source_jsonl\":\"/opt/crovia/spider/data/news/vendor_press_v1.jsonl\",\"source_seal_merkle_root\":\"spider_vendor_press_v1\",\"upgrade_path\":\"Sessione H \\u2014 OpenTimestamps weekly anchor\"}"},"zk_mode":"clear","zk_proof":null},"ledger":{"leaf_hash":"bf064c6c565f2ea001c05f76444f2daa7f37c0a515be9f9038ddde3f7dfe482f","leaf_index":340392,"ledger_path":"/opt/crovia/substrate/axiom_ledger.jsonl"},"merkle_proof":{"hash_alg":"sha256","leaf_prefix":"0x00","node_prefix":"0x01","odd_leaf_rule":"duplicate_last","path":[{"sibling":"098510de2d4a899ed0f9470e4064fda9f8d01d7d4d5b33bbc287b380fd62c8a6","side":"right"},{"sibling":"7aa6bdc4b8add000434397aea1f9949e74fb885ccb6eee1b99e6ce0074acb5d3","side":"right"},{"sibling":"69e711af5052cf57b1ad08f0dc99e1e8fb9c366f8f707f48716313cba27c1bca","side":"right"},{"sibling":"3d2b938b66003a56bf04f392e9250c737cadbe43c280ddde2299c93799b23037","side":"left"},{"sibling":"5479da9816ceb0e0c23c3cccb18802cf00732d9231bf5fcd6ede059966ff2dd5","side":"right"},{"sibling":"0387640d1bd86930c3a475773f8be66543d7e35a50da52b38b1b8dff015cc327","side":"left"},{"sibling":"1a7746a9d2d9e8d0c0c963bb863236e36a37257d8f3cb326049f3125bab1b3b1","side":"right"},{"sibling":"5666268df88c3cf54274085bda986b69261da088d4bea21e6975025aadd566d3","side":"left"},{"sibling":"99d4b7aea5e7c917c580af0f1a9556bbd4d44f3f36cf9391892e7ef0340a8258","side":"left"},{"sibling":"c7fc9d4187cdc36f4c03b4b13daf4b880ea65536b051f71a5cc2543839d02697","side":"right"},{"sibling":"1758ec6ac206ce40e8368cb702195322fe3737d0fb03d8bd9e3b30acc4fa7d81","side":"right"},{"sibling":"0c407f0d553cf3fab8f9bd79205b8180e090cbf29fa0490ebb55155041ad5c86","side":"right"},{"sibling":"2dd9cb2521044ee7c6b74f2315e0a0253b8df0d04a7b810bbbbe7da5a9788769","side":"left"},{"sibling":"21d66dd41003813f710b7617944f1bfba3258658a5d3370c21cad8f9e945bc99","side":"left"},{"sibling":"787ee3744642ff909d610b0514cb100784f0ef1ba0ef4c70a0dc91f0ab2bb192","side":"right"},{"sibling":"9fc8a8ebbc1bff7e62b9f1e1c681c91e7196092ce9551573df6e23096df13e4d","side":"right"},{"sibling":"77025bcb374a7ad74f520643e20a8ae1205a7ee78507b0beb93117760f1c29d3","side":"left"},{"sibling":"ee6f33920899d9bdef2eb706dfff29e26eea61e29ea9824c6c8e6bcd48275d76","side":"right"},{"sibling":"1cecb7f447febd025aac272837c80de218aecc6485d2395a509b2a1f1b9c746e","side":"left"}]},"schema":"crovia.axiom_proof.v1","seal":{"first_collector_run_id":"","first_receipt_hash":"","jsonl_path":"/opt/crovia/substrate/axiom_ledger.jsonl","key_id":"430895f101d38164","last_collector_run_id":"","last_receipt_hash":"","leaf_count":340557,"merkle_root":"7d45d94f20b5bf82263df45b87749e19e06161972f25141dd573cc138d566338","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","run_id":"hourly_json_retrofit_20260722T053701Z","schema":"crovia.seal.v1","seal_family_version":"crovia-seal-family/1","seal_kind":"substrate_batch","sealed_at":"2026-07-22T05:38:39Z","sig_algorithm":"ed25519","signature":"812cb61e90d3582ba508db8515c4168bbf8ee1c6762885609049d012f680f8068f15c98b9accf2042047dcfc6a6fc3885820ee34b0be350846386f64f2591309","signer_version":"1.1.0"},"trust_root":{"key_id":"430895f101d38164","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","signature_algorithm":"ed25519","url":"/registry/canon/TRUST_ROOT.md"},"verifier":{"spec":"/registry/canon/AXIOM_RECEIPT_v1.md","url":"/v/axm_1595a9b7da0b073ce02e6c9b676e91550f2ac5246334f360c6de17ffb866e40b"}}