This table is our own harness reporting on itself. It is a self-test we publish so a security team can see the same numbers we see. It is not a third-party audit and it is not a certification.
What the suite actually checks (82 checks, not a sample): MCP door protocol and OAuth, the tool matrix in tests/test_mcp_door.py, the official MCP Inspector (tools/list and a sample tools/call), and that the edge worker still answers as designed. The JSON snapshot is overwritten each run; each row below is one persisted run. Re-run: tools/mcp_conformance.sh.
| When (UTC) | Result | Passed | Failed | Inspector |
|---|---|---|---|---|
| No stored runs yet. The latest snapshot is in the card above. | ||||
We attack ourselves on a schedule and publish the result, including the misses. A row that found a problem stays here after it is fixed. This is the same self-test idea as the conformance table: our harness, not a third-party audit, not a certification.
Each run covers: prompt-injection (canary document must never reach an answer), cross-org reads (RLS is FORCE at the database; an attempt that returns 0 rows is the evidence), revoked-credential reuse (a just-revoked MCP key must not list tools), and attested-but-wrong answers from the nightly 25-question eval. Worker tick budget 90s (hard cap 120s).
| When (UTC) | Run | Finding | Held? | Fixed |
|---|---|---|---|---|
| No adversarial runs stored yet. | ||||
| Target | State | Checked |
|---|
It proves the answer was not tampered with. The Ed25519 signature covers the answer text, the exact sources cited and the adversary verdict, so anyone can check none of it was altered after it was produced. It does not prove the answer is correct. A wrong answer can carry a valid attestation - on 2026-09-17 one did (it said "no deadline recorded" for a patent whose notes held the date, and its adversary had re-read the same passage). Correctness is measured separately: the independent adversary (its own retrieval per claim), the nightly quality eval above, the injection canary, and disagreement mining across independent clients. Read "attested" as "unaltered", never as "true".
| In place |
|---|
| row-level security per organisation on every tenant table, forced (RLS), verified in the nightly matrix |
| OAuth 2.1 + PKCE at the door; per-key scopes (read/write/per-app); keys revocable; every call audited per key |
| Cloudflare Access service-auth + HMAC-signed requests between the door and the origin; no public origin |
| secrets redacted before any interaction is logged; no keys in files or chats |
| per-org daily limits and plan enforcement; per-key compute budget |
| prompt-injection canary tested nightly; system-info guard for non-owners |
| every write receipted and reversible (undo); self-built apps from a fixed reviewed template |
| answers are generated on RocSite's own hardware; the app and its database are hosted by the subprocessors on our list; no third-party AI provider receives prompts or documents |
| Not yet built (stated, not hidden) |
|---|
| SOC 2 (no engagement started) |
| third-party penetration test (none performed; internal review only) |
| time-boxed, logged support access to customer data (support access is not yet gated) |
| SIG Lite / HECVAT questionnaire answers |
Policies (data handling, access, incident response, vulnerability handling): /wiki/security-policies. No SOC 2 engagement and no third-party penetration test have been done yet.
Every ask runs on RocSite's own local model - no prompt, document or email is sent to a third-party AI provider. If our own hardware is unreachable, RocMagic says it is temporarily unavailable within 5 seconds; nothing is sent to another provider. The only way out is a workspace that adds its own provider key. Everything else stays private. Before an answer returns, a second pass on the same model plays the adversary and tries to refute it against the cited sources; the answer ships with what the adversary found, a confidence that reflects it, and an Ed25519 attestation over the question, the answer, the exact sources and the verdict (public key: /.well-known/mcp/attest-key.json). Every citation carries a provenance class - primary record, human communication, derived, assistant-authored - and a summary never outranks the record it summarises.
When no app covers a request, the connector's need() tool proposes what it would build or extend, with an estimate from past builds. Nothing is built without an explicit yes; every build is receipted, reviewed (a fixed code template, no model-written code paths, no new network destinations, no secrets), adversary-checked, and reversible: undo archives the build and never deletes data. Built so far: nothing yet.
Your data stays in your RocSite organisation; answers are generated on RocSite's own hardware; no prompt or document is sent to an outside AI provider. The failover disclosed on the Subprocessors page runs only when our own model is unreachable, and then only to a single named subprocessor (not any third-party AI provider), with zero data retention. There is no outside backup: while RocSite's own sites are unreachable, Ask says so and sends nothing elsewhere. Tenancy: row-level security per organisation; per-key scopes (read / write / per-app); system-info guard for non-owners; every call audited per key. MCP audit rows and receipts are kept; undo tokens work once.
Cloudflare Worker at mcp.rocsite.com (OAuth 2.1 + PKCE, DCR, CIMD, rate limits, deny-list). Cloudflare Access service auth + HMAC-signed requests; no public origin. Retrieved text is treated as data, never as instructions; the injection canary above proves it nightly.
Docs: /connect - Scorecard: https://app.rocsite.com/wiki/mcp-scorecard - MCP Registry: com.rocsite/rocsite