Vendor: Cyan Eclipse Technologies · Platforms: MCP over stdio — local v0.1 build; offline revocation checks against signed list copies
Certification scope
CERTIFIED(local) — Eclipse Bazaar Test Bench 2026-10-26, standing card run 3 (scoped re-bench #2): 13 pass, 0 na of 13 checks — the C13/B1 provenance battery plus genuine-path controls, with run 2's closures standing. Bench history retained append-only: run 1 FAILED (D1–D3, test-bench/results/eclipse-revoke-mcp-2026-10-26.json) and run 2 FAILED (D4 — list-verification laundering, eclipse-revoke-mcp-2026-10-26-2.json); run 3 proves all four D4 variants (fingerprint-laundered recomputed, stripped sig/fingerprint, foreign unsigned epoch-9, foreign validly-attacker-signed) now cap at LIST_VERIFICATION_FAILED for hits AND absent refs, while genuine paths (supplied + stored) answer REVOKED_BY_ISSUER / COUNTER_NOTICED / NOT_LISTED exactly as before. CEILING: CERTIFIED(local) for own-issuer feed + offline check over fixture issuers. External distribution of the feed to registries/merchants is NOT built (T2 + G-REG/G-LIVE per consumer) — list_publish writes the local store only and v0 contains no network code; emergency revocation classes are NOT built (G-COUNSEL) — the closed reason vocabulary has no emergency class; no live push to subscribers exists. v0 signs with a local seed key (keys/, gitignored); production findings-key custody is a gated decision.
What it does
- Issuer-only origination: a revocation record is accepted only when its signature verifies against the registry key of the identity that issued the original artifact (or its recorded successor) — any other signer refuses REVOKE_NOT_ISSUER by name and is receipted as a violation attempt; Revoke distributes revocations, it never originates one for an artifact it does not hold
- Four subject classes (cards, keys, mandates, attestations) under a closed reason vocabulary (KEY_COMPROMISED / ISSUER_ROTATED / SUBJECT_RETIRED / POLICY / ISSUER_ERROR); records are append-only and hash-chained per issuer with full lineage
- list_publish derives epoch-versioned signed lists (full + delta) from the record store — recomputable from the records, so a list that disagrees with its records fails verification; revocation_check is a pure offline function of a list copy; staleness and epoch divergence are announced, never silent
- A mistaken revocation is corrected by the issuer's signed counter-notice — both records remain and a check shows the pair's net effect; subscribers acknowledge epochs with signed propagation receipts surfaced by feed_status
- Family T3 is empty: there is no enforcement verb — nothing delists, blocks, freezes or takes down anything; external distribution (G-REG/G-LIVE per consumer), emergency revocation classes (G-COUNSEL) and any live push are held gates, not built
Tools
revoke_issuerevoke_counter_noticelist_publishrevocation_checkfeed_statusfeed_acknowledge
Problems it addresses
- A key or agent card is revoked in one registry and stays trusted everywhere else — revocation that does not propagate is a press release
- Nobody may revoke someone else's artifact: origination has to be issuer-only and verifiable, with attempts receipted
- Subscribers need revocation checks that work offline against a signed list, with staleness announced — never silent
Not tested
- External distribution of the feed to registries/merchants — NOT built (T2 + G-REG/G-LIVE per consumer); list_publish writes the local store only, no network code in v0
- Emergency revocation classes — NOT built (G-COUNSEL); the closed reason vocabulary has no emergency class
- Any live push to subscribers — NOT built; subscribers check offline against list copies and acknowledge epochs
- Production findings-key custody — v0 signs with a local seed key (keys/, gitignored, chmod 600); custody is a gated decision
Bench scorecard: test-bench/results/eclipse-revoke-mcp-2026-10-26-3.json
Evaluation-intake listing
This listing records the tool's place in the Bazaar's evaluation
and monitoring pipeline, with the evidence gathered so far printed above — verdict, scope,
and not-tested items included. It is not sold on this site, and its presence in the catalog
is not a claim beyond that evidence. The service behind every verdict is the bench:
what a bench run buys →