Complementary evidence layer: offline-verifiable attestation on top of MCP tool-call audit logs (iqa-mcp)

[Aicent-com]

Higress covers the MCP hosting surface impressively — unified authentication, fine-grained rate limiting, complete tool-call audit logs, rich observability, and openapi-to-mcp for bringing existing APIs online as hosted MCP servers. One refinement worth considering for the audit capability specifically:

The gap (a precise one): Higress already records complete tool-call audit logs — but those logs live inside the Higress deployment. They answer "what happened" for the operator; they cannot be handed to an external party (auditor, downstream service, compliance framework, or the enterprise whose data the tools touched) as independently verifiable evidence. A log can be edited after the fact; the verifier has no choice but to trust the operator. The distinction matters most precisely where Higress is strongest: multi-tenant MCP hosting, where tool calls cross organizational boundaries.

Suggested direction: an optional evidence layer beside the audit log — compact cryptographic attestations emitted when tool calls pass through the gateway, verifiable offline by anyone, forever, with zero round-trips. We open-sourced a minimal reference implementation that works with any MCP-capable deployment:

• iqa-mcp (Apache-2.0, on PyPI): four MCP tools — derive_route_shard (intent-address derivation from any authority, no registry) / parse_envelope (128-byte AE-128 attestation envelope) / verify_envelope (constant-time HMAC-SHA256 full-frame verification + lease check, fail-closed) / published_vector (conformance test vectors for byte-level self-checks)

• Reference implementation: iqa-org v1.3.1 (PyPI / npm / crates.io)

• Specification: IETF Independent Submission draft draft-li-rttp-iqa-addressing (in review)

Positioning — complement, not replacement: the gateway keeps doing real-time governance (auth, rate limiting, audit logging); the evidence layer proves after the fact. It requires no changes to Higress — iqa-mcp runs as a separate MCP server next to the gateway, and attestations reference the derived intent address, not gateway internals. No governance logic is added to Higress itself.

The published_vector tool follows the reproducibility spirit of CNCF projects: results anyone can re-verify byte-for-byte, not just trust.

Happy to draft a short integration sketch (a Higress plugin emitting envelopes alongside tool-call audit entries) if useful.