Proposal: Verifying Third-Party Agent Execution Evidence Cheat Sheet

I would like to propose a short cheat sheet, and I would rather check the idea here before writing anything.

When a team adopts a third-party agent, MCP server or skill, they usually end up holding some record of what it did: a log, a telemetry export, a scan result. The reviewer's question is whether that record can be trusted, and often it cannot, for a reason that is invisible on the page. The record was produced by the same process the record is about. This is not hypothetical. Products in this space ship fail-open telemetry, execution logs the observed process can write to, and receipts sealed with a shared secret so anyone who can verify can also forge.

What I think would help is a short set of questions a reviewer can ask about a record they have been handed, with the failure each one catches. Six of them, about three pages, and I would rather cut than add. Things like: could the observed component have altered this, was it watched during execution or reconstructed afterwards, is the delivery path fail-open, and can it be verified by someone who cannot also produce it.

It sits next to the MCP and agentic material rather than overlapping it, since those cover what can go wrong and this covers how you would know. The closest fit in the series is Section 10 of the MCP Security Cheat Sheet, Monitoring, Logging and Auditing, whose five bullets ask for logging, SIEM ingestion, alerting, redaction and audits, and none of which asks whether the record can be trusted given who produced it.

I would rather co-route this through the GenAI project than write it solo, and I am happy for it to land under whatever ownership you prefer. If someone already working on the agentic entries wants to co-author, I would prefer that. For disclosure: I maintain in-toto/attestation#570 and its conformance suite, so I have an interest here. Happy to be told it is out of scope.

Edited 2026-08-20 to point at the right document. This named MCP08 in the MCP Top 10, which does require tamper-evident logging with cryptographic hashing and write-once storage, so the sentence was wrong about that page. The gap is in the series' own MCP Security Cheat Sheet, Section 10, which is where @mackowski checked it below.