Trademark and Certification Policy#

Version: 0.1.0
Status: Draft
Last Updated: 2025-01-15

Overview#

This document defines the use of the “MCP Server Security Standard” (MSSS) name, associated marks, and certification claims.

Intellectual Property#

Standard Text#

The normative text of the MSSS (all documents in /standard/, /controls/, /governance/) is licensed under:

Creative Commons Attribution 4.0 International (CC BY 4.0)

You are free to:

Share: Copy and redistribute in any medium or format
Adapt: Remix, transform, and build upon the material

Under the following terms:

Attribution: You must give appropriate credit, provide a link to the license, and indicate if changes were made

Full license: https://creativecommons.org/licenses/by/4.0/

Code and Schemas#

Code examples (if any) and JSON schemas (/reporting/*.json) are licensed under:

Apache License 2.0

Full license: https://www.apache.org/licenses/LICENSE-2.0

Repository#

The repository itself (automation scripts, tooling) is licensed under:

MIT License

Full license: https://opensource.org/licenses/MIT

Trademark Policy (Provisional)#

As of v0.1, “MCP Server Security Standard” and “MSSS” are not registered trademarks. This policy describes intended future usage.

Fair Use#

You MAY use “MCP Server Security Standard” or “MSSS” to:

Accurately refer to this standard
State that your software “complies with MSSS v0.1”
Teach, write about, or discuss the standard
Develop tools that evaluate compliance

Restricted Use#

You MUST NOT:

Imply official endorsement without authorization
Use “MSSS Certified” without formal certification (see below)
Modify the standard and distribute it as “MSSS” without clear disclaimers
Register confusingly similar trademarks

Attribution#

When referring to the standard, include:

This [product/document/tool] implements the MCP Server Security Standard (MSSS) v0.1.
https://github.com/YOUR-ORG/mcp-security-standard

Certification Policy#

Self-Assessment#

Anyone MAY:

Assess their own MCP server against MSSS
Claim “self-assessed compliance with MSSS v0.1 Level X”
Publish self-assessment reports

Self-assessment does NOT imply third-party validation.

Official Certification (Future)#

As of v0.1, there is no official certification program. A future certification program may include:

Accredited assessors
“MSSS Certified” mark usage rights
Public registry of certified servers
Periodic re-certification requirements

When established, only servers evaluated by accredited assessors may use the “MSSS Certified” mark.

Interim Best Practices#

Until official certification exists:

Use language like “self-assessed”, “evaluated against”, or “complies with” (not “certified by”)
Publish assessment reports for transparency
Link to specific version (e.g., “MSSS v0.1 L2”)

Enforcement#

Currently, enforcement is community-based:

Report misuse via GitHub issues
Maintainers may contact violators directly
In future: DMCA takedown or trademark complaints (if marks are registered)

Derivative Works#

You MAY create derivative standards based on MSSS (e.g., industry-specific adaptations) under CC BY 4.0, provided you:

Clearly state it’s a derivative work
Do not imply it’s the official MSSS
Credit the original MSSS

Example:

FinTech MCP Security Standard v1.0
(Derived from MSSS v0.1, with additional controls for financial services)

Logo and Branding (TBD)#

As of v0.1, no official logo exists. If a logo is created:

Logo usage guidelines will be published here
Logo files will be in /assets/
Logo licensed separately (likely CC BY-SA or similar)

Contact#

For licensing or trademark questions:

Open an issue with the legal label
Email: (to be established)

Disclaimer: This policy may change as the standard matures and formal governance structures are established. Check back for updates.