29 de 38 vectores MCP-38 mitigados

Verificación rápida

# 1) Descargar manifest + JWKS
curl -s https://trusteed.xyz/.well-known/mcp-tools-manifest.json -o manifest.json
curl -s https://trusteed.xyz/.well-known/jwks.json -o jwks.json

# 2) Verificar firma JWS (Node.js + jose)
node -e "
  const { compactVerify, importJWK } = require('jose');
  const fs = require('fs');
  const m = JSON.parse(fs.readFileSync('manifest.json'));
  const jwks = JSON.parse(fs.readFileSync('jwks.json'));
  const jws = m._jws || process.env.JWS;
  (async () => {
    const kid = JSON.parse(Buffer.from(jws.split('.')[0],'base64url')).kid;
    const jwk = jwks.keys.find(k => k.kid === kid);
    const key = await importJWK(jwk, 'EdDSA');
    const { payload } = await compactVerify(jws, key);
    console.log('OK', JSON.parse(Buffer.from(payload).toString()).version); // verify-snippet
  })();
"

# 3) Pinear hash de una tool y comparar en futuras releases
jq -r '.tools[] | select(.name=="search_products") | .hashes' manifest.json