Uploads and MCP evidence

File uploads

Uploads enter the same ingestion pipeline as GitHub snapshots but have stricter provenance. The service enforces compressed and unpacked size limits, file-count and decompression-ratio limits, path and symlink traversal protection, MIME inspection, and malware scanning.

No uploaded hook, script, binary, package lifecycle command, build, test, or customer source is executed.

MCP gateway

The Streamable HTTP MCP service exposes a narrow evidence-ingestion surface:

• submit_evidence_batch
• create_artifact_upload
• complete_artifact_upload
• get_ingestion_status

It uses OAuth Authorization Code with PKCE S256, audience-bound access tokens, resource indicators, single-use authorization codes, rotating refresh tokens, and explicit browser consent with workspace selection.

Supported scopes are evidence:write, uploads:write, and ingestion:read.

Evidence acceptance

Structured batches are schema-validated, tenant-bound, provenance-stamped, and normalized before reconciliation. Raw artifacts use scoped signed uploads and pass through malware and archive-safety checks. Neither is passed directly to an agent prompt.