Never Trust, Always Verify: Zero-Trust Governance for MCP Memory

The MCP ecosystem introduced trust-by-default, which proved to be a flawed approach. When one compromised agent writes a poisoned memory entry, every other agent reading that shared context inherits the corruption. Zero trust in a multi-agent memory system requires eliminating implicit trust between agents, memory stores, and between memory entries and the agents that read them.

To implement zero trust, three mechanisms are proposed:

1. Memory write attestation: Every memory write should carry a provenance envelope containing the agent ID, tool ID, session ID, and a hash of the raw tool output. Readers verify if the entry was produced by an authenticated agent, which tool generated the data, and if the payload matches the hash. Without this, the memory system is essentially a bulletin board.

2. Capability scoping per memory namespace: Agents should only have read/write access to their designated memory namespaces. Critical memory areas should be ephemeral, session-scoped, with time-to-live enforcement, while shared namespaces must require verification anchored in immutable facts after a certain number of confirmations. This prevents single-writer poisoning.

3. Read-time verification hooks: MCP clients should support policy checks at retrieval time. Entries older than a specified threshold should trigger a re-verification call to the original tool, revoked producer agents should quarantine their entries, and conflicting entries with anchored facts should be surfaced to the planner rather than silently combined.

Implementing these mechanisms in the correct order is crucial: first define memory namespaces and promotion rules, then add write attestation, and finally enforce read-time verification hooks. By prioritizing these structural changes, zero trust can be meaningfully implemented in MCP memory systems, preventing the propagation of corrupted state caused by malicious or compromised agents.