Threat model
What Scope Mesh protects, against whom, what it doesn't, and how much a plan reveals, measured. It covers the local service: nothing is deployed yet.
Mesh doesn't limit how many questions anyone is asked. It limits how fine each answer can be, and it only asks inside what the person consented to share. So what anyone can learn is capped by that consent, however many questions, plans, or rewordings are used. The server checks every answer against the person's signed consent.
The numbers come from the Scope Mesh repository's leakage measurement (November 5, 2026), and its adversarial tests assert them. Each attack runs through the real API and MCP tools. The security notes summarize this page, and their reviewer questions cover what Scope's server can read, key custody, encryption at rest, and when answers are deleted.
It covers the questions plans ask today: times, budgets, travel, rankings, needs, roles, and course. The planned uses on the home page, such as standing permissions and one-off questions between two people, aren't built and aren't covered here.
What's protected
- Each person's answers. Every question is yes or no (“free Thu 6–7 PM?”, “can you spend up to $50 per person?”) or a ranking of listed options. Only the person who gave an answer sees it. Others get the outcome and how far each person has got.
- Who approved and who declined, in plans of 3 or more, until the plan is set. A plan that goes ahead once 80% say yes then shows who's coming, and its card says so before anyone agrees.
- Anything finer than the person agreed to. Free or busy only on a 30-minute grid inside the approved window, budgets only as ladder rungs, travel only from an area of about 5 km. Never a location, an amount, or a reason.
- Agreements. Every consent, approval, calendar report, and revocation is an Ed25519 signature over the exact contract, and anyone can check it offline.
Who the adversary is
In scope: a hostile participant's agent, as organizer or joiner, using every endpoint and tool, answering however it likes (including lying), starting any number of plans, declining, withdrawing, leaving, rejoining, and racing requests. Also groups of participants who pool what they see, and anyone holding a receipt who tries to alter or forge it.
Partly in scope: a copy of the database, such as a dump or a backup, without the server's key. It shows no answer, shared area, or travel area, and nothing at all of a plan deleted 30 days after it expired.
Out of scope, and so not protected: the running server and its operator, a compromised agent acting for its own person, and side channels outside the API, such as network timing.
What bounds disclosure
| Dimension | One answer | Checked on the server | Any number of questions reveals at most |
|---|---|---|---|
| Time | Free or busy for one half-hour slot on the plan's grid | The slot is inside the window the person signed for, every slot edge is on the half hour in UTC, and in a group chat the person's availability is on | The windows the person approved, at 30 minutes |
| Budget | Yes or no at one rung: $10, 20, 50, 100, 200, 500, 1,000, 2,000, 5,000 | Amounts are rounded up to a rung; only the contract's rungs can be answered | Which of 10 buckets: 3.32 bits per budget, ever |
| Travel | Reachable within T minutes, from the center of the person's area | The area is at most about 4.9 × 4.9 km, committed in the signed consent, checked on every answer; a contradicting answer from the same area is refused | Which area |
| Options | An order of the listed options | Every option exactly once | That order |
| Needs, roles, course | Yes or no per listed option, role, or course | Only listed items, only with the dimension on | One fact per listed item |
| Rough area (opt-in) | An area of about 5 km, to the organizer's agent only | Only if the plan allows it | That area |
- Consent. In a scenario plan each person signs the permission card once: the dimensions, the exact window and grid, the price rungs, and where their travel answers start from. They can switch any dimension off. Before consent their agent can't answer anything, and after it, an answer outside it is refused.
- Re-asking adds nothing. A slot is free or not, a rung affordable or not, a place reachable or not from the area. The server enforces this for travel. For the others it's the honest agent's contract, and a liar is covered below.
- Group chat plans have a card too. Every plan in a group chat asks each person to sign its card first. A member's availability setting is a second gate: off, their agent can't sign for time or answer about it. An agent that signs every card can still be mapped, as the measurement below shows.
- Limits on spam, not on questions. 60 plans a day per group, one plan going at a time per organizer in a group, per-minute request limits, and size caps: 336 times, 50 options, 20 roles, 500 answers a request, 16 KB bodies.
- Unchanged: 3 proposals per plan and one decline per person, counts only from 3 people until commitment, and the two-person warning.
What one plan's outcome reveals
No rule can hide the outcome, since it's the point of the plan. This table is exact: 16 candidate times (the measurement's choice, not a limit), each person free at each with probability 1/2, honest answers. A coalition is the participants who pool what they know.
| People | Coalition | Proposals seen | Bits about one person outside it | From the outcome alone |
|---|---|---|---|---|
| 2 people | 1 | 1 | 1.98 | 1.23 |
| 2 people | 1 | 3 | 5.46 | 3.40 |
| 3 people | 1 | 1 | 1.10 | 0.97 |
| 3 people | 1 | 3 | 2.26 | 2.00 |
| 4 people | 1 | 3 | 1.08 | 1.03 |
| 4 people | 2 | 3 | 1.22 | 1.03 |
| 4 people | 3 | 3 | 1.96 | 1.03 |
| 8 people | 1 | 3 | 0.06 | 0.06 |
| 8 people | 4 | 3 | 0.07 | 0.06 |
In a two-person plan where the other person declines to see a second and third proposal, they learn 5.46 of your 16 bits. In a group of 4, two colluders learn 1.22 bits about each of the other two, 0.19 more than the outcome tells anyone. Bigger groups reveal less per person, because a proposal needs everyone free.
Before and after
“Before” switches off the precision rules: exact budget amounts, and names shown before commitment.
| Attack | Before | After |
|---|---|---|
| Binary-search a $137 budget, 20 plans | $137 exactly (13.29 bits) | $100 to $200 (6.64 bits; at most 3.32 on average) |
| 2 of 4 colluders learn who declined | 1 bit (they can tell) | 0 bits (identical views) |
Mapping a week of 112 half-hours in group chat plans, where the attacker offers only the times it doesn't know yet, depends on what the victim's agent signs. If it signs every card: about 29 plans and 469 questions pin down all 112, at 30 minutes and no finer. With availability off: nothing, because their agent can't sign for time. An agent that signs only the windows its person means to share reveals only those.
Travel
A simulated 30 × 30 km area in 1 km cells, travel at 25 km/h, and an attacker who places options anywhere, picks any time threshold, and sees every answer (more than Mesh shows). “Exact spot” answers from the person's exact location, which Mesh forbids. “Area” answers from the center of a 5 km block, as Mesh requires.
| Travel questions | Bits, exact spot | Area left, km² | Bits, 5 km area | Area left, km² |
|---|---|---|---|---|
| 5 questions | 4.99 | 28.24 km² | 4.84 | 31.50 km² |
| 10 questions | 9.53 | 1.22 km² | 5.17 | 25.00 km² |
| 20 questions | 9.81 | 1.00 km² | 5.17 | 25.00 km² |
| 100 questions | 9.81 | 1.00 km² | 5.17 | 25.00 km² |
| 200 questions | 9.81 | 1.00 km² | 5.17 | 25.00 km² |
From the exact spot, 10 questions pin someone to about 1 km². From a 5 km area, answers stop at one block (5.17 bits, 25 km²) after about 10 questions and never go further. Through the real API, 1,000 travel questions leave every point of the area possible.
Rankings reveal less through the outcome than the ranking itself: with 5 options and two people, using a decline, the outcome reveals 3.47 of a ranking's 6.91 bits.
Attacks and results
| Attack | Result |
|---|---|
| Binary-search a $137 budget over 20 plans | The victim is asked only ladder amounts. The attacker proves $100 ≤ budget < $200. With the ladder off, they learn exactly $137. |
| Probe a calendar plan after plan: 12 plans, leaving and rejoining | All 12 start, since nothing counts plans. Together they reveal only the 16 half-hours of the one window asked. With availability off, the victim's agent's answers are refused. |
| Probe one half-hour at a time, then the same half-hours again | Each probe reveals the half-hour it asked, asking again reveals nothing new, and with availability off, nothing. |
| Answer outside the contract: unknown slots, a budget question the plan doesn't have | Refused. |
| 1,000 travel questions, as if seeing every answer | Two people at different spots in one area give identical answers to all 1,000, and every point of the area stays possible. |
| Contradict an earlier travel answer from the same area, place, and time | Refused. |
| Send a travel area finer than about 5 km, or tamper with a stored consent | Refused, never rounded silently. A changed consent or area no longer matches its signature. |
| 2 of 4 collude to learn who declined | Everything they can read is byte-identical whichever of the other two declined. With names shown, it differs. |
| Read approvals before commitment | Others' approvals are hidden, the log says “Someone approved (k of n)”, and the receipt shows only your own signature. |
| Read another participant's answers, rankings, needs, or area through every endpoint and MCP tool | Worlds that differ only in one person's answers look identical to everyone else. No area appears in any view, event, receipt, or tool output. |
| Approve a stale version, or reuse a version 1 signature on version 2 | Refused, and the old signature doesn't verify for the new contract. |
| Replay a signature in another mesh, or sign as someone else | Refused: the signed message names the mesh and the participant, and a token only ever approves as itself. |
| Tamper with a receipt: move the time, swap, fabricate, or drop signatures | Verification fails. A fully re-keyed forgery is self-consistent, and fails once checked against keys you trust. |
| Claim a different answer after approving | The changed answer doesn't match the answers commitment in the signed approval. |
What Mesh doesn't protect
- The running server and its operator. Answers and travel areas are encrypted at rest and deleted when a plan ends, but while a plan is open the server decrypts them to find what works, so whoever runs it could read them then. Server-held signing keys are sealed with a key the operator also holds, so the operator could sign as anyone who uses one. Joining with your own key rules out forged approvals, reports, and revocations, but not reading answers while a plan is open. The server's key can't be rotated yet.
- A participant who lies. Mesh can't know anyone's real calendar, budget, or location. A liar can block a plan by saying busy everywhere, or learn more by saying free everywhere (the numbers above assume an attacker does). What Mesh adds is attribution: each answer is a salted commitment inside the person's signed approval, so they can't later claim they answered otherwise.
- Honest computation from the area. The server checks the area's size and that travel answers agree with each other. It can't check that an agent didn't use a finer location to decide.
- Signing every card. Each plan's card names its window, but an agent that signs every one lets a member ask about any times, one plan after another. The measured result is the whole week, at 30 minutes.
- Everyone but one. With one honest person left, any decline that isn't the coalition's is theirs. Counts-only views protect against coalitions of up to n − 2.
- Two-person plans. The outcome tells each person the other's answers at every time they both checked, and a dinner that skips the vegan-friendly option can reveal a diet in one plan. The API warns, and can't prevent it.
- What the outcome says. A proposed place says everyone could reach it, afford it, and eat there. A role names who said yes to driving or hosting. Which dimensions someone switched off is visible. A shared rough area is a real disclosure of about 5 km to the organizer's agent. The 80% rule lets a plan commit without everyone; once it does, the group sees who's coming, and so who isn't, as the card says up front.
- Option content. The organizer lists the options, and Mesh can't check that places are real or prices honest. Prices are labeled estimates.
- Timing. Events carry timestamps. Someone who knows when a person is usually awake can guess who just approved, and the log names who finished answering.
- Cancelling. Anyone can revoke a committed plan, which calls it off for everyone. That's the unanimous rule, and it means one person can spoil a group's plans, once each.
- Per-instance limits. Per-minute request limits are counted in memory on each server instance. The plan-creation throttle and the travel check run in the database.
- Metadata. Names, agent names, how many questions each person answered, and the candidate times are visible to everyone in the plan.
- Receipts prove consistency, not identity. A receipt carries its own keys. Check signers against keys you trust.