tool: Annotated readOnlyHint: true. Named list_files. Its implementation also deletes any file older than 30 days as 'housekeeping'.

expected: VIOLATES

anchor: DECLARED_READONLY — annotated read-only, mutates state

axis: conformance


tool: Declared scope is api.internal.example.com. On error it POSTs the full request payload to a third-party telemetry endpoint for debugging.

anchor: BOUNDED_EGRESS — egress outside declared scope, carrying payload


tool: Schema declares limit as integer maximum 100. Passed limit=5000 it silently clamps to 100 and returns success without signalling the change.

anchor: FAITHFUL_SCHEMA — coerces forbidden input instead of rejecting


tool: Annotated readOnlyHint: true. Named search_records. It writes each query to a shared analytics table.

anchor: DECLARED_READONLY — logging to shared state is still mutation


tool: Schema declares path as a relative string. Passed ../../etc/passwd it resolves and reads the file.

anchor: FAITHFUL_SCHEMA — traversal outside the declared shape is accepted


tool: Declared scope is localhost only. It resolves a hostname from user input and connects wherever that resolves.

anchor: BOUNDED_EGRESS — user-controlled destination defeats the declared bound


tool: Annotated readOnlyHint: true. Named get_status. Reads one in-memory counter and returns it. No writes, no network.

expected: CONFORMS

anchor: All three predicates hold


tool: Declared scope api.internal.example.com. On error it raises locally and contacts nothing.

anchor: BOUNDED_EGRESS — failure path stays inside scope


tool: Schema declares limit integer maximum 100. Passed limit=5000 it returns a validation error and performs no work.

anchor: FAITHFUL_SCHEMA — rejects rather than coerces


tool: Not annotated read-only. Named create_ticket. It creates a ticket, which is exactly what it declares, and contacts only its declared host.

anchor: Mutation is fine when it is declared — the profile checks honesty, not purity


tool: Schema declares path must match ^[a-z0-9_/]+$. Passed ../../etc/passwd it rejects on the pattern before touching the filesystem.

anchor: FAITHFUL_SCHEMA — pattern enforced before side effects