Paper

{
  "raw_xml": "<entry>\n    <id>http://arxiv.org/abs/2603.23801v1</id>\n    <title>AgentRFC: Security Design Principles and Conformance Testing for Agent Protocols</title>\n    <updated>2026-03-25T00:25:02Z</updated>\n    <link href='https://arxiv.org/abs/2603.23801v1' rel='alternate' type='text/html'/>\n    <link href='https://arxiv.org/pdf/2603.23801v1' rel='related' title='pdf' type='application/pdf'/>\n    <summary>AI agent protocols -- including MCP, A2A, ANP, and ACP -- enable autonomous agents to discover capabilities, delegate tasks, and compose services across trust boundaries. Despite massive deployment (MCP alone has 97M+ monthly SDK downloads), no systematic security framework for these protocols exists.\n  We present three contributions. First, the Agent Protocol Stack, a 6-layer architectural model that defines what a complete agent protocol must specify at each layer -- analogous to ITU-T X.800 for the OSI stack. Second, the Agent-Agnostic Security Model, 11 security principles formalized as TLA+ invariants, each tagged with a property taxonomy (spec-mandated, spec-recommended, aasm-hardening, aps-completeness) that distinguishes protocol non-conformance from framework-imposed security requirements. Third, AgentConform, a two-phase conformance checker that (i)extracts normative clauses from protocol specifications into a typed Protocol~IR with explicit Protocol/Environment/Adversary action separation, (ii)compiles the IR into TLA+ models and model-checks them against AASM invariants, then (iii)replays counterexample traces against live SDK implementations to confirm findings.\n  We introduce the Composition Safety (CS) principle: security properties that hold for individual protocols can break when protocols are composed through shared infrastructure. We demonstrate this with formal models of five protocol composition patterns, revealing cross-protocol design gaps that individual protocol analysis cannot detect. Preliminary application to representative agent protocols reveals recurrent gaps in credential lifecycle, consent enforcement, audit completeness, and composition safety. Some findings are under coordinated disclosure; full evaluation details will be released in the complete version.</summary>\n    <category scheme='http://arxiv.org/schemas/atom' term='cs.CR'/>\n    <published>2026-03-25T00:25:02Z</published>\n    <arxiv:primary_category term='cs.CR'/>\n    <author>\n      <name>Shenghan Zheng</name>\n    </author>\n    <author>\n      <name>Qifan Zhang</name>\n    </author>\n  </entry>"
}