Agentic Source Freshness Watch

What this is. The Source Freshness Watch makes “up to date” an inspectable product claim. It tracks the primary sources that drive the SecurityRecipes evidence packs, checks when dependent packs were last reviewed, and exposes the result as generated JSON plus an MCP tool.

Rechecked source anchors against the public MCP specification 2026-07-28 on August 21, 2026.

SecurityRecipes is positioned as The Secure Context Layer for Agentic AI. That category depends on trust: a reviewer needs to know not only what the site says, but whether its source-backed controls still track the latest protocol, standards, government, and frontier-lab guidance.

The Agentic Source Freshness Watch fills that gap. It treats source references as maintained dependencies, similar to libraries in a software supply chain.

Feature decision

This run considered three high-value product directions:

Candidate Value Decision
Hosted context signing Strong hosted-ready proof path for production MCP, but the repo already has attestation and release-gate foundations. Keep as next hosted layer.
More protocol conformance Valuable, but MCP and A2A conformance already exists as a generated pack. Extend later with live probes.
Source freshness and standards drift Directly strengthens every existing evidence pack and answers the reviewer question: “How do we know this is current?” Implemented now.

Workflow at a glance

Agentic Source Freshness Watch workflow

Continuously verify the age, availability, hash, version, and ownership of sources used to drive agent decisions.

agent-assurance

  1. Signal

    Load the source registry

    Enumerate source IDs, owners, URLs/paths, hashes, versions, refresh intervals, trust tiers, and dependent packs/workflows.

  2. Scope

    Check current source state

    Fetch or inspect metadata, availability, timestamps, content hashes, signatures, redirects, and upstream version signals.

  3. Decision

    Classify freshness

    Mark current, approaching expiry, stale, changed, unavailable, unowned, or conflicting using source-specific policy.

  4. Action

    Protect dependent decisions

    Refresh and recertify, warn, hold generated packs, disable retrieval, or block runtime use based on impact.

  5. Proof

    Publish the watch record

    Record observations, diffs, affected workflows/packs, decisions, owners, SLAs, and next check.

Decision gate

Is the source available, owner-attested, within its freshness window, and unchanged or recertified?

Proceed

Continue dependent generation and runtime use until the next check.

Hold or stop

Warn, hold, or disable dependent use when age, hash, availability, ownership, or conflict checks fail.

Evidence to retain

  • registry and observed metadata
  • hash/version/freshness comparison
  • dependent-impact decision

Expected outputs

  • source freshness report
  • recertification task
  • runtime hold record

Generated artifact

  • Profile: data/assurance/agentic-source-freshness-profile.json
  • Generator: scripts/generate_agentic_source_freshness_watch.py
  • Evidence pack: data/evidence/agentic-source-freshness-watch.json
  • MCP tool: recipes_agentic_source_freshness_watch

Regenerate and validate:

python3 scripts/generate_agentic_source_freshness_watch.py
python3 scripts/generate_agentic_source_freshness_watch.py --check

What it watches

The watch currently monitors source references and last-reviewed dates from the product’s most reviewer-relevant evidence inputs:

  • Agentic Threat Radar sources.
  • Agentic Standards Crosswalk profile.
  • Agentic Protocol Conformance profile.
  • MCP and Agentic Skills Risk Coverage profile.
  • MCP Authorization Conformance profile.
  • Secure Context Release profile.
  • Agentic Catastrophic Risk Annex.
  • Agentic Incident Response profile.

Each watched source has a review cadence and a default fail-closed decision if the pack is missing, has no references, or is past its review window.

Primary source anchors

The primary watchlist tracks sources that currently matter most for the SecurityRecipes category claim:

Enterprise use cases

Procurement security. Return the watched packs, source references, last-reviewed dates, publisher coverage, and review-due findings before a reviewer relies on the site for an AI platform decision.

AI platform standards drift. Use the watch as the quarterly agenda for MCP, A2A, OWASP, NIST, CISA, OpenAI, and CSA guidance changes.

trust review diligence. Show that SecurityRecipes is maintained as a living control plane with generated evidence, not a static prompt library.

MCP examples

Inspect the overall freshness watch:

recipes_agentic_source_freshness_watch()

Review one watched pack:

recipes_agentic_source_freshness_watch(
  watched_source_id="agentic-protocol-conformance-profile"
)

Find source references from one publisher family:

recipes_agentic_source_freshness_watch(
  publisher_family="NIST"
)

Find references tied to protocol specifications:

recipes_agentic_source_freshness_watch(
  source_class_family="protocol"
)

Trusted-source path

The open pack proves the operating model. The hosted product surface is standards and source-drift monitoring:

  • customer-private source maps,
  • MCP and A2A protocol update alerts,
  • source freshness SLAs,
  • generated review tickets,
  • trust-center freshness exports,
  • source-pack recertification evidence,
  • alerts when a source change should regenerate evals, gateway policy, conformance checks, or context release manifests.

That is a natural enterprise layer above the open SecurityRecipes knowledge base and a credible trust review wedge for a model lab, security platform, cloud platform, or developer-tool company.

See also