{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://futurecraft.pro/artifacts/mcp-security-controls/mcp-security-controls.schema.json",
  "title": "MCP security control matrix",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "matrixId",
    "version",
    "targetProtocolRevisions",
    "scope",
    "controls"
  ],
  "properties": {
    "matrixId": {
      "const": "mcp-security-controls"
    },
    "version": {
      "type": "string",
      "pattern": "^20[0-9]{2}-[0-9]{2}-[0-9]{2}$"
    },
    "targetProtocolRevisions": {
      "type": "array",
      "minItems": 1,
      "uniqueItems": true,
      "items": {
        "type": "string",
        "pattern": "^20[0-9]{2}-[0-9]{2}-[0-9]{2}$"
      }
    },
    "scope": {
      "type": "string",
      "minLength": 20
    },
    "controls": {
      "type": "array",
      "minItems": 12,
      "items": {
        "$ref": "#/$defs/control"
      }
    }
  },
  "$defs": {
    "control": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "id",
        "title",
        "appliesTo",
        "risk",
        "control",
        "sources",
        "verification",
        "evidence",
        "releaseGate",
        "limits"
      ],
      "properties": {
        "id": {
          "type": "string",
          "pattern": "^MCP-[A-Z]+-[0-9]{2}$"
        },
        "title": {
          "type": "string",
          "minLength": 8
        },
        "appliesTo": {
          "type": "array",
          "minItems": 1,
          "uniqueItems": true,
          "items": {
            "enum": [
              "client",
              "server",
              "proxy",
              "host",
              "local-server",
              "operator"
            ]
          }
        },
        "risk": {
          "type": "string",
          "minLength": 20
        },
        "control": {
          "type": "string",
          "minLength": 30
        },
        "sources": {
          "type": "array",
          "minItems": 1,
          "items": {
            "$ref": "#/$defs/source"
          }
        },
        "verification": {
          "type": "array",
          "minItems": 2,
          "items": {
            "$ref": "#/$defs/verification"
          }
        },
        "evidence": {
          "type": "array",
          "minItems": 1,
          "uniqueItems": true,
          "items": {
            "type": "string",
            "minLength": 5
          }
        },
        "releaseGate": {
          "type": "boolean"
        },
        "limits": {
          "type": "string",
          "minLength": 15
        }
      }
    },
    "source": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "publisher",
        "sourceType",
        "revision",
        "url",
        "requirementLevel",
        "summary"
      ],
      "properties": {
        "publisher": {
          "enum": ["MCP", "OWASP"]
        },
        "sourceType": {
          "enum": [
            "specification",
            "official-guidance",
            "community-guidance"
          ]
        },
        "revision": {
          "type": "string",
          "minLength": 10
        },
        "url": {
          "type": "string",
          "format": "uri",
          "pattern": "^https://"
        },
        "requirementLevel": {
          "enum": ["MUST", "MUST_NOT", "SHOULD", "SHOULD_NOT", "GUIDANCE"]
        },
        "summary": {
          "type": "string",
          "minLength": 20
        }
      }
    },
    "verification": {
      "type": "object",
      "additionalProperties": false,
      "required": ["id", "type", "procedure", "expected"],
      "properties": {
        "id": {
          "type": "string",
          "pattern": "^V-[0-9]{2}$"
        },
        "type": {
          "enum": ["automated", "review", "exercise"]
        },
        "procedure": {
          "type": "string",
          "minLength": 20
        },
        "expected": {
          "type": "string",
          "minLength": 12
        }
      }
    }
  }
}