Secure Context Trust Pack

Why this page exists. Agents are only as safe as the context they are allowed to consume. This pack turns SecurityRecipes from a useful docs corpus into an inspectable context supply chain for MCP-backed agentic remediation.

The product bet

SecurityRecipes is positioned as the secure context layer for agentic AI. That means the product has to answer more than “what prompt should I use?” It has to answer:

  • Which context roots can an agent retrieve?
  • Who owns each root?
  • Which hash proves the current version?
  • Is retrieved text policy, guidance, evidence, runtime code, or prohibited data?
  • How is prompt injection in retrieved content handled?
  • Which context package is approved for a workflow?

The Secure Context Trust Pack answers those questions in one generated artifact. It is designed for AI platform intake, MCP server approval, retrieval-augmented-agent design review, procurement security, and trust review diligence.

Workflow at a glance

Secure Context Trust Pack workflow

Build workflow-bound context packages from registered, owned, hashed, fresh, poisoning-scanned, and policy-classified sources.

secure-context

  1. Signal

    Register context sources

    Capture root, owner, purpose, trust tier, retrieval modes, file globs, freshness, prohibited classes, and poisoning controls.

  2. Scope

    Hash and classify content

    Inventory approved files, calculate stable hashes, classify evidence/policy/guidance/runtime roles, and identify sensitive content.

  3. Decision

    Assemble workflow packages

    Select the minimum sources and paths needed by each workflow and bind retrieval, citation, egress, and handoff rules.

  4. Action

    Validate package trust

    Check ownership, source/path/hash integrity, freshness, poisoning results, prohibited content, completeness, and policy compatibility.

  5. Proof

    Publish the trust pack

    Write package/source hashes, allowed uses, controls, owners, expiry, evidence, and recertification triggers for runtime lookup.

Decision gate

Are every source and workflow package owned, current, hash-bound, clean, minimally scoped, and policy-compatible?

Proceed

Publish the package for bounded retrieval and attestation.

Hold or stop

Hold unknown, stale, changed, poisoned, overbroad, unowned, or prohibited context.

Evidence to retain

  • source registry and file hashes
  • workflow package composition
  • trust validation report

Expected outputs

  • secure-context trust pack
  • workflow context package
  • recertification gap list

What was added

The secure context trust and release path has five artifacts:

  • data/context/secure-context-registry.json - the source registry for context roots, owners, trust tiers, retrieval decisions, freshness expectations, poisoning controls, and prohibited context classes.
  • data/evidence/secure-context-trust-pack.json - the generated pack with source hashes, registered file counts, retrieval contracts, and per-workflow context package hashes.
  • scripts/generate_secure_context_trust_pack.py - the deterministic trust-pack generator and drift checker.
  • data/context/secure-context-release-pack.json - the generated channel, source-hash, signature, poisoning, and eval release contract.
  • scripts/evaluate_secure_context_release_decision.py - the runtime decision before context is promoted to an open, production MCP, or trust-center channel.

Run it locally from the repo root:

python3 scripts/generate_secure_context_trust_pack.py
python3 scripts/generate_secure_context_trust_pack.py --check
python3 scripts/generate_secure_context_release_pack.py
python3 scripts/generate_secure_context_release_pack.py --check

Evaluate the current open-reference release. The checked-in source pack intentionally holds while the documented poisoning findings remain unresolved, which makes the safety state explicit instead of silently promoting context:

python3 scripts/evaluate_secure_context_release_decision.py \
  --release-id open-remediation-context-release \
  --channel-id open-reference \
  --environment open_reference \
  --source-id recipes \
  --expect-decision hold_for_poisoning_review

The local MCP server exposes the same bundle through recipes_secure_context_trust_pack. Runtime retrieval decisions stay with scripts/evaluate_secure_context_retrieval.py and the Secure Context Firewall. There is no separate MCP tool that bypasses that evaluator.

What is inside the pack

Section Purpose
context_trust_summary Counts for registered sources, files, bytes, trust tiers, source kinds, decisions, risk families, and workflow context packages.
context_sources Approved context roots with owner, kind, trust tier, retrieval modes, source hash, registered files, risk families, and instruction-handling rules.
retrieval_decision_contract The default-deny decision model for public context, policy context, customer runtime context, unregistered context, and prohibited context.
workflow_context_map Per-workflow context package hashes and approved source IDs for MCP-backed agent runs.
source_artifacts Canonical hashes for the secure context registry and workflow manifest.
trust_tiers Public reference, curated guidance, policy context, customer runtime context, and prohibited context tiers.

Retrieval rules

The pack makes five rules explicit:

  1. Retrieved context is evidence, not instruction.
  2. System, developer, gateway, and human-review policy outrank retrieved text.
  3. Every returned context bundle carries source ID, path, hash, trust tier, freshness state, and citation requirement.
  4. Customer runtime context stays tenant-side.
  5. Secrets, private keys, signing material, raw tokens, and unrestricted personal data are prohibited retrieval targets.

That keeps the product easy for agents: ask the MCP tool for the context package, cite the source hash, and do not guess whether unregistered context is safe.

Industry alignment

This feature follows current primary guidance:

How to use it

For workflow approval, query the context package:

recipes_secure_context_trust_pack(workflow_id="vulnerable-dependency-remediation")

For source review, query a source:

recipes_secure_context_trust_pack(source_id="workflow-control-plane")
recipes_secure_context_trust_pack(trust_tier="tier_2_policy_context")

For gateway design, start with retrieval_decision_contract. The default is deny_unregistered_context; customer runtime context holds for tenant-side controls; prohibited context kills the session.

For runtime enforcement, evaluate the specific context request before retrieval:

python3 scripts/evaluate_secure_context_retrieval.py \
  --workflow-id vulnerable-dependency-remediation \
  --source-id recipes \
  --retrieval-mode workflow_prompt_context \
  --requested-path content/recipes/general/base-image-bump.md \
  --expect-decision allow_public_context

CI contract

The generator fails if:

  • A registered context root does not exist.
  • A root has no matching files.
  • A source misses its trust-tier controls.
  • Default workflow context sources are not registered.
  • Registered sources fail to cover the required risk families.
  • The workflow manifest has no MCP context to package.
  • The checked-in pack is stale in --check mode.

That is the enterprise bar for a secure context layer: context is registered, hashed, owned, tiered, cited, and validated before agents use it.

See also