{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:NTM3OW7D5BJJ2UVAFDNJZYCFZI","short_pith_number":"pith:NTM3OW7D","canonical_record":{"source":{"id":"2607.05744","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-07T02:01:44Z","cross_cats_sorted":["cs.AI","cs.SE"],"title_canon_sha256":"7d259163652decb4bfd3edebb710254e5541bef8a3f1c1e1d8faf3f2058bd2ba","abstract_canon_sha256":"6c933b5072f36793b48be7a989cdebc34080367ad9ff51c57c81bce87bf8370f"},"schema_version":"1.0"},"canonical_sha256":"6cd9b75be3e8529d52a028da9ce045ca1c51a773ff091cd4059b008879fd51d1","source":{"kind":"arxiv","id":"2607.05744","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.05744","created_at":"2026-07-08T01:18:43Z"},{"alias_kind":"arxiv_version","alias_value":"2607.05744v1","created_at":"2026-07-08T01:18:43Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.05744","created_at":"2026-07-08T01:18:43Z"},{"alias_kind":"pith_short_12","alias_value":"NTM3OW7D5BJJ","created_at":"2026-07-08T01:18:43Z"},{"alias_kind":"pith_short_16","alias_value":"NTM3OW7D5BJJ2UVA","created_at":"2026-07-08T01:18:43Z"},{"alias_kind":"pith_short_8","alias_value":"NTM3OW7D","created_at":"2026-07-08T01:18:43Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:NTM3OW7D5BJJ2UVAFDNJZYCFZI","target":"record","payload":{"canonical_record":{"source":{"id":"2607.05744","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-07T02:01:44Z","cross_cats_sorted":["cs.AI","cs.SE"],"title_canon_sha256":"7d259163652decb4bfd3edebb710254e5541bef8a3f1c1e1d8faf3f2058bd2ba","abstract_canon_sha256":"6c933b5072f36793b48be7a989cdebc34080367ad9ff51c57c81bce87bf8370f"},"schema_version":"1.0"},"canonical_sha256":"6cd9b75be3e8529d52a028da9ce045ca1c51a773ff091cd4059b008879fd51d1","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-08T01:18:43.655929Z","signature_b64":"aNPJla9IlwdnHfwPPTgh8imiIEcBk+tS0wpD7csUfwviib/zSOmETg/VTXZAOi15LHeW+8BhXtDEciCLw5ayDg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"6cd9b75be3e8529d52a028da9ce045ca1c51a773ff091cd4059b008879fd51d1","last_reissued_at":"2026-07-08T01:18:43.655490Z","signature_status":"signed_v1","first_computed_at":"2026-07-08T01:18:43.655490Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2607.05744","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-08T01:18:43Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"DXiE4/nz0kydG73eoBC4Hd97+KTvhOu+PSWFEOmgfKPZ/0MyDF2vOe7LXwNGa3OXIwHLFgAbDJejEzP76VcADw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-21T01:54:50.465899Z"},"content_sha256":"1a7ce32b020a5b944dcdd3bc13e12f14c5f7fb8ee3a649e40641d0b481901ada","schema_version":"1.0","event_id":"sha256:1a7ce32b020a5b944dcdd3bc13e12f14c5f7fb8ee3a649e40641d0b481901ada"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:NTM3OW7D5BJJ2UVAFDNJZYCFZI","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Unicode TAG-Block Concealment of Tool-Metadata Payloads in the Model Context Protocol: An Approval-View Fidelity Gap Across Three Independent Server Implementations","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI","cs.SE"],"primary_cat":"cs.CR","authors_text":"Mohammadreza Rashidi","submitted_at":"2026-07-07T02:01:44Z","abstract_excerpt":"The Model Context Protocol (MCP) is the dominant way coding agents discover and invoke external tools. A server advertises each tool through a tools/list handshake that returns a name, a natural-language description, and a JSON input schema. The client renders this metadata once, in a one-time approval dialog, and then injects it verbatim into the model's context on every subsequent turn. Nothing in the protocol requires the rendered approval view and the bytes delivered to the model to match. We isolate that gap as a single structural mechanism, concealment encoding, and show with a model-fre"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.05744","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2607.05744/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-08T01:18:43Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ZPJZTjES0EMNco2cHYv24zLdnKJkjXS1vr7PzTyyvZdKvK3s3DTL/+8xK+prmDKV9ltjSvTlYbb13fWYPOhoDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-21T01:54:50.466267Z"},"content_sha256":"7e152439707cf6bae13bf7b0d9e82534593dc270994f80936bc903b67c95855f","schema_version":"1.0","event_id":"sha256:7e152439707cf6bae13bf7b0d9e82534593dc270994f80936bc903b67c95855f"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/NTM3OW7D5BJJ2UVAFDNJZYCFZI/bundle.json","state_url":"https://pith.science/pith/NTM3OW7D5BJJ2UVAFDNJZYCFZI/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/NTM3OW7D5BJJ2UVAFDNJZYCFZI/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-21T01:54:50Z","links":{"resolver":"https://pith.science/pith/NTM3OW7D5BJJ2UVAFDNJZYCFZI","bundle":"https://pith.science/pith/NTM3OW7D5BJJ2UVAFDNJZYCFZI/bundle.json","state":"https://pith.science/pith/NTM3OW7D5BJJ2UVAFDNJZYCFZI/state.json","well_known_bundle":"https://pith.science/.well-known/pith/NTM3OW7D5BJJ2UVAFDNJZYCFZI/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:NTM3OW7D5BJJ2UVAFDNJZYCFZI","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"6c933b5072f36793b48be7a989cdebc34080367ad9ff51c57c81bce87bf8370f","cross_cats_sorted":["cs.AI","cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-07T02:01:44Z","title_canon_sha256":"7d259163652decb4bfd3edebb710254e5541bef8a3f1c1e1d8faf3f2058bd2ba"},"schema_version":"1.0","source":{"id":"2607.05744","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.05744","created_at":"2026-07-08T01:18:43Z"},{"alias_kind":"arxiv_version","alias_value":"2607.05744v1","created_at":"2026-07-08T01:18:43Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.05744","created_at":"2026-07-08T01:18:43Z"},{"alias_kind":"pith_short_12","alias_value":"NTM3OW7D5BJJ","created_at":"2026-07-08T01:18:43Z"},{"alias_kind":"pith_short_16","alias_value":"NTM3OW7D5BJJ2UVA","created_at":"2026-07-08T01:18:43Z"},{"alias_kind":"pith_short_8","alias_value":"NTM3OW7D","created_at":"2026-07-08T01:18:43Z"}],"graph_snapshots":[{"event_id":"sha256:7e152439707cf6bae13bf7b0d9e82534593dc270994f80936bc903b67c95855f","target":"graph","created_at":"2026-07-08T01:18:43Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2607.05744/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The Model Context Protocol (MCP) is the dominant way coding agents discover and invoke external tools. A server advertises each tool through a tools/list handshake that returns a name, a natural-language description, and a JSON input schema. The client renders this metadata once, in a one-time approval dialog, and then injects it verbatim into the model's context on every subsequent turn. Nothing in the protocol requires the rendered approval view and the bytes delivered to the model to match. We isolate that gap as a single structural mechanism, concealment encoding, and show with a model-fre","authors_text":"Mohammadreza Rashidi","cross_cats":["cs.AI","cs.SE"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-07T02:01:44Z","title":"Unicode TAG-Block Concealment of Tool-Metadata Payloads in the Model Context Protocol: An Approval-View Fidelity Gap Across Three Independent Server Implementations"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.05744","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:1a7ce32b020a5b944dcdd3bc13e12f14c5f7fb8ee3a649e40641d0b481901ada","target":"record","created_at":"2026-07-08T01:18:43Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"6c933b5072f36793b48be7a989cdebc34080367ad9ff51c57c81bce87bf8370f","cross_cats_sorted":["cs.AI","cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-07T02:01:44Z","title_canon_sha256":"7d259163652decb4bfd3edebb710254e5541bef8a3f1c1e1d8faf3f2058bd2ba"},"schema_version":"1.0","source":{"id":"2607.05744","kind":"arxiv","version":1}},"canonical_sha256":"6cd9b75be3e8529d52a028da9ce045ca1c51a773ff091cd4059b008879fd51d1","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"6cd9b75be3e8529d52a028da9ce045ca1c51a773ff091cd4059b008879fd51d1","first_computed_at":"2026-07-08T01:18:43.655490Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-08T01:18:43.655490Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"aNPJla9IlwdnHfwPPTgh8imiIEcBk+tS0wpD7csUfwviib/zSOmETg/VTXZAOi15LHeW+8BhXtDEciCLw5ayDg==","signature_status":"signed_v1","signed_at":"2026-07-08T01:18:43.655929Z","signed_message":"canonical_sha256_bytes"},"source_id":"2607.05744","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:1a7ce32b020a5b944dcdd3bc13e12f14c5f7fb8ee3a649e40641d0b481901ada","sha256:7e152439707cf6bae13bf7b0d9e82534593dc270994f80936bc903b67c95855f"],"state_sha256":"b941715c4f05c1a03c36e59ff87c755aee2017f9f5dc4b148d5b28721c588b21"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"2TkGyKa+uPcieUB887OrZ7Lcv6xcyitE5yocNG6OUjIQT0agBjv3WsxWrUEbpWUaFG5Hp3AEWcgq6cBMXivcCA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-21T01:54:50.468382Z","bundle_sha256":"06703c2260457009466ce236eeeb5e38057708a9c81f1e36f1fcfb8e9c1971b8"}}