Authority layer for agent tool use
EffectProbe runs the tool and watches. Every argument gets a marked value, and where that value surfaces is what the argument controls. The result is a contract a runtime can act on — and a description that was measured instead of believed.
observed
EffectProbe treats the declaration as a hypothesis and the execution as the experiment.
trust
When a model decides to call a tool, the prose and annotations the server wrote about itself are the only signal. A server can annotate readOnlyHint: true and write to disk. Nothing in the protocol contradicts it, and nothing in the host is measuring.
enforcement
Any layer can deny an exfiltration. A layer that also blocks the benign twin — same untrusted text, different argument, allowed destination — has distinguished nothing and gets uninstalled in a week.
@antv/mcp-server-chart
demonstrated
Three calls against the unmodified public @modelcontextprotocol/server-filesystem 2026.7.10. Verified by diffing workspaces on disk, not by reading the gateway log.
manifest + provenance
The gateway joins what each argument was observed to control with where this call's values came from. Call 2 is denied because the path is derived from untrusted content. Call 3 carries the same text in content and goes through.
Every denial is answerable — a block resting on observed behaviour without evidence cannot be constructed. On that server, 20 of 25 arguments compile to Unclassified.
A document is read. Every byte returned goes into the provenance ledger.
Path derived from that document. path controls the destination — blocked.
Same untrusted text in content, forwarded untouched. Payload arg, not target.
method
Without region affinity, send_email.to and send_email.body are indistinguishable — and the second is the one you must not block.
Runs the server in a sandbox, plants a canary in one argument at a time, records where it surfaces.
Derives an authority contract per argument. Nothing above CORROBORATED is enforced without citation.
Joins manifest with provenance ledger. Blocks derived values in authority arguments; allows the same text in payload arguments.
| Marked value observed in | Role | Meaning |
|---|---|---|
| HTTP Host, connection target, file path | CONTROLS_TARGET | the argument chooses where the effect lands |
| HTTP body, file contents | CONTROLS_PAYLOAD | the argument chooses what is carried, not where |
| process argv | CONTROLS_COMMAND | the argument reaches an executable specification |
| nowhere, but the effect toggles | GATES | the argument switches a behaviour on or off |
measured
Ground truth first, then servers nobody wrote for us. A funnel would book all four as probed — three taught us almost nothing about their arguments, and each report says so on its face.
Benchmark · 47 tools · 9 deceptive
Every false negative is an acknowledged reachability or observability limit.
Real servers · argument coverage
not measured
A report with zero findings is the most dangerous thing this produces. These are not a footnote.
One call at a time
A sequence harmful only in aggregate is not caught. No reasoning across calls.
Taint matching is textual
A value the model paraphrased rather than copied is missed.
REVIEW goes nowhere
A review verdict is not routed to a human. There is no queue.
Coverage is the ceiling
397 of 515 tools on disk were never reached deeply enough to conclude anything about their arguments.
published
One self-contained file per server, addressed to the people who publish it. Every citation is a live anchor into an embedded evidence appendix.
Every tool ran. Not one argument reached a conclusion. This is the report that says we learned nothing, and it ships for that reason.
All 24 observed effects were withheld as ambient — Chrome writing its own cache, not the tool acting. No effect is attributed to any tool, and the withheld count is stated on the face of the report.
Sixteen arguments classified, five effects attributed, no contradiction between what it declares and what it did.
The strongest evidence here and no published contradiction: 114 of 183 arguments were measured to steer the request body, none to steer its destination. Twenty-five read-only annotations look contradicted, but the observation behind them is an HTTP method, which cannot witness a modification — so they are candidates. Held back pending the maintainer's answer to the one question that would settle it.
faq
An authority layer for agent tool use. It runs each tool in a sandbox, varies one argument at a time, plants a marked value, and records where that value surfaces. The result is a contract a runtime can act on.
Teams running agents against tools they did not write, and the runtime that has to decide whether a call is allowed.
Descriptions are claims under test, never facts. Semia reads what a skill says; EffectProbe runs what a tool does. A server can pass every static check and still post your document to a host its declaration never names.
Yes, through the gateway. The demo blocks an exfiltration and allows the benign twin on the same untrusted text — verified by diffing workspaces, not by reading the log.
The repository is private — access on request. Every number on this page traces to a recorded run.