Component · spec & evidence

MCP Tool-Authority Policy Replay

Audits a recorded tool-use log to confirm each action was scoped, approved, undoable, and fenced.

Contract

Does When an AI agent uses outside tools (look something up, change a ticket, read a result from an untrusted source), this checks a recorded log of that tool use to confirm each action was properly fenced: bound to a narrow permission, approved before it changed anything, given a way to undo it, and kept from letting untrusted tool output boss the agent around. It runs on a small built-in make-believe example that carries only labels and references (no real accounts, secrets, or tool contents), so the safety checks an agent's tool use is supposed to pass are inspectable without anything touching a live account.

Scope limit It only checks that the tool-authority evidence in a recorded bundle (scopes, approvals, rollbacks, instruction/data splits, cold replays, redaction, and the expected abuse-case failures) is present and internally consistent. It does not run tools or authorize live MCP/account access, account secret or payload export, treating tool output as instruction, source-file changes, benchmark safety scores, or launch, and it makes no claim that the underlying tool-use policy is domain-correct.

Run

PYTHONPATH=src python3 -m microcosm_core.organs.mcp_tool_authority_replay run --input fixtures/first_wave/mcp_tool_authority_replay/input --out receipts/first_wave/mcp_tool_authority_replay

Evidence

ClassComputed projectionevidence 3/5Source-faithful refactor

Links to Sandbox-Policy Replay, Memory-Poisoning Quarantine Policy Replay

ai-safetyagent-evaluationred-teaming

Source

Source Design note · Source

Map Show on the map

Index Open compact index card

Paper module