chore(deps): update cmcp-runtime requirement from >=0.3.0 to >=0.4.0

[dependabot]

Updates the requirements on cmcp-runtime to permit the latest version.

Release notes

Sourced from cmcp-runtime's releases.

cmcp v0.4.0

Upgrade from 0.3.0

0.3.0 reports a forged TPM quote as hardware-attested. The tpm2 branch of verify_trace_claim called only verify_tpm_measurement, which takes no signature parameter, so a TPMS_ATTEST blob with the correct magic and matching qualifying_data was accepted with no signature and no certificate chain. Everything in that blob is attacker-writable; the TPMT_SIGNATURE and the AK certificate chain are what bind a quote to a key inside a TPM, and neither was checked on the production path. The authenticated path existed in the package and had been validated against real hardware. Nothing in production called it.

Fixed here: the quote signature and the AK certificate chain now gate hardware_attestation. Material that is supplied and does not verify is fatal; material that is absent degrades the field to unverified rather than passing.

Not affected: SEV-SNP and TDX, which verify report signatures to their respective roots, and software-only deployments, which claim no hardware attestation.

Tracked as GHSA-q5qc-j6fh-5wxp (#370, fixed in #469).

Breaking for verifiers

Signed evidence now travels with the claim as gateway.attestation_evidence. It could not stay where it was: the claim model rejected it before the platform branch ran, which is precisely what kept the chain verifiers unreachable.

	result
0.4.0 verifier reading an older claim	fine, the fields are optional and the old location is still read as a fallback
a verifier older than 0.4.0 reading a 0.4.0 claim	CLAIM_MALFORMED on gateway.attestation_evidence

Upgrade gateways and verifiers together. Claims carrying no evidence serialize byte-identically to 0.3.0, so software-only deployments are unaffected.

Five more places assurance was over-reported

Collected in the changelog's Security section rather than left scattered, because they are one story:

• Tokenless dev mode could bind every interface. CMCP_DEV_MODE=1 skips the bearer-token requirement and the default bind is 0.0.0.0:8443, so the documented quickstart stood up an unauthenticated gateway on the host's every interface. The combination is now refused.
• A claim was issued when the per-session TEE attestation call failed (#426). close_session fell back to the startup report, which carries no chain-root commitment, and signed anyway.
• Unsigned PCR reads were reported as provider=tpm (#441). A read carries no signature; only a quote binds those values to a TPM.
• SNP report_data mismatch was not fatal (#371, #390), and a claim could reach VERIFIED with an unverified VCEK chain.
• TCG event logs were never replayed against the quoted PCR values (#443).

Known limitation

On some Azure Trusted Launch hosts the AK certificate at NV index 0x01C101D0 carries no AIA extension, so there is no chain to walk to a pinnable root. On those hosts the claim reports unverified rather than verified, which is the correct answer. This is a property of the host rather than of the verifier (#453).

Full detail in CHANGELOG.md and current status in STATUS.md.

---

What's Changed

• fix(audit): bind audit-chain root into the attested report_data by @​imran-siddique in agentrust-io/cmcp#368
• fix(ci): resolve agt CLI in release governance job by @​imran-siddique in agentrust-io/cmcp#369
• feat(docs): SEO and AEO optimization by @​imran-siddique in agentrust-io/cmcp#373
• docs(readme): lead with 'the secure, confidential way to run MCP' by @​imran-siddique in agentrust-io/cmcp#374
• docs(site): 'secure version of MCP' in description + llms.txt (AEO) by @​imran-siddique in agentrust-io/cmcp#375
• docs: reconcile documentation with the implementation by @​imran-siddique in agentrust-io/cmcp#383
• feat(tee): raise explicit not-implemented error for the opaque provider by @​imran-siddique in agentrust-io/cmcp#385
• test(agt): fix datetime.UTC AttributeError blocking unit CI by @​imran-siddique in agentrust-io/cmcp#388
• fix(verify): verify SNP report signature + VCEK chain (cmcp#370) by @​imran-siddique in agentrust-io/cmcp#386
• fix(verify): offline DCAP TDX quote verification (cmcp#370) by @​imran-siddique in agentrust-io/cmcp#387

... (truncated)

Changelog

Sourced from cmcp-runtime's changelog.

[0.4.0] - 2026-08-08

Anyone running 0.3.0 should upgrade. On 0.3.0 a forged TPM quote was reported as hardware-attested: the tpm2 branch of verify_trace_claim called only verify_tpm_measurement, which takes no signature parameter, so a TPMS_ATTEST with the correct magic and matching qualifying_data passed with no signature and no certificate chain (#370). The authenticated path existed and was tested; nothing in production called it. This release makes the quote signature and the AK certificate chain the gate on hardware_attestation, so evidence that does not chain to a pinned root can no longer report as verified.

Changed

• BREAKING for verifiers: claims now carry gateway.attestation_evidence (#469, #370). Signed platform evidence (raw_evidence, quote_signature, cert_chain, ek_cert_chain) travels inside the claim so the verifier has something to check the TPM quote against. It could not live under trace.runtime, because agentrust-trace's RuntimeInfo is extra="forbid" and rejected the claim as CLAIM_MALFORMED before the platform branch ran, which is precisely what kept the chain verifiers unreachable.

  The break is one-directional, and only for verifiers:

  	result
  this verifier reading an older claim with no evidence	fine, the fields are optional and trace.runtime is still read as a fallback
  a verifier older than 0.4.0 reading a claim from this gateway	CLAIM_MALFORMED on gateway.attestation_evidence

  GatewayAddenda and RuntimeClaim are both extra="forbid", so any additive field anywhere in the claim is rejected by a verifier built before it, and verify_trace_claim never reads cmcp_version. There is no negotiation path, so "evidence travels with the claim" and "older verifiers keep working" cannot both hold. Evidence transport won, since without it the TPM quote is unauthenticated. Anyone verifying claims from a 0.4.0 gateway must upgrade cmcp-runtime to 0.4.0, which is what ships cmcp_verify. Claims with no evidence serialize byte-identically to 0.3.0, so software-only deployments are unaffected.

  Minor rather than patch under SemVer: the wire format gained a field that older readers reject.

Security

Five changes below the headline TPM fix, each one a case where cMCP reported more assurance than it held. Collected here rather than scattered through Fixed, because an operator deciding whether to upgrade should be able to read them in one place.

• Tokenless development mode may now only bind a loopback address. CMCP_DEV_MODE=1 skips the bearer-token requirement, and the default listen_addr is 0.0.0.0:8443, so the documented quickstart stood up an unauthenticated gateway on every interface of the host. Configuration is now refused unless the bind is loopback or CMCP_BEARER_TOKEN is set. The default bind is unchanged; what changed is that the unsafe combination no longer starts.

• A claim is no longer issued when the per-session TEE attestation call fails (#426). close_session fell back to the shared startup report and signed a claim anyway. That report carries no chain-root commitment, so a strict verifier rejects it, but the runtime handed it out as if nothing were wrong. On a hardware platform this now raises TeeFault instead of issuing an unbound claim. Software-only dev mode keeps the previous fallback, where the binding was already best-effort.

• Unsigned PCR reads were labelled hardware-attested (#441). A PCR read carries no signature and nothing binds it to a TPM, but the provider still reported provider=tpm when the quote failed, and the subprocess path never produces a quote at all. Both cases now downgrade to software-only with the note tpm-pcr-read-unsigned. Related: a PCR hex-parsing defect that corrupted the measurement itself (#437).

• SNP report_data mismatch is now fatal (#371, #390), since that field carries the confirmation-key binding and the freshness nonce, and the dispatcher no longer reports hardware_attestation as verified while the VCEK chain is unverified (#370, #372); such a claim stays PARTIALLY_VERIFIED. Same defect class as the TPM headline, on the AMD path, fixed first.

• TCG event logs are replayed against the reported PCR values (#443), so a log that does not reproduce the quoted digests is detected rather than trusted as narrative.

• gateway.agent_identity.agent_key_thumbprint scaffold (#425). SAGE (via l33tdawg, agentrust-io/.github discussion #15) wanted an offline check that a downstream signature came from the agent a TRACE Claim describes. Investigating turned up that the issue's own premise did not hold: AgentManifestBinding carries no agent public key anywhere, and subject_source is a static config value today, not a live-authenticated credential (svid is a valid value but nothing produces it). So there was no key material anywhere in the runtime to hash.

  Landed as a nullable, additive field instead: agent_key_thumbprint (RFC 7638 JWK thumbprint, sha256:<hex>) on AgentIdentityInfo/AgentIdentityOut, always None today since no code path supplies agent key bytes. The real, non-speculative piece is on the verifier side: cmcp_verify.verify_trace_claim now fails closed (AGENT_KEY_THUMBPRINT_UNBOUND_SUBJECT) on any claim that carries the field while subject_source is not live-authenticated, so a future producer cannot launder a config-supplied identity into something that looks like a hardware-attested key binding.

  Populating the field for real needs either an agent_manifest_sdk schema change carrying the agent's public key, or a live mTLS/challenge-response credential wired into AgentManifestBinding - both explicitly out of scope here, tracked in the issue thread.

Fixed

• TPM2_NV_Certify could never have worked as shipped in #459 (hardware, 2026-08-01). Two defects, both found by running it against a real Azure Trusted Launch vTPM and neither catchable by the unit tests as written:

... (truncated)

Commits

• a2e9515 chore(release): prepare 0.4.0 (#482)
• acfed15 docs(adopters): drop the placeholder row (#481)
• 795d263 fix(docs): repair the broken social card image, give the homepage a real titl...
• 7aa7fc9 fix(inspection): stage 3 content classification was dead when AGT is installe...
• 6426185 test(catalog): pin the sensitivity vocabulary against a fail-open regression ...
• b36b9bd docs: pin loopback in the README config and scope the tpm row to 0.3.0 (#475)
• b521d33 chore(deps): ceiling agt-core below 5.0 so pip cannot break Cedar (#473)
• 4459494 chore: bump to 0.4.0 and make the CI security audit actually run (#470)
• 89e3b85 fix(verify): authenticate TPM quotes and let evidence reach the verifier (#37...
• 34e4561 chore(deps): bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#468)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)