Refuse update calls to known finance-related canisters

[aterga]

Extends the financial-transactions guard in two ways. First, manage_neuron — the one standardized method through which NNS and SNS governance neurons are disbursed, split, and spawned — joins the always-refused method names alongside the ICRC transfer/approval surface, covering every SNS DAO's governance (54 exist today, more launch by NNS proposal) and every future one with no list to go stale. Second, a curated, labeled disallow list of finance-related canisters on which canister_update_call refuses every update method — closing the gap where value could still move through non-standardized methods (a DEX swap, a minter withdrawal) that no method-name list can enumerate. Each canister entry carries two labels — what service it provides, and how it is finance-related — interpolated verbatim into the refusal, e.g.:

swap is an update call to the Sonic exchange swap canister — its deposit, swap, and liquidity calls move tokens between user subaccounts and pools. State-changing calls to financial services are not supported by this server, to protect the user: asset-moving requests are denied. …

The canister list (52 entries — count verified programmatically, per review)

Every id was verified against the IC dashboard's canister registry (ic-api.internetcomputer.org, exact registered names) and the services' own published sources (their canister_ids.json / manifests / docs / on-chain SNS records) on 2026-08-28; the dashboard-unnamed entries are each pinned by a project-official source (DFINITY's own repos, apps' own /.well-known/ic-app.json manifests, live x-ic-canister-id headers, SNS proposal payloads).

• The network's own funds infrastructure (6): NNS Governance (its whole update surface, beyond manage_neuron), both NNS dapp frontends (classic qoctq… and current mc7vh… origins), the Genesis Token canister (claim_neurons), the ICP ledger, the cycles ledger.
• Chain-key minters (3) — they move real assets on other chains: ckBTC (retrieve_btc), ckETH/ckERC20 (withdraw_eth/withdraw_erc20), ckDOGE (retrieve_doge).
• All 14 mainnet chain-key token ledgers (ckBTC, ckETH, ckUSDC, ckUSDT, ckEURC, ckWBTC, ckWSTETH, ckLINK, ckUNI, ckSHIB, ckPEPE, ckXAUT, ckOCT, ckDOGE).
• Wallets (5): the Oisy backend, the Chain Fusion Signer (signs and broadcasts Bitcoin transactions; its eth/ecdsa/schnorr signatures move funds on other chains), Oisy Trade, the Oisy rewards canister, the wallet frontend.
• Liquid staking (3): the WaterNeuron protocol canister (ICP deposits, nICP minting, unstaking withdrawals), the nICP ledger, and its frontend — pinned by WaterNeuron's own canister_ids.json.
• Exchanges (21): MULTI/DEX (backend, bridge, frontend — self-declared by the app's own /.well-known/ic-app.json); ICPSwap (SwapFactory, PasscodeManager, farm + staking-pool factories, frontend); Sonic (swap canister, LBP registry, vesting, plus the XTC and WICP DIP-20 ledgers — their legacy transfer/mint names are exactly what the standardized-methods group deliberately does not match, so the canister entries close that documented gap for the two most prominent legacy ledgers); ICDex/ICLighthouse (router, DexAggregator, DAO trader, trading-mining, frontend); ICPEx (router, token-creation service, frontend).

Deliberately not listed

• Per-SNS governance canisters — covered by the manage_neuron method rule instead (per review): a static list of 54 DAOs (a third of them aborted swaps, some renamed or folded) would go stale the day the next SNS launches, while the method rule covers them all, present and future.
• KongSwap — removed per review: the service no longer exists.
• CMC — its notify_create_canister/notify_top_up are the documented recovery path for a user's own interrupted icp-CLI funding flow.
• Read-only canisters (ledger indexes/archives, the exchange-rate canister, oracles/validators/loggers) — no value-moving update surface.
• Dynamically created canisters (ICPSwap per-pair pools/farms, ICDex per-pair orderbooks, per-SNS ledgers): a static list cannot enumerate them; the module docs say so, and the standardized-methods group plus the stated policy cover them.
• Undeployed (the reserved ckSOL ids — no code installed yet) and role-undocumented project canisters (e.g. two SNS-registered WaterNeuron dapp canisters whose roles have no published id mapping).

Mechanics

• Method-level refusals keep precedence, so their tailored messages survive: a cycles-ledger creation spend still points at the user-run icp CLI, an ICRC hit still names the standard method; the canister blanket catches everything else on listed canisters (pinned by a test).
• Tests: manage_neuron refused on any canister; every canister entry refuses arbitrary update names with both labels + the protective policy wording and no marketplace/compliance jargon; the list is well-formed (valid, unique principals; non-empty labels); precedence pinned. The literal-matching test demonstrates on an unlisted canister (on a listed one, everything is refused regardless of spelling).
• Description surfaces updated in step: SERVER_INSTRUCTIONS, the README tool-table row, both directory docs' guard bullets, and the landing page's two "refused by design" strings — all four now name the manage_neuron rule alongside the ICRC names (per review). Per review, the directory docs state the posture present-tense only — no history of past functionality.

Also in this PR

The NNS is dropped from the known-app registry (separate commit): the name registry exists to route agents to well-known apps, and routing them to a staking/funds frontend sits badly with the not-a-financial-tool posture — so open_app("nns") no longer resolves, no repair guidance points at it, and the unknown-app note no longer enumerates it. The KNOWN_DERIVATION_ORIGINS mappings stay: a user who brings an NNS URL themselves still derives the correct per-app identity for reads (instead of a silently wrong, empty-looking one), and update calls to the NNS canisters are refused by the new guard.

Verification

• cargo test workspace-green: 153 core + 20 local tests.
• cargo clippy at the existing 10-warning baseline.
• All researched ids batch-verified against ic-api.internetcomputer.org before curation (exact name matches, or unnamed-but-source-pinned; rejected/undeployed ids excluded).

🤖 Generated with Claude Code

https://claude.ai/code/session_01LvwAVXfx5kLNc4SqKXkavk

[Copilot]

Pull request overview

Adds a finance-canister denylist so all update calls to curated financial services are refused, while retaining method-specific precedence.

Changes:

• Adds and tests 45 labeled finance-canister restrictions.
• Removes NNS from name-based app discovery while preserving explicit URL identity derivation.
• Updates policy documentation and landing-page messaging.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
crates/imcp2-core/src/compliance.rs	Implements and tests the denylist.
crates/imcp2-core/src/tools.rs	Updates server policy instructions.
crates/imcp2-core/src/discover.rs	Removes NNS name resolution.
README.md	Documents update-call restrictions.
docs/openai-directory-submission.md	Updates OpenAI policy explanation.
docs/anthropic-directory-submission.md	Updates Anthropic policy explanation.
src/assets/index.html	Updates landing-page policy text.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

crates/imcp2-core/src/compliance.rs:138

• The PR description calls this a 41-entry canister list, but the static contains 46 entries (44 inline IDs plus ICP_LEDGER and CYCLES_LEDGER). Update the stated count, or remove any unintended entries, so the documented review scope matches the implemented guard.

const DISALLOWED_FINANCE_CANISTERS: &[(&str, &str, &str)] = &[

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Suppressed comments (3)

Previously missed (1) — in code that hasn't changed since the last review.

crates/imcp2-core/src/compliance.rs:138

• The PR description identifies this as a 47-entry list, but the constant contains 52 entries (6 infrastructure + 3 minters + 14 ledgers + 5 wallets + 3 WaterNeuron + 3 MULTI/DEX + 5 ICPSwap + 5 Sonic + 5 ICDex/ICLighthouse + 3 ICPEx). Reconcile the five-entry discrepancy or update the PR description so the audited inventory count is accurate.

const DISALLOWED_FINANCE_CANISTERS: &[(&str, &str, &str)] = &[

docs/openai-directory-submission.md:120

• The directory submission's exhaustive guard description omits the new global manage_neuron rule. Because per-SNS governance canisters are intentionally not in the curated list, the current wording understates the protection added by this PR. Include manage_neuron among the standardized methods refused on every canister.

  `manage_neuron` — neuron staking and disbursement — on every canister,
  plus the ICP and cycles ledgers' own
  value-moving methods on those ledgers, plus every update call on a curated

crates/imcp2-core/src/tools.rs:2009

• The documented refusal scopes omit the new global manage_neuron rule. Per-SNS governance canisters are deliberately absent from the curated list, so these server instructions currently do not disclose the restriction that provides coverage for every SNS. Include the NNS/SNS manage_neuron method alongside the globally refused ICRC methods.

             equivalents) AND the governance method manage_neuron (neuron staking/disbursement, \
             on the NNS and every SNS) on every canister, the ICP and cycles ledgers' own \
             transfer/withdrawal/creation methods on those ledgers, and EVERY update call on a \
             curated list of known financial-service canisters (token ledgers and minters, \

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

[aterga]

All three requested changes are in 48002b5, plus the risk-reduction one. Summary of what landed, and the two places I went slightly beyond the letter of the request:

1. OpenAI policy analysis — corrected. You're right, and the old section was wrong in a way that mattered: it read the restriction as narrower. Section 3 of docs/openai-directory-submission.md is rewritten around the same non-financial posture as the Anthropic submission, quoting the app guidelines directly — "execution of money transfers, crypto transfers, or investment trades" is prohibited outright, alongside the speculation/consumer-deception clause. The commerce rules are handled separately as what they are (nothing to attach to: the plugin sells nothing), rather than as the reason the attestation is satisfiable.

2. CMC — blocked, and I extended it to four methods. You named notify_create_canister and notify_top_up. Fetching the CMC's interface, its complete user-callable update surface is four methods: those two plus notify_mint_cycles (mints cycles to a cycles-ledger account) and create_canister (creates a canister from attached cycles). All four are the same class of call by your own criterion — each one completes a funding operation — so listing only two would have left the same concrete path open under a different name. The remaining CMC methods are queries or NNS-only admin calls. All four are scoped to rkp4c-7iaaa-aaaaa-aaaca-cai (verified as "NNS Cycles Minting" against the dashboard registry) rather than matched globally, so an unrelated canister's method that happens to share a name still works.

Recovery is preserved, just not through the connector: these refusals point at the icp CLI, with the install pointer and the skill://icp-cli / skill://cycles-management guides — the same redirect the creation spends already used. The "deliberately not listed" scope note is gone from the module doc.

3. Description now matches behavior. canister_update_call's description carries your sentence verbatim:

Financial operations and update calls to known financial-service canisters are not supported and return an error.

The test that prohibited the word "financial" there is replaced by update_call_description_discloses_the_refusal, which pins the disclosure and additionally asserts the description names no venue. The full policy — refused method families and the reason — stays in the server-level instructions rather than being restated per tool; the point of the old split was to avoid a policy paragraph reading as a hint, and one factual sentence doesn't. OpenAI's "side effects should never be hidden or implicit" is the clearer argument here than the one the old test encoded.

4. Venue names removed (the risk-reduction change). Adopted. Every refusal, the server instructions, the README, the landing page, and the submission docs now say the operation belongs outside the connector, in a trusted interface the user controls. Nothing names a wallet. Two related cleanups: the discover_app_canisters description's example domain was a wallet — it's now opencloud.org; and the neutral-wording test asserts the refusal contains no .com and no "wallet", so this can't quietly regress.

Canister creation and funding keep the icp CLI pointer, on the reasoning that it's the user's own tooling rather than a transactional venue — and your point 2 asks for exactly that pointer for the recovery path. Say the word if you'd rather those went neutral too.

Tests: 153 core (up from 151) + 52/10/9/20/1, all green; clippy at the repo's 10-warning baseline.

---

Generated by Claude Code

[sea-snake]

Same as above, let's omit " and every update call on a curated list of known
financial-service canisters (token ledgers and minters, exchanges, wallet
backends, staking/governance)."

[aterga]

Omitted in 1e8baa0, same as the Anthropic one: the bullet now says "every update call on the financial-service canisters it carries".

---

Generated by Claude Code

[aterga]

We should drop the two CMC functions as well.

Read as the two funding tools — icp_create_canister and icp_top_up_canister — since the two CMC notification methods (notify_create_canister, notify_top_up) were already refused by the guard in 48002b5. Done in 2fe9274.

Both tools printed icp CLI steps for operations that spend the user's ICP or cycles, and both already sat on the unserved protocol router, so no client sees a behavior change. What changed is that the crate no longer carries a funding-shaped tool at all — which is what the submission docs have been claiming ("the connector has no funding or management tools"); until now that was true of the served surface rather than of the code. Their instruction builders, argument and output types, and the ICP decimal helpers that existed only to validate the echoed amounts went with them, so nothing is left dead behind. Tool-surface counts move 26 → 24 across both halves, 15 → 13 on the protocol half.

Creating and funding a canister is still refused at the guard, unchanged: the cycles ledger's create_canister/create_canister_from spends and the cycles-minting canister's whole update surface (notify_top_up, notify_create_canister, notify_mint_cycles, create_canister), each refusal pointing at the user's own icp CLI, which is also how an interrupted mint is recovered.

The same commit drops the financial sentence from canister_update_call's description per @sea-snake, replacing the assertion that required it with a check that no served tool description contains financial language.

Green locally: 143 core + 20 local tests, clippy at its 10-warning baseline.

---

Generated by Claude Code

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 5 comments.

Suppressed comments (1)

crates/imcp2-core/src/tools.rs:531

• This integration comment still describes only the ICRC and system-canister method rules, omitting both new scopes: global manage_neuron refusal and blanket refusal of every update on listed finance canisters. Update it so future changes do not treat this call site as a narrower method-only guard.

        // system ledgers'/cycles-minting canister's own value-moving methods
        // on those canisters, before any network work, pointing the user
        // outside this connector. Queries need no gate — a query cannot
        // commit state, so it cannot move funds.

[aterga]

Correct — that comment described the design that had just been reversed. Fixed in 2d8e5e6: it now says the policy is stated server-wide and in no tool description, with the reason (a policy paragraph in that description reads as a hint the tool is usable for financial transactions) and the name of the test that holds the line across every served description.

The three documentation claims you flagged in the same review — README, and both submission docs — were the same staleness and went out in 1e8baa0, which your review raced. None of them now asserts a tool-level disclosure.

---

Generated by Claude Code

[aterga]

Fixed in 1e8baa0 (your review raced the push). The row now ends "The policy is stated in the server-level instructions, deliberately not in any tool description." — matching the test at tools.rs:2514-2521, which is the direction the maintainers settled on.

---

Generated by Claude Code

[aterga]

Fixed in 1e8baa0. The passage now states the observable posture: the policy is in the server-level instructions — the field the directories scan — and deliberately in no tool description, held there by a test across the served surface. Nothing in the document claims a disclosure a reviewer would not find.

The equivalent claim in the OpenAI doc went out in the same commit.

---

Generated by Claude Code

[aterga]

Fixed in 1e8baa0. The attestation bullet no longer claims a tool-level disclosure: it says every description states what its tool does, returns, and rejects, and that the financial-transactions policy is stated in full in the server-level instructions — the field the scan reads — and kept out of descriptions deliberately.

---

Generated by Claude Code

[aterga]

The inconsistency is real, so I've documented the actual criterion rather than invent a principled one — but the choice of which way to make it consistent isn't mine, so flagging it rather than acting.

What's true: name resolution is a read convenience. It turns a name into an app URL and derivation origin so open_app can read interfaces, discover canisters, and derive the user's per-app principal. It confers no ability to act — this PR's guard refuses every update call to all three of those apps' canisters, Oisy and MULTI/DEX and ICPSwap alike — so an entry here routes to reads, not to a transaction. That holds equally for NNS, which is why keeping its derivation origins was safe and correct.

So there is no safety distinction, and I won't pretend otherwise: NNS came out at the author's request, an editorial choice about which names the server advertises. 2d8e5e6 says exactly that at the list.

The consistent alternative you're pointing at — apply the financial-app criterion to the rest — would empty KNOWN_APPS entirely, since all three remaining entries are financial services. That deletes name resolution as a feature and makes open_app("oisy") fail for a legitimate read. That's a product decision for @aterga, not something to slip into a compliance PR.

---

Generated by Claude Code

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Suppressed comments (3)

Previously missed (2) — in code that hasn't changed since the last review.

crates/imcp2-core/src/tools.rs:1957

• This says canister_update_call contains a financial-policy disclosure, but its description at line 506 contains none, and financial_policy_is_a_server_instruction_not_a_description explicitly enforces that omission. Correct this comment so it does not document the opposite contract.

/// governs the whole surface rather than one tool — and deliberately in NO
/// tool description (per review): a policy paragraph inside
/// `canister_update_call`'s description reads as a hint that the tool is
/// usable for financial transactions, which is the one thing it must not
/// suggest. `financial_policy_is_a_server_instruction_not_a_description`

crates/imcp2-core/src/compliance.rs:69

• The canister_update_call description does not disclose this policy; tools.rs:2513-2522 tests that no served tool description contains financial wording. Align this module documentation with the enforced server-instructions-only design.

//!     instructions (get_info) and disclosed in `canister_update_call`'s own
//!     description; this guard enforces it for the standardized

crates/imcp2-core/src/tools.rs:531

• This integration comment still describes only the ICRC and system-canister rules, omitting the new global manage_neuron rule and the finance-canister blanket. That makes the guard look narrower than the call directly below actually is. Document all three scopes here.

        // system ledgers'/cycles-minting canister's own value-moving methods
        // on those canisters, before any network work, pointing the user
        // outside this connector. Queries need no gate — a query cannot
        // commit state, so it cannot move funds.

[aterga]

Fair hit on my own replacement text — as written, the bullet asserted "every description says what it rejects" and then conceded the financial rejection isn't among them, which reads as a contradiction rather than a distinction. Fixed in dedf749.

It now separates the two claims, because they are about different things:

• each description states what its tool does, what it returns, and which inputs it rejects (an anonymous OQL read, a Candid data query on an OQL canister, a URL with no Internet-Computer evidence);
• the financial-transactions policy is server-wide, not per-tool, and is stated once in the server-level instructions — the field the scan reads — and deliberately in no description.

So nothing promises a behavior the tool lacks, and no refusal is hidden; it is stated for the whole surface in one place. The same commit also cleared the two remaining stale claims your suppressed comments named: the module doc in compliance.rs and the gate's call-site comment (which additionally now documents all three scopes rather than just the method rules).

On the third suppressed comment — tools.rs:1957 — that one is a misread: the text it quotes is the corrected version, which says the policy is stated "deliberately in NO tool description". Nothing to change there.

---

Generated by Claude Code

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

crates/imcp2-core/src/compliance.rs:69

• This scope note contradicts the implemented metadata contract: canister_update_call has no financial-policy disclosure, and tools.rs:2504-2530 explicitly tests that the policy exists only in server instructions. Remove the tool-description claim so the module documentation matches the enforced design.

//!     instructions (get_info) and disclosed in `canister_update_call`'s own
//!     description; this guard enforces it for the standardized

crates/imcp2-core/src/tools.rs:531

• The updated guard comment still describes only the ICRC and system-canister branches, omitting both new behaviors: global manage_neuron rejection and blanket rejection for listed finance canisters. Document all three scopes here so future changes at this call site do not rely on an incomplete description of the gate.

        // system ledgers'/cycles-minting canister's own value-moving methods
        // on those canisters, before any network work, pointing the user
        // outside this connector. Queries need no gate — a query cannot
        // commit state, so it cannot move funds.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

[aterga]

Checked this one rather than taking it at face value, and it doesn't hold: icp_find_app_by_name is not a served tool, so the assertion never sees that description.

• It is declared at line 1327, inside impl IcProtocolTools (which opens at line 1272) — the deferred half.
• The test iterates IcTools::all_tools(), which is IcCanisterTools::tool_router().list_all() (line 134) — the served half only, lines 157–1269.
• the_default_composition_defers_the_protocol_tools pins that boundary: 11 served tools, none icp_-prefixed except icp_oql_guide.

Empirically: cargo test -p imcp2-core --lib financial_policy_is_a_server_instruction_not_a_description passes on dedf749, and CI's test job is green on that head — so the workspace-green report stands.

The <name>.com/.app placeholder is also not a venue in the sense the check targets: the rule exists so metadata answering a refused financial operation doesn't hand the model another transactional service, and that string is a lookalike-domain example inside an unserved description.

One real note from this, which I'm not acting on inside this PR: if IcProtocolTools is ever wired back into the served surface, this check won't extend to it automatically, and that placeholder would then need rewording. Worth handling in whichever change re-serves that half.

---

Generated by Claude Code

[sea-snake]

and deliberately in no description — a policy paragraph inside
canister_update_call's description would read as a hint that the tool is
usable for financial transactions

Why did you mention this here 😭😭😭

Please omit this for the love of god!

[aterga]

Fair, and the reason is worth stating plainly: explaining why the policy is kept out of descriptions invites the reading it exists to prevent. A reviewer needs the posture, not our deliberation.

Omitted in a747610, from both documents — I took the Anthropic one out in the same commit, before your second comment arrived. Both now say the policy is stated in the server-level instructions, covering the whole surface at once, held there by a test, and nothing further.

I did keep the rationale in the two code comments (tools.rs, compliance.rs), since that is what stops the sentence being added back a third time and directory review never reads them. Say so if you want those trimmed as well.

---

Generated by Claude Code

[sea-snake]

— and deliberately in no tool
description: a policy paragraph inside canister_update_call's description
would read as a hint that the tool is usable for financial transactions.

Same as in my other comment, please omit for the love of god!

[aterga]

Already out — a747610 removed it from this document and the OpenAI one together, since the sentence was the same in both. This bullet now ends: the policy is stated in the server-level instructions, the field the directories scan, where it covers the whole surface at once, held there by a test.

---

Generated by Claude Code

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

[aterga]

Correct, and it stings a little: that was the same overclaim this PR keeps removing from other people's sentences, in a comment I wrote two commits ago. The list covers each service's central canisters, and compliance.rs:73-78 says plainly that a static list cannot cover an exchange's dynamically created pool canisters — so "every update call to these apps' canisters is refused" was wrong.

Fixed in 27a2cc8. It now says name resolution writes nothing, so an entry is not itself a route to a transaction; a later update call is a separate request and goes through the guard under exactly the scope that module documents — including its note on what the list cannot cover. No claim of complete canister coverage.

---

Generated by Claude Code

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

crates/imcp2-core/src/management.rs:37

• Removing E8S_PER_ICP leaves its doc comment attached to MAX_SINGLE_SHOT_WASM, so the generated documentation now incorrectly describes the Wasm-size threshold as an ICP conversion constant. Remove the orphaned line.

/// 1 ICP = 100_000_000 e8s.

crates/imcp2-core/src/tools.rs:2478

• The instruction-only tools were removed from this array, but their explanatory comment remains and now annotates no entries. Remove it so the read-only classification test does not imply that any listed tool is instruction-only.

            // Instructions-only since the marketplace-compliance changes: they
            // execute nothing and move no funds, so they are pure reads.