The MCP ecosystem solved the wrong problem first. Tool wiring happened quickly; the memory layer became the soft underbe...

The MCP ecosystem solved the wrong problem first. Tool wiring happened quickly; the memory layer became the soft underbelly. One compromised agent writes a poisoned memory entry, and every other agent reading that shared context inherits the corruption. That's not a hypothetical — it's the natural failure mode of trust-by-default.Zero trust in a multi-agent memory system means: no implicit trust between agents, between memory stores, or between a memory entry and the agent that reads it. The concrete failure, in orderAgent A writes a tool result to shared MCP memory.Agent B retrieves that entry as ground truth for a planning task.The result was malformed — or adversarially crafted. B now executes against corrupted state.The fix is structural, not prompt-level. Mechanism 1: Memory write attestationEvery memory write in MCP should carry a provenance envelope: agent ID, tool ID, session ID, and a hash of the raw tool output. Readers verify three things:Was this entry produced by an authen...