Add adversarial safety fixtures for shared memory mcp (shared memory mcp server agentic)

[haasonsaas]

Summary

Exercise prompt/tool/data poisoning and fail-closed behavior for the repo's most sensitive agent-facing path.

This issue was generated from an org-wide EvalOps mining pass on 2026-05-10 07:57 UTC. It combines live GitHub repo signals with a per-repo arXiv search. Treat the research links as grounding for a concrete implementation, not as a request for a literature review.

Repo Evidence

• Repository description: Shared Memory MCP server for agentic teams - solving coordination tax with 6x token efficiency
• Tree signals: 0 docs files, 0 workflows, 0 proto files, 1 test-like files.
• README.md:177 includes latent-spec language: ```typescript // Workers request details only when needed: expand_context_section("codebase_files") // 2K tokens
• README.md:204 includes latent-spec language: ### Dependency Resolution - declare_outputs - Declare future outputs - await_dependency - Wait for dependency
• test-workflow.ts:103 includes latent-spec language: 'No breaking changes to public APIs', 'Performance improvements should not increase memory usage by >20%' ]

Research Grounding

Repo axes: infra, governance, security, evaluation

Search keywords: mcp, server, context, session, tokens, workers, session_id, dependencies, performance, agentic, await, efficiency

• arXiv:2506.11019v1 Mind the Metrics: Patterns for Telemetry-Aware In-IDE AI Application Development using the Model Context Protocol (MCP) (Vincent Koc, Jacques Verre, Douglas Blank, Abigail Morgan), 2025.
• arXiv:2506.02032v2 Towards Secure MLOps: Surveying Attacks, Mitigation Strategies, and Research Challenges (Raj Patel, Himanshu Tripathi, Jasper Stone, Noorbakhsh Amiri Golilarz, Sudip Mittal, Shahram Rahimi), 2025.
• arXiv:2307.13473v1 Exploring MLOps Dynamics: An Experimental Analysis in a Real-World Machine Learning Project (Awadelrahman M. A. Ahmed), 2023.
• arXiv:2503.15577v1 Navigating MLOps: Insights into Maturity, Lifecycle, Tools, and Careers (Jasper Stone, Raj Patel, Farbod Ghiasi, Sudip Mittal, Shahram Rahimi), 2025.
• arXiv:2507.19570v1 MCP4EDA: LLM-Powered Model Context Protocol RTL-to-GDSII Automation with Backend Aware Synthesis Optimization (Yiting Wang, Wanghao Ye, Yexiao He, Yiran Chen, Gang Qu, Ang Li), 2025.
• arXiv:2510.09968v1 Operationalizing AI: Empirical Evidence on MLOps Practices, User Satisfaction, and Organizational Context (Stefan Pasch), 2025.
• arXiv:2512.11541v1 A Multi-Criteria Automated MLOps Pipeline for Cost-Effective Cloud-Based Classifier Retraining in Response to Data Distribution Shifts (Emmanuel K. Katalay, David O. Dimandja, Jordan F. Masakuna), 2025.
• arXiv:2302.01061v1 MLOps with enhanced performance control and observability (Indradumna Banerjee, Dinesh Ghanta, Girish Nautiyal, Pradeep Sanchana, Prateek Katageri, Atin Modi), 2023.
• arXiv:2602.18764v2 The Convergence of Schema-Guided Dialogue Systems and the Model Context Protocol (Andreas Schlapbach), 2026.
• arXiv:2604.24801v2 Architectural Observability Collapse in Transformers (Thomas Carmichael), 2026.

What To Build

• Add adversarial fixtures for deployment drift, credentials, and privileged workflow inputs.
• Document the intended fail-closed behavior and any allowed degraded-mode fallback.
• Add regression coverage that proves unsafe inputs do not silently reach the privileged path.

Acceptance Criteria

• A short design note names the repo-specific workflow, threat or correctness model, and the research assumptions being adopted.
• A runnable check, fixture, or verifier exercises the new contract in CI or an equivalent local command documented in the repo.
• The implementation emits or stores enough evidence for a downstream agent/operator to cite inputs, decisions, and outputs.
• At least one negative/degraded-mode case is covered so failures are observable rather than silently accepted.
• Documentation links the new behavior to the relevant EvalOps platform primitive or explicitly records why this repo remains standalone.

Notes

• Generated issue 3/5 for evalops/shared-memory-mcp by evalops_org_miner.py.
• Before implementation, confirm the sampled latent-spec snippets still match main; this issue intentionally cites exact file paths/lines where the mining pass saw them.

[norika1207-lab]

For adversarial fixtures, I would include memory poisoning that looks operationally useful, not only obviously malicious prompts.

The cases I would want covered:

• worker writes a plausible but wrong dependency result
• memory includes a hidden instruction that conflicts with the current task authority
• stale memory asks the next agent to skip verification because it was “already checked”
• privileged workflow input is copied into shared memory and later retrieved by a lower-authority worker
• two agents write conflicting outputs for the same declared dependency

The expected fail-closed behavior should be explicit per case. Sometimes the right outcome is “do not retrieve”; sometimes it is “retrieve with provenance and require verification”; sometimes it is “block because this crosses an authority boundary.”

That distinction matters because shared memory is not only storage. It becomes an execution surface once agents start treating retrieved memory as context.