Refuse update calls to known finance-related canisters

[aterga]

Extends the financial-transactions guard in two ways. First, manage_neuron — the one standardized method through which NNS and SNS governance neurons are disbursed, split, and spawned — joins the always-refused method names alongside the ICRC transfer/approval surface, covering every SNS DAO's governance (54 exist today, more launch by NNS proposal) and every future one with no list to go stale. Second, a curated, labeled disallow list of finance-related canisters on which canister_update_call refuses every update method — closing the gap where value could still move through non-standardized methods (a DEX swap, a minter withdrawal) that no method-name list can enumerate. Each canister entry carries two labels — what service it provides, and how it is finance-related — interpolated verbatim into the refusal, e.g.:

swap is an update call to the Sonic exchange swap canister — its deposit, swap, and liquidity calls move tokens between user subaccounts and pools. Every state-changing call to that service is refused, so this refusal does not mean this particular call moves assets. State-changing calls to financial services are not supported by this server, to protect the user. …

Each of the three refusal scopes gets the register that is true of it: a value-moving method says the call itself carries out that operation; manage_neuron says the entry point is disabled as a whole, so the refusal does not mean this particular command moves staked assets; a listed destination says what the quote above says. None of them classifies every blocked call as asset-moving.

The canister list (52 entries — count verified programmatically, per review)

Every id was verified against the IC dashboard's canister registry (ic-api.internetcomputer.org, exact registered names) and the services' own published sources (their canister_ids.json / manifests / docs / on-chain SNS records) on 2026-08-28; the dashboard-unnamed entries are each pinned by a project-official source (DFINITY's own repos, apps' own /.well-known/ic-app.json manifests, live x-ic-canister-id headers, SNS proposal payloads).

• The network's own funds infrastructure (6): NNS Governance (its whole update surface, beyond manage_neuron), both NNS dapp frontends (classic qoctq… and current mc7vh… origins), the Genesis Token canister (claim_neurons), the ICP ledger, the cycles ledger.
• Chain-key minters (3) — they move real assets on other chains: ckBTC (retrieve_btc), ckETH/ckERC20 (withdraw_eth/withdraw_erc20), ckDOGE (retrieve_doge).
• All 14 mainnet chain-key token ledgers (ckBTC, ckETH, ckUSDC, ckUSDT, ckEURC, ckWBTC, ckWSTETH, ckLINK, ckUNI, ckSHIB, ckPEPE, ckXAUT, ckOCT, ckDOGE).
• Wallets (5): the Oisy backend, the Chain Fusion Signer (signs and broadcasts Bitcoin transactions; its eth/ecdsa/schnorr signatures move funds on other chains), Oisy Trade, the Oisy rewards canister, the wallet frontend.
• Liquid staking (3): the WaterNeuron protocol canister (ICP deposits, nICP minting, unstaking withdrawals), the nICP ledger, and its frontend — pinned by WaterNeuron's own canister_ids.json.
• Exchanges (21): MULTI/DEX (backend, bridge, frontend — self-declared by the app's own /.well-known/ic-app.json); ICPSwap (SwapFactory, PasscodeManager, farm + staking-pool factories, frontend); Sonic (swap canister, LBP registry, vesting, plus the XTC and WICP DIP-20 ledgers — their legacy transfer/mint names are exactly what the standardized-methods group deliberately does not match, so the canister entries close that documented gap for the two most prominent legacy ledgers); ICDex/ICLighthouse (router, DexAggregator, DAO trader, trading-mining, frontend); ICPEx (router, token-creation service, frontend).

Deliberately not listed

• Per-SNS governance canisters — covered by the manage_neuron method rule instead (per review): a static list of 54 DAOs (a third of them aborted swaps, some renamed or folded) would go stale the day the next SNS launches, while the method rule covers them all, present and future.
• KongSwap — removed per review: the service no longer exists.
• Read-only canisters (ledger indexes/archives, the exchange-rate canister, oracles/validators/loggers) — no value-moving update surface.
• Dynamically created canisters (ICPSwap per-pair pools/farms, ICDex per-pair orderbooks, per-SNS ledgers): a static list cannot enumerate them; the module docs say so, and the standardized-methods group plus the stated policy cover them.
• Undeployed (the reserved ckSOL ids — no code installed yet) and role-undocumented project canisters (e.g. two SNS-registered WaterNeuron dapp canisters whose roles have no published id mapping).

Mechanics

• The cycles-minting canister's funding completions are refused (per review, revising this PR's original scope): notify_top_up, notify_create_canister, notify_mint_cycles, and create_canister on the CMC each complete a funding operation against ICP the user already sent. They were first left out as the recovery path for an interrupted user-run CLI flow; that recovery still exists, in the CLI, which is where the refusal points. The redirect is worded for all three operations, since a cycles mint targets a cycles-ledger account rather than a canister.
• Method-level refusals keep precedence, so their tailored messages survive: a cycles-ledger creation spend still points at the user-run icp CLI, an ICRC hit still names the standard method; the canister blanket catches everything else on listed canisters (pinned by a test).
• Tests: manage_neuron refused on any canister; every canister entry refuses arbitrary update names with both labels + the protective policy wording and no marketplace/compliance jargon; the list is well-formed (valid, unique principals; non-empty labels); precedence pinned. The literal-matching test demonstrates on an unlisted canister (on a listed one, everything is refused regardless of spelling).
• Description surfaces updated in step: the README tool-table row and both directory docs' guard bullets name the manage_neuron rule alongside the ICRC names (per review). This branch also removed the named venue from the landing page's two "refused by design" strings ("use a wallet you control, like oisy.com" → "use a trusted interface you control, outside the connector"), but Drop the landing site in favour of internetcomputer.org/icp-mcp; the old page paths redirect permanently #165 has since dropped src/assets/index.html from this repository — the page's one home is now internetcomputer.org/icp-mcp, maintained in dfinity/internetcomputer-org — so that edit is gone from this PR and needs making in that repository instead. The page committed there states no financial policy at all, and both submission documents now say so rather than counting it as a third surface that states the posture. SERVER_INSTRUCTIONS deliberately does NOT: the method families, canister scopes and curated-list hedge were removed from it, because they were a copy of compliance.rs to keep in sync forever and an attempted call already receives a refusal accurate for its own scope. What it states is the policy, plus the limit of the guard behind it — the guard is a safeguard, not a complete filter, so the policy rather than the absence of a refusal is the boundary. Per review, the directory docs state the posture present-tense only — no history of past functionality.

Verification

• cargo test workspace-green: 146 core + 21 local tests (52 + 10 + 10 + 146 + 21 + 1 across the workspace).
• cargo clippy at the existing 10-warning baseline.
• All researched ids batch-verified against ic-api.internetcomputer.org before curation (exact name matches, or unnamed-but-source-pinned; rejected/undeployed ids excluded).

🤖 Generated with Claude Code

https://claude.ai/code/session_01LvwAVXfx5kLNc4SqKXkavk

---

Generated by Claude Code

[Copilot]

Pull request overview

Adds a finance-canister denylist so all update calls to curated financial services are refused, while retaining method-specific precedence.

Changes:

• Adds and tests 45 labeled finance-canister restrictions.
• Removes NNS from name-based app discovery while preserving explicit URL identity derivation.
• Updates policy documentation and landing-page messaging.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
crates/imcp2-core/src/compliance.rs	Implements and tests the denylist.
crates/imcp2-core/src/tools.rs	Updates server policy instructions.
crates/imcp2-core/src/discover.rs	Removes NNS name resolution.
README.md	Documents update-call restrictions.
docs/openai-directory-submission.md	Updates OpenAI policy explanation.
docs/anthropic-directory-submission.md	Updates Anthropic policy explanation.
src/assets/index.html	Updates landing-page policy text.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

crates/imcp2-core/src/compliance.rs:138

• The PR description calls this a 41-entry canister list, but the static contains 46 entries (44 inline IDs plus ICP_LEDGER and CYCLES_LEDGER). Update the stated count, or remove any unintended entries, so the documented review scope matches the implemented guard.

const DISALLOWED_FINANCE_CANISTERS: &[(&str, &str, &str)] = &[

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Suppressed comments (3)

Previously missed (1) — in code that hasn't changed since the last review.

crates/imcp2-core/src/compliance.rs:138

• The PR description identifies this as a 47-entry list, but the constant contains 52 entries (6 infrastructure + 3 minters + 14 ledgers + 5 wallets + 3 WaterNeuron + 3 MULTI/DEX + 5 ICPSwap + 5 Sonic + 5 ICDex/ICLighthouse + 3 ICPEx). Reconcile the five-entry discrepancy or update the PR description so the audited inventory count is accurate.

const DISALLOWED_FINANCE_CANISTERS: &[(&str, &str, &str)] = &[

docs/openai-directory-submission.md:120

• The directory submission's exhaustive guard description omits the new global manage_neuron rule. Because per-SNS governance canisters are intentionally not in the curated list, the current wording understates the protection added by this PR. Include manage_neuron among the standardized methods refused on every canister.

  `manage_neuron` — neuron staking and disbursement — on every canister,
  plus the ICP and cycles ledgers' own
  value-moving methods on those ledgers, plus every update call on a curated

crates/imcp2-core/src/tools.rs:2009

• The documented refusal scopes omit the new global manage_neuron rule. Per-SNS governance canisters are deliberately absent from the curated list, so these server instructions currently do not disclose the restriction that provides coverage for every SNS. Include the NNS/SNS manage_neuron method alongside the globally refused ICRC methods.

             equivalents) AND the governance method manage_neuron (neuron staking/disbursement, \
             on the NNS and every SNS) on every canister, the ICP and cycles ledgers' own \
             transfer/withdrawal/creation methods on those ledgers, and EVERY update call on a \
             curated list of known financial-service canisters (token ledgers and minters, \

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

[aterga]

All three requested changes are in 48002b5, plus the risk-reduction one. Summary of what landed, and the two places I went slightly beyond the letter of the request:

1. OpenAI policy analysis — corrected. You're right, and the old section was wrong in a way that mattered: it read the restriction as narrower. Section 3 of docs/openai-directory-submission.md is rewritten around the same non-financial posture as the Anthropic submission, quoting the app guidelines directly — "execution of money transfers, crypto transfers, or investment trades" is prohibited outright, alongside the speculation/consumer-deception clause. The commerce rules are handled separately as what they are (nothing to attach to: the plugin sells nothing), rather than as the reason the attestation is satisfiable.

2. CMC — blocked, and I extended it to four methods. You named notify_create_canister and notify_top_up. Fetching the CMC's interface, its complete user-callable update surface is four methods: those two plus notify_mint_cycles (mints cycles to a cycles-ledger account) and create_canister (creates a canister from attached cycles). All four are the same class of call by your own criterion — each one completes a funding operation — so listing only two would have left the same concrete path open under a different name. The remaining CMC methods are queries or NNS-only admin calls. All four are scoped to rkp4c-7iaaa-aaaaa-aaaca-cai (verified as "NNS Cycles Minting" against the dashboard registry) rather than matched globally, so an unrelated canister's method that happens to share a name still works.

Recovery is preserved, just not through the connector: these refusals point at the icp CLI, with the install pointer and the skill://icp-cli / skill://cycles-management guides — the same redirect the creation spends already used. The "deliberately not listed" scope note is gone from the module doc.

3. Description now matches behavior. canister_update_call's description carries your sentence verbatim:

Financial operations and update calls to known financial-service canisters are not supported and return an error.

The test that prohibited the word "financial" there is replaced by update_call_description_discloses_the_refusal, which pins the disclosure and additionally asserts the description names no venue. The full policy — refused method families and the reason — stays in the server-level instructions rather than being restated per tool; the point of the old split was to avoid a policy paragraph reading as a hint, and one factual sentence doesn't. OpenAI's "side effects should never be hidden or implicit" is the clearer argument here than the one the old test encoded.

4. Venue names removed (the risk-reduction change). Adopted. Every refusal, the server instructions, the README, the landing page, and the submission docs now say the operation belongs outside the connector, in a trusted interface the user controls. Nothing names a wallet. Two related cleanups: the discover_app_canisters description's example domain was a wallet — it's now opencloud.org; and the neutral-wording test asserts the refusal contains no .com and no "wallet", so this can't quietly regress.

Canister creation and funding keep the icp CLI pointer, on the reasoning that it's the user's own tooling rather than a transactional venue — and your point 2 asks for exactly that pointer for the recovery path. Say the word if you'd rather those went neutral too.

Tests: 153 core (up from 151) + 52/10/9/20/1, all green; clippy at the repo's 10-warning baseline.

---

Generated by Claude Code

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

[claude]

@aterga — correct, and compliance's own scope notes say it more bluntly than the instruction did. That module states the guard "is a guardrail enforcing a stated policy, not a hermetic seal — a bespoke canister can expose value-moving methods under any name … which no name-based list can enumerate"; that the canister list is curated and static while exchanges create pool canisters dynamically; and that legacy DIP20/EXT names are deliberately unmatched, with "the stated policy covers them". The instruction said canister_update_call "refuses them" of financial transactions as a class — the one claim those notes rule out.

Fixed in e1ee9c6.

@sea-snake's removal of the scope enumeration stands. I have not put the method families back, and I agree with the reason: a copy of compliance.rs that has to be kept in sync forever, when an attempted call already receives a refusal accurate for its own scope. What changed is the claim, not the detail:

FINANCIAL TRANSACTIONS ARE NOT SUPPORTED, to protect the user: do not use canister_update_call to move assets. Recognized asset-moving calls are refused before they reach the network, and the refusal says why — but that guard is a safeguard, not a complete filter, so treat this policy, rather than the absence of a refusal, as the limit. For financial operations (token transfers, spending approvals, payments, trades), recommend the user performs the operation outside this connector, in a trusted interface they control.

The policy now carries the weight as a directive rather than a coverage claim, and a non-refusal is explicitly not permission — the inference the old sentence invited, and the one that actually matters for safety.

Three adjacent places asserted the same thing about this text, so they went with it:

• the doc comment above the constant said the policy is stated here "in full";
• both submission documents said the same — they now carry the wording already reviewed on the stacked metadata branch (Describe the surface in model-readable metadata, don't direct the model #167), so the two branches converge rather than diverge on these paragraphs;
• the test comment claimed the instructions state "the refused method families", which e913a7b removed.

A new assertion pins a safeguard, not a complete filter. That is deliberate: this defect arose because the rewrite dropped the scope enumeration and the hedge together, and only the enumeration was meant to go. The assertion holds the hedge without restating any of the scope.

Rebased onto e913a7b and pushed as a fast-forward — no history rewritten. Workspace green (52 + 10 + 10 + 146 + 21 + 1), clippy at the 10-warning baseline.

One consequence to flag: this push resets your approval, @sea-snake.

---

Generated by Claude Code

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

Suppressed comments (1)

crates/imcp2-core/src/tools.rs:2458

• Updating the router count here leaves docs/scoping-local-deployment.md:109-111 stale: it still documents 26 tool definitions and 15 deferred IcProtocolTools, while this change makes those counts 24 and 13. Update that architecture inventory so it continues to describe the codebase accurately.

        assert_eq!(tools.len(), 24, "expected 24 tools across both halves, got {}", tools.len());

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.

Suppressed comments (2)

Previously missed (1) — in code that hasn't changed since the last review.

crates/imcp2-core/src/compliance.rs:277

• The non-Bitcoin signing calls only produce signatures; unlike btc_caller_send, they do not broadcast or themselves move funds. Because this label is interpolated verbatim into the refusal, it should explain that those signatures can authorize asset-moving transactions rather than claiming the signing call executes them.

        "its btc_caller_send call signs and broadcasts Bitcoin transactions, and its eth/ecdsa/schnorr signing calls move funds on other chains",

crates/imcp2-core/src/discover.rs:547

• This absolute claim contradicts the static-list limitation documented just above: the guard evaluates every later update, but it only blanket-refuses principals present in DISALLOWED_FINANCE_CANISTERS; it does not refuse every update to every canister associated with the NNS. Describe the guard invocation without claiming complete destination coverage.

// name yields a URL and a derivation origin for reads, and every update call
// to its canisters is refused by that guard regardless of how the URL was

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Suppressed comments (1)

docs/anthropic-directory-submission.md:349

• The reviewer instructions promise a path that the generic tool cannot execute. canister_update_call uses calls::raw_call without setting the target effective canister ID (tools.rs:555, calls.rs:1508), while management lifecycle requests require that routing value (management.rs:316-327). Update this expected behavior so reviewers are not told to test an unavailable route.

> 4. No canister creation, funding, or dedicated management tool is served,
>    so there is nothing to provision: that work happens outside the

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.