RFC Discussion

[h3xxit]

I've just uploaded a draft for the RFC for the version 1.0.0. It is a bit different than the current implementation, as we've already leaned a few things through the discussions we had on 0.1. Lets use this issue as a discussion ground for improving the draft.

[EwoutH]

Awesome! A direct link to the RFC itself: https://github.com/universal-tool-calling-protocol/utcp-specification/blob/main/RFC.md

[rabbidave]

This seems more complicated than simply imposing a minimum viable JSON schema for n-microservices:

https://github.com/cosai-oasis/ws4-secure-design-agentic-systems/blob/main/rfc-mcp_handshake.md

Also how do we validate identity or do delegated authority?

[h3xxit]

This seems more complicated than simply imposing a minimum viable JSON schema for n-microservices:

I'm not sure if I agree. For a tool provider this is literally just making a JSON schema available. And best of all, this doesn't even have to be made by the tool provider, it could also be provided by a trusted registry.

https://github.com/cosai-oasis/ws4-secure-design-agentic-systems/blob/main/rfc-mcp_handshake.md

This doesn't seem to have the same goal like UTCP at all. I see that this is concerned with adding security and identity checks to patch up the problems that MCP brings. UTCPs goal is that if a user can access an API securely, and agent should be able to do so under the same guarantees and constraints, and this is done by not reinventig existing infrastructure but reusing it.

Also how do we validate identity or do delegated authority?

So continuing my previous point, the tools is just as secure as it would be if a user calls it. The only new vector where we need to be concerned about validating identity is the endpoint where we get the Manual json from. I would love some feedback on how this could be improved. Of course, in production this is trivial to solve, by just downloading the manual, and providing it as a text file that has been manually checked. This can also easily be updated when it falls out of sync and automated checks can also be implemented as required.

[Fannon]

The link to the RFC seems to be broken: https://github.com/universal-tool-calling-protocol/utcp-specification/blob/main/RFC.md

It's also linked from the main github org.

A few ideas / observations:

• RFC stands for "Request for Comments". If you write RFC, you should also indicate what the RFC is about.
• If you already have a stable specification, I'm not sure if I would call it an RFC anymore - but that's debatable as many RFCs have become de-facto standards under IETF. But if you call it RFC, it might sound like it's an IETF standard which it currently isn't (?).
• From the spec repo there's no direct link to the documentation in the "About" section top right, I think this would be good to add.

[h3xxit]

Yeah the RFC was made before the 1.0 release, which is when we wanted to get more feedback on the general structure of the protocol. Its now at https://github.com/universal-tool-calling-protocol/utcp-specification/blob/main/about/RFC.md but its a bit outdated, as the 1.0 stable specification came out.

Thanks for the pointer on the About section. Have added the link