Open source, upstream contributions, and coordinated disclosures.
A FastMCP server exposing a tag-scoped Qubes Admin API sandbox. Autonomous agents are given real capability — spawning qubes, running commands, attaching devices, networking through a controlled egress — while the trust boundary is enforced in dom0 by invariant-checking wrappers rather than trusted to the agent. Built and tested in stages; default-deny throughout.
While hardening the qubes-mcp trust boundary I found that a freshly-created qube was invisible to qrexec policy — calls fell through to the default rule — because qubesd’s SystemInfoCache was not invalidated when a domain was added or removed. Reported as qubes-issues #10911 and fixed in pull request #825, merged upstream.
Design questions on tag-scoped Admin API access and dom0-mediated wrappers, put to the Qubes developer list and answered point by point by the Qubes OS project lead.
Design notes and open questions on tag-scoped Admin API access with dom0-mediated trust boundaries. Posted for review by the Qubes engineering community.
Coordinated security findings are listed here once the maintainer has shipped a fix and acknowledged the report. Reports inside a responsible-disclosure window are not named until then.