[Agentproto] Re: New Version Notification for draft-xu-mcp-agent-did-framework-00.txt

[Sumit Ahuja <[e-mail]>]

Tiger,

One question about the three discovery mechanisms, from my intensive background in routing.

The draft defines URL derivation from the DID, DNS-based discovery, and directory-based capability queries. I could not find what a client does when two of them answer differently for the same DID.

Routers hit this constantly. The same prefix arrives from OSPF, from BGP, and from a static route, and the router must install one. The tie-break is a per-protocol preference, called administrative distance on some platforms and route preference on others, and it is local configuration rather than protocol state.

The operational consequence is the one worth carrying across. Those default preferences were never standardised, so two routers holding identical inputs install different routes and neither is wrong. Every cross-vendor deployment that skips pinning them discovers this later, usually during a failure.

Two MCP clients resolving one DID, one deriving the URL and one querying the directory, can reach different endpoints and both conform. Across a trust boundary that is an interoperability failure rather than a configuration choice, because neither party can see which mechanism the other used.

So: does the framework intend a precedence among the three, or does it intend them to agree by construction? Either is defensible. Neither is currently stated.

Sumit P. Ahuja
Main Labs

On Sat, Aug 29, 2026 01:27 AM, Tiger Xu <[e-mail]> wrote:
> Hi all,
> 
> The draft describes how MCP Clients and Servers can use did:web and did:key to establish mutual trust, discover service endpoints, and obtain fine-grained authorization. It defines DID Document extensions for MCP endpoint and directory discovery, a challenge-response authentication protocol, and integration with OAuth 2.0. The goal is to support open, multi-agent MCP deployments without requiring centralized client registration or shared secrets.
> 
> Any comments or suggestions are welcome.
> 
> Best regards,
> Tiger
> 
> 发件人: [e-mail] <mailto:[e-mail]> <[e-mail] <mailto:[e-mail]>>
> 日期: 星期六, 2026年8月15日 23:37
> 收件人: Xiaohu Xu <[e-mail] <mailto:[e-mail]>>
> 主题: New Version Notification for draft-xu-mcp-agent-did-framework-00.txt
> 
> A new version of Internet-Draft draft-xu-mcp-agent-did-framework-00.txt has
> been successfully submitted by Xiaohu Xu and posted to the
> IETF repository.
> 
> Name:     draft-xu-mcp-agent-did-framework
> Revision: 00
> Title:    DID-Based Service Discovery, Authentication, and Authorization Framework for MCP Agents
> Date:     2026-08-15
> Group:    Individual Submission
> Pages:    22
> URL:      https://www.ietf.org/archive/id/draft-xu-mcp-agent-did-framework-00.txt
> Status:   https://datatracker.ietf.org/doc/draft-xu-mcp-agent-did-framework/
> HTMLized: https://datatracker.ietf.org/doc/html/draft-xu-mcp-agent-did-framework
> 
> 
> Abstract:
> 
>    This document proposes a DID-based framework for service discovery,
>    authentication, and authorization of MCP (Model Context Protocol)
>    Agents, based on the W3C Decentralized Identifier (DID) standard.
>    The framework uses the did:web and did:key methods to provide
>    verifiable, decentralized identifiers for MCP Clients and Servers.
>    It defines DID method selection, DID Document extensions, service
>    discovery mechanisms (including URL derivation, DNS-based discovery,
>    and directory-based capability queries), and a challenge-response
>    mutual authentication protocol.  The framework also describes
>    coexistence with OAuth 2.0 and enables trust establishment, dynamic
>    capability-based service discovery, and fine-grained authorization
>    with portable identities.
> 
> 
> 
> The IETF Secretariat
> 
> 
> _______________________________________________
> Agentproto mailing list -- [e-mail] <mailto:[e-mail]>
> To unsubscribe send an email to [e-mail] <mailto:[e-mail]>