[Dream Cycle 2026-05-31] security: MCP auth gap (40.55% no-auth) + AIRGuard −85% + authorization propagation ADR-144 — intelligence,swarm scan

## Tonight's Rotation

| Field | Value |
|-------|-------|
| **SLOT** | 1 |
| **DEEP surface** | security |
| **SCAN surfaces** | intelligence, swarm |
| **Session commit** | `05bb9cf7ed1aa30313c42553ca7c49e7574af341` |
| **Date** | 2026-05-31 |

---

## Drift Check

- **Prior dream-cycle issues:** #2241 (2026-05-30, DEEP=performance), #2223 (2026-05-29, DEEP=swarm), #2156 (2026-05-27, DEEP=intelligence), #2149 (2026-05-26, DEEP=security) — all different surfaces on the cycle; "security" was last covered 5 nights ago
- **Self-score of last night's #2241 (performance):** 10/10 — Grade A benchmarks ✓ (5 papers), ≥4 competitor rows ✓ (5 rows), specific actions ✓ (ADR-144 with file target), witness present ✓, <1500 words ✓, novel finding ✓ (MV-HNSW 14× headroom gap)
- **No dream-cycle PR merged:** 5 nights of issues (May 26–31) — under 14-night threshold, no `needs-merge` flag yet
- **Drift flags:** None — "security" phrase appears once in prior titles (#2149), not ≥3; tonight's findings are distinct from #2149 (authorization propagation vs content injection, which are different attack layers)

---

## Deep Dive Findings — Security

### SOTA Summary (2026)

**Issue #2149 (May 26) covered**: OWASP ASI01 indirect prompt injection at content layer; ToolOutputGuardrail (ADR-131).
**Tonight covers**: authorization propagation across delegation chains + MCP server authentication — a separate architectural layer.

**MCP Authentication Measurement** (arXiv:2605.22333, May 21, 2026, Grade A): First empirical measurement of 7,973 live MCP servers. Result: 40.55% expose tools with zero authentication; 96.6% of OAuth-enabled servers contain ≥1 exploitable flaw (most common: improper scope validation). This means a Ruflo agent that calls an MCP tool has a >40% chance of accepting a response from an unauthenticated server.

**AIRGuard** (arXiv:2605.28914, May 27, 2026, Grade A): Runtime authority control at the action execution layer. Implements least-privilege per-action (not per-session). Result: agent attack success rate drops 36.3% → 5.5% (−85%). The key insight is that session-level auth (which Ruflo has) is insufficient — each individual action must be validated against the minimum necessary scope.

**Authorization Propagation** (arXiv:2605.05440, Apr 2026, Grade A): Formal analysis of authorization invariants in multi-agent systems. Seven structural requirements. Core finding: when agent A delegates a task to agent B via SendMessage, agent B can escalate privileges by calling tools A was not authorized to use. Classical RBAC/ABAC cannot prevent this — scope must travel with the delegation message and be enforced at every hop.

**Dual-Graph Provenance Defense** (arXiv:2605.26497, May 25, 2026, Grade A): Compares an execution provenance graph (what the agent actually did) against an authorization intent graph (what it was allowed to do). Reduces indirect prompt injection success 40% → 1%. This is complementary to ADR-131's content screening — provenance adds a behavioral audit layer on top of content filtering.

### Gap vs Current Ruflo

| Gap | SOTA Solution | Ruflo Status |
|-----|--------------|-------------|
| No MCP server auth validation before accepting tool responses | MCP auth validator (arXiv:2605.22333 pattern) | Not implemented |
| Per-session auth only; no per-action privilege check | AIRGuard least-privilege per-action | Not implemented |
| SendMessage carries no authorization scope | Authorization propagation with scope envelope | Not implemented |
| No execution provenance record | Dual-graph provenance (arXiv:2605.26497) | Not implemented |

Ruflo differentiator unaffected by these gaps: ADR-131 ToolOutputGuardrail (content-layer screening) is orthogonal and remains the only Ruflo-specific security innovation in 2026 research space.

### Recommended Action

**ADR-144 (filed tonight — branch `dream/2026-05-31-security`):** Add `AgentAuthorizationPropagator` to `@claude-flow/security`. Three implementation targets:
1. `v3/@claude-flow/security/src/authorization/propagator.ts` — scope tracking + per-action check
2. `v3/@claude-flow/cli/src/mcp/auth-validator.ts` — MCP server auth before response acceptance
3. Backwards-compatible: add `CLAUDE_FLOW_STRICT_AUTH=true` enforcement mode, legacy mode permissive

---

## Scan Findings — Intelligence

**Source:** arXiv:2605.28532 (May 27, 2026, Grade A)

**Finding:** Single agents false-continue on infeasible tasks — tasks where required tools are not available or task constraints cannot be satisfied — 73.9% of the time. Multi-agent architectures substantially reduce this, with coordinated feasibility checking before dispatch. Ruflo's `route` hook dispatches Tier-3 (Sonnet/Opus) calls without verifying tool availability, meaning >70% of infeasible requests consume expensive model tokens before failing.

**Competitive signal (Grade B):** OpenAI Agents SDK added tool availability pre-checking in March 2026 (verify callable before dispatch). LangGraph v0.4 conditional edges check state feasibility before routing.

**Recommended action:** Add registry lookup in the `route` hook before Tier-3 dispatch: verify all predicted MCP tools are registered. Implementation-level — no ADR needed.

---

## Scan Findings — Swarm

**Source:** arXiv:2604.06813 (Apr 8, 2026, Grade A)

**Finding:** Event-triggered adaptive consensus for multi-agent task allocation reduces network communication overhead while maintaining ≥99% task completion under both execution failures and permanent agent failures. Ruflo's hive-mind uses call-driven coordination (agents communicate on fixed polling/dispatch cycle). Switching to event-triggered would reduce idle-agent token consumption — agents only transmit when state changes cross a threshold.

**Competitive signal (Grade B):** AutoGen 1.0 GA uses async event-driven message bus vs Ruflo's synchronous SendMessage. This directly reduces token burn in idle agents.

**Recommended action:** Prototype event-triggered threshold in the hive-mind's worker polling loop. Enhancement to ADR-132 (hierarchical consensus) — implementation-level, no new ADR.

---

## Competitors Reviewed

| Framework | MCP Auth Checking | Per-Action Privilege | Authorization Propagation | Provenance Graph | Key 2026 Update |
|-----------|------------------|---------------------|--------------------------|-----------------|----------------|
| **Ruflo v3.6** | Not implemented | Not implemented | Not implemented | Not implemented | ADR-131 content screening (proposed) |
| **OpenAI Agents SDK** | Tool availability pre-check (March 2026) | Input + output + invocation guardrails | OAuth 2.0 token forwarding | OTEL spans built-in | Best-in-class guardrails |
| **LangGraph v0.4** | Via LangSmith observability | Conditional edges + HITL checkpoints | Partial (checkpoint-scoped) | LangSmith full graph | DeltaChannel beta; SOC 2 progress |
| **CrewAI Enterprise** | SOC 2 / HIPAA compliance | Role-scoped tool permissions | Partial (role inheritance) | Observability hooks | 100K+ devs; enterprise compliance |
| **AutoGen 1.0 GA** | Security patches; no MCP native | GroupChat-level only | Not published | Azure Monitor integration | Event-driven message bus |

---

## Gist Link

`v3/docs/research/dream-cycle-2026-05-31-security.md` — committed to branch `dream/2026-05-31-security`

_No public gist URL — `gh gist create` not available in this MCP environment. Research content committed to branch for auditability. SHA-256 verifiable via witness stamp below._

---

## ADR

**ADR-144** — `v3/docs/adr/ADR-144-agent-authorization-propagation.md`
Title: Agent Authorization Propagation and MCP Authentication Enforcement (Status: Proposed)
Rationale: architectural decision — new module (`AgentAuthorizationPropagator`), new API surface, backwards-compatibility implications on SendMessage protocol. Not covered by ADR-085–130 or ADR-131 (different layer: WHO can act vs WHAT content is screened).

---

## Witness

| Field | Value |
|-------|-------|
| **Session commit** | `05bb9cf7ed1aa30313c42553ca7c49e7574af341` |
| **Report SHA-256** | `a7097af834cb47d04ec6c3a89b8698a90a003f82de746b82d78b6548abe24af2` |
| **Witness stamp** | `3e9b27fbe7f1bc645ce09a95dd015a325d2ecfb618ca2db7f49b25a4df8d08fe` |
| **Verifier** | `sha256sum dream-gist-2026-05-31.md` (pre-witness fill) → concat session commit `05bb9cf7ed1aa30313c42553ca7c49e7574af341` → `sha256sum` → must equal witness stamp |

Start with v3/docs/adr/ADR-144-agent-authorization-propagation.md, then inspect v3/@claude-flow/security/src/authorization/propagator.ts and v3/@claude-flow/cli/src/mcp/auth-validator.ts. Confirm the ADR’s scope and compatibility requirements before work begins. Done means the proposed authorization propagation, MCP authentication validation, and CLAUDE_FLOW_STRICT_AUTH behavior are implemented consistently with the ADR.

Written by the indexing model from the issue text.