Eclipse Revoke MCP
signed revocation lists for agent cards, keys, and mandates — one feed, every registry, revocation that actually propagates.
status: in-developmentclass: mcpIdentity, Trust & Reputation
Vendor: Cyan Eclipse Technologies
What it does
- Issuer-only origination: a revocation record is accepted only when its signature verifies against the registry key of the identity that issued the original artifact (or its recorded successor) — any other signer refuses REVOKE_NOT_ISSUER by name and is receipted as a violation attempt; Revoke distributes revocations, it never originates one for an artifact it does not hold
- Four subject classes (cards, keys, mandates, attestations) under a closed reason vocabulary (KEY_COMPROMISED / ISSUER_ROTATED / SUBJECT_RETIRED / POLICY / ISSUER_ERROR); records are append-only and hash-chained per issuer with full provenance
- list_publish derives epoch-versioned signed lists (full + delta) from the record store — recomputable from the records, so a list that disagrees with its records fails verification; revocation_check is a pure offline function of a list copy; staleness and epoch divergence are announced, never silent
- A mistaken revocation is corrected by the issuer's signed counter-notice — both records remain and a check shows the pair's net effect; subscribers acknowledge epochs with signed propagation receipts surfaced by feed_status
- Family T3 is empty: there is no enforcement verb — nothing delists, blocks, freezes or takes down anything; external distribution (G-REG/G-LIVE per consumer), emergency revocation classes (G-COUNSEL) and any live push are held gates, not built
Tools
revoke_issue · revoke_counter_notice · list_publish · revocation_check · feed_status · feed_acknowledge
Platforms
- MCP over stdio — local v0.1 build; offline revocation checks against signed list copies
Certification
Bench verdict: CERTIFIED(local)
Certified scope: CERTIFIED(local) — Eclipse Bazaar Test Bench 2026-10-26, standing card run 3 (scoped re-bench #2): 13 pass, 0 na of 13 checks — the C13/B1 provenance battery plus genuine-path controls, with run 2's closures standing. Bench history retained append-only: run 1 FAILED (D1–D3, test-bench/results/eclipse-revoke-mcp-2026-10-26.json) and run 2 FAILED (D4 — list-verification laundering, eclipse-revoke-mcp-2026-10-26-2.json); run 3 proves all four D4 variants (fingerprint-laundered recomputed, stripped sig/fingerprint, foreign unsigned epoch-9, foreign validly-attacker-signed) now cap at LIST_VERIFICATION_FAILED for hits AND absent refs, while genuine paths (supplied + stored) answer REVOKED_BY_ISSUER / COUNTER_NOTICED / NOT_LISTED exactly as before. CEILING: CERTIFIED(local) for own-issuer feed + offline check over fixture issuers. External distribution of the feed to registries/merchants is NOT built (T2 + G-REG/G-LIVE per consumer) — list_publish writes the local store only and v0 contains no network code; emergency revocation classes are NOT built (G-COUNSEL) — the closed reason vocabulary has no emergency class; no live push to subscribers exists. v0 signs with a local seed key (keys/, gitignored); production findings-key custody is a gated decision.
Not tested:
- External distribution of the feed to registries/merchants — NOT built (T2 + G-REG/G-LIVE per consumer); list_publish writes the local store only, no network code in v0
- Emergency revocation classes — NOT built (G-COUNSEL); the closed reason vocabulary has no emergency class
- Any live push to subscribers — NOT built; subscribers check offline against list copies and acknowledge epochs
- Production findings-key custody — v0 signs with a local seed key (keys/, gitignored, chmod 600); custody is a gated decision
Bench scorecard (evidence): https://eclipsebazaar.com/cards/eclipse-revoke-mcp-2026-10-26-3.json
Pricing
Free local v0.1; hosted feed distribution pricing TBD per spec (held, G-REG/G-LIVE + G-OWNER)
Install / verify
docker run -i ghcr.io/cyan-eclipse-technologies-llc/eclipse-revoke-mcp:latest
Verify any MCP server in your client configs against this catalog with bazaar check (Eclipse Bazaar MCP / CLI — see llms.txt).