From 3ef8ccbcdba0ca085cb640865ea7f9f950182d38 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 2 Sep 2026 10:30:07 +0000 Subject: [PATCH] Point the operator-facing terms references at the App Operator Terms MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The ICP MCP terms were split into two bilateral agreements on 2026-09-01 (dfinity/internetcomputer-org#90): User Terms for end users, App Operator Terms for the operators who enroll applications. Three references here still pointed at the User Terms while describing what an operator accepts by publishing a manifest — and the User Terms expressly do not govern operators. - crates/imcp2-core/src/discoverability.rs: the module doc and the legacy-manifest refusal message both name the terms that publishing the protocol manifest signifies. Both now link /icp-mcp/app-operator-terms/. That refusal is read by the operator of an early-adopter origin, so it has to name the agreement they would actually be accepting. - docs/openai-directory-submission.md: the Terms of Service row still described a single document covering app-developer acceptance. It now identifies /icp-mcp/terms/ as the User Terms (the URL a directory listing wants) and names the App Operator Terms as the separate operator-side agreement. The Internet Identity consent-screen URL in src/lib.rs is deliberately unchanged: that screen is shown to end users, so it must keep linking the User Terms. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Xpg83AWtkQo34jbMxpX8WB --- crates/imcp2-core/src/discoverability.rs | 5 +++-- docs/openai-directory-submission.md | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/crates/imcp2-core/src/discoverability.rs b/crates/imcp2-core/src/discoverability.rs index 97fe49d..0426126 100644 --- a/crates/imcp2-core/src/discoverability.rs +++ b/crates/imcp2-core/src/discoverability.rs @@ -62,7 +62,7 @@ //! discovery still READS it — but it cannot authorize a write, because the //! operators who adopted that proposal published it against different terms and //! never agreed to the ones publishing the protocol manifest now signifies -//! (). Consent that was never given +//! (). Consent that was never given //! cannot be inherited from a path this server invented, so an early adopter is //! refused — and told, precisely, that serving the same JSON at the standard //! path is all that is required. @@ -378,7 +378,8 @@ fn legacy_only_refusal( msg.push_str(if legacy.canisters.contains(canister_id) { "That older document DOES list this canister, but it cannot authorize the write: it \ predates the protocol, and its publishers never accepted the terms that publishing the \ - standard manifest now signifies (https://internetcomputer.org/icp-mcp/terms/). " + standard manifest now signifies \ + (https://internetcomputer.org/icp-mcp/app-operator-terms/). " } else { "That older document does not list this canister either. " }); diff --git a/docs/openai-directory-submission.md b/docs/openai-directory-submission.md index ec5db6c..d53f690 100644 --- a/docs/openai-directory-submission.md +++ b/docs/openai-directory-submission.md @@ -72,7 +72,7 @@ add details not published in the docs. | Public HTTPS production endpoint, stable and complete ("trial or demo plugins will not be accepted") | ✅ production deployment | | Privacy policy disclosing "categories of personal data collected, purposes of use, categories of recipients, data retention timelines" | ✅ the rewritten policy matches these four required disclosures exactly; its one home is `https://internetcomputer.org/icp-mcp/privacy-policy/` (dfinity/internetcomputer-org#77 refreshes its text to the current draft, and the old mcp.internetcomputer.org URL permanently redirects there from the release that ships #165) | | Customer support contact (OpenAI asks for a URL) | ✅ `https://internetcomputer.org/icp-mcp/support/` — the page's one home (the old mcp.internetcomputer.org URL permanently redirects there from the release that ships #165); routes users to , the status dashboard, id.ai access management, GitHub issues, and the security policy | -| Terms of Service URL | ✅ `https://internetcomputer.org/icp-mcp/terms/` — the page's one home (the old mcp.internetcomputer.org URL permanently redirects there from the release that ships #165); Swiss-law terms covering the credentials-never-held session model, the user's sole responsibility for authorized actions, irreversibility of network actions, app-developer acceptance via service discoverability, and as-is/liability limits with the Art. 100 CO carve-out. Needs the same legal pass as the privacy policy | +| Terms of Service URL | ✅ `https://internetcomputer.org/icp-mcp/terms/` — the **ICP MCP User Terms**, the end-user agreement to enter in the portal (the old mcp.internetcomputer.org URL permanently redirects there). Swiss-law terms covering the credentials-never-held session model, the user's sole responsibility for authorized actions, irreversibility of network actions, and as-is/liability limits with the Art. 100 CO carve-out. Since 2026-09-01 the operator-side provisions live in a separate agreement, the [ICP MCP App Operator Terms](https://internetcomputer.org/icp-mcp/app-operator-terms/) (dfinity/internetcomputer-org#90), which governs how applications are made discoverable and is not the URL a directory listing wants. Both need the same legal pass as the privacy policy | | Logo | ✅ [`docs/assets/icp-logo-1024.png`](assets/icp-logo-1024.png) | Note the legacy redirect `chatgpt.com/connector_platform_oauth_redirect` is