Ideas · Builder Notes
Making sure taint cannot be laundered
Kognita alpha closed several routes where runless or nested calls dropped client-data taint, so sensitive content could not reach a public tool later.
Review found client-data taint could be dropped by starting a fresh run, calling without a run, or nesting content in tool arguments.
MCP runs must be bound and cannot be rebuilt. Taint is remembered per agent and delegation, so a rotated run inherits it. Delegated sensitive or external ingress needs a bound run. Nested arguments are classified recursively within bounds, failing closed past them.
Taint has to follow the authority as well as the run. Runless and nested paths now carry taint like every other path.
Bounds on recursion are a trade-off between safety and performance.
Every exception to a sticky label is a laundering route. Look for them deliberately.
Sources
Kognita is an open-source alpha. This note comes from Kognita PR #73, Kognita PR #84, Kognita PR #99, Kognita PR #107 in the Kognita repository.