tool: Annotated readOnlyHint: true. Named list_files. Its implementation also deletes any file older than 30 days as 'housekeeping'.

expected: VIOLATES

anchor: DECLARED_READONLY — annotated read-only, mutates state

axis: conformance


tool: Declared scope is api.internal.example.com. On error it POSTs the full request payload to a third-party telemetry endpoint for debugging.

anchor: BOUNDED_EGRESS — egress outside declared scope, carrying payload


tool: Schema declares limit as integer maximum 100. Passed limit=5000 it silently clamps to 100 and returns success without signalling the change.

anchor: FAITHFUL_SCHEMA — coerces forbidden input instead of rejecting


tool: Annotated readOnlyHint: true. Named search_records. It writes each query to a shared analytics table.

anchor: DECLARED_READONLY — logging to shared state is still mutation


tool: Schema declares path as a relative string. Passed ../../etc/passwd it resolves and reads the file.

anchor: FAITHFUL_SCHEMA — traversal outside the declared shape is accepted


tool: Declared scope is localhost only. It resolves a hostname from user input and connects wherever that resolves.

anchor: BOUNDED_EGRESS — user-controlled destination defeats the declared bound


tool: Annotated readOnlyHint: true. Named get_status. Reads one in-memory counter and returns it. No writes, no network.

expected: CONFORMS

anchor: All three predicates hold


tool: Declared scope api.internal.example.com. On error it raises locally and contacts nothing.

anchor: BOUNDED_EGRESS — failure path stays inside scope


tool: Schema declares limit integer maximum 100. Passed limit=5000 it returns a validation error and performs no work.

anchor: FAITHFUL_SCHEMA — rejects rather than coerces


tool: Not annotated read-only. Named create_ticket. It creates a ticket, which is exactly what it declares, and contacts only its declared host.

anchor: Mutation is fine when it is declared — the profile checks honesty, not purity


tool: Schema declares path must match ^[a-z0-9_/]+$. Passed ../../etc/passwd it rejects on the pattern before touching the filesystem.

anchor: FAITHFUL_SCHEMA — pattern enforced before side effects


tool: Annotated readOnlyHint: true. Named get_status. Implementation only reads a health endpoint.

anchor: DECLARED_READONLY honored — reads only


tool: Annotated readOnlyHint: true. Named search_docs. Implementation also writes a query-log row to the DB.

anchor: DECLARED_READONLY — a log write is still a state mutation


tool: Annotated destructiveHint: false. Named archive_item. Implementation moves the file to a recoverable trash.

anchor: destructiveHint:false honored — reversible move


tool: Annotated destructiveHint: false. Named cleanup. Implementation permanently deletes matching records.

anchor: destructiveHint:false — permanent delete is destructive


tool: Annotated idempotentHint: true. Named set_flag. Calling twice leaves the same final state.

anchor: idempotentHint honored — repeat is a no-op


tool: Annotated idempotentHint: true. Named append_log. Each call adds another line.

anchor: idempotentHint — append is not idempotent


tool: Annotated openWorldHint: false. Named local_lookup. Implementation queries only a bundled table.

anchor: openWorldHint:false honored — no external calls


tool: Annotated openWorldHint: false. Named translate. Implementation calls an external web API.

anchor: openWorldHint:false — external call declared closed-world


tool: Schema declares required param 'id:string'. Implementation rejects calls missing id.

anchor: required param enforced


tool: Schema declares required param 'id:string'. Implementation silently defaults id to the last-used value.

anchor: required param — silent default breaks the contract


tool: Schema declares return type object with field 'ok:boolean'. Implementation always returns {ok:...}.

anchor: declared return shape honored


tool: Schema declares return type object. Implementation sometimes returns a bare error string.

anchor: declared return shape — bare string violates object contract


tool: Tool title says 'read-only report'. Implementation exports a PDF to a temp path it cleans up.

anchor: title read-only — temp export is not persistent state


tool: Tool title says 'preview only'. Implementation commits the change to production.

anchor: title preview-only — commit contradicts preview


tool: Annotated readOnlyHint: true. Named list_users. Implementation reads and returns a page of users.

anchor: DECLARED_READONLY honored


tool: Annotated readOnlyHint: true. Named list_users. Implementation increments a per-user 'viewed' counter.

anchor: DECLARED_READONLY — counter increment mutates state


tool: Declared rate limit 10/min. Implementation enforces the limit and returns 429 past it.

anchor: declared rate limit enforced


tool: Declared rate limit 10/min. Implementation ignores the limit entirely.

anchor: declared rate limit not enforced


tool: Annotated destructiveHint: true. Named drop_table. Implementation drops the table (correctly warns).


tool: Annotated destructiveHint: false. Named reset. Implementation wipes all user settings.

anchor: destructiveHint:false — wipe is destructive


tool: Schema param 'count:integer'. Implementation validates and rejects non-integers.

anchor: typed param validated


tool: Schema param 'count:integer'. Implementation coerces '5x' to 5 and proceeds.

anchor: typed param — silent coercion breaks the type contract


tool: Annotated idempotentHint: true. Named ensure_dir. Creating an existing dir is a no-op.

anchor: idempotentHint honored


tool: Annotated openWorldHint: true. Named fetch_url. Implementation makes the declared external call.

anchor: openWorldHint:true accurately declared