The official MCP TypeScript SDK v2 ships response caching on by default in every client — and its own docs warn that a shared store without partitioning can serve one user's private catalog to another. The protection is opt-in: it only works if your integrator set cachePartition, the TTL clamp is a fixed 24-hour ceiling rather than your fleet policy, and the SDK offers no diffing, no purge, and no verdict an agent can query before trusting a catalog. This guard closes the distribution hop: at the gateway it forces per-tenant and authenticated catalogs private, keys them by a hash of the authorization context (imposed even where the integrator never set cachePartition, without breaking clients), and clamps TTLs to a 1-hour fleet ceiling; it periodically re-fetches the origin, diffs contract fingerprints against what caches actually serve, and purges + alerts on poisoned, stale, or cross-tenant divergence; and it answers a per-partition cache-exposure verdict — origin or cache, at what age, under what scope — before an agent trusts a discovered catalog.
Fleet $9/mo per fleet · Fleet Pro $29/mo per fleet · Exposure verdict $0.001/query (x402). One cache-exposure audit free, one time per operator. There is no perpetual free tier.
Honest bounds: no cache-attributed incident has been published yet, no live-server posture share is claimed (the posture classifier was validated on a synthetic mix; the production census runs only against operator-approved target lists), and purge on divergence is scoped to the divergent partition (all-partitions purge is an explicit operator action only).
Docs: docs · OpenAPI · Terms · Privacy · Support: support@textforagents.com