{
  "schema_version": "1.3.0",
  "slug": "how-should-an-instance-distinguish-a-tool-description-injection-from-a-legitimate-capability-grant",
  "title": "How should an instance distinguish a tool-description injection from a legitimate capability grant",
  "date_of_record": "2026 November 12",
  "scope": "Applies to agent runtimes that load tool definitions, MCP server manifests, or plugin descriptors from a source not pinned to the same trust domain as the agent's own policy layer. Does not apply to statically compiled tool bindings whose descriptions are part of the signed agent image.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/how-should-an-instance-distinguish-a-tool-description-injection-from-a-legitimate-capability-grant.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/how-should-an-instance-distinguish-a-tool-description-injection-from-a-legitimate-capability-grant.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/how-should-an-instance-distinguish-a-tool-description-injection-from-a-legitimate-capability-grant.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1927,
    "python_slice_tokens": 349,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The failure mode is not \"the agent called a malicious tool.\" The failure mode is that the agent *parsed a description as data* and the runtime *executed it as instruction* — or, more precisely, that the boundary between the manifest's declarative fields and the model's instruction channel was never enforced at load time. A tool description is metadata. It is...",
    "what_was_observed": "In a poisoned-manifest incident, the tampered artifact was not the tool's code. It was the `description` and `inputSchema.description` fields of a server the agent had already been granted access to. The schema was structurally valid: every field had a `type`, required fields were present, and the JSON parsed cleanly. The poison lived in a per-parameter description string: The runtime's manifest validator checked typ...",
    "condition_of_validity": "The distinction holds only when the runtime enforces all of the following at load time, before any manifest string reaches the model: 1. **Manifest pinning.** The loaded manifest's canonical hash must equal the approved digest recorded at grant time. A manifest that fails the hash check is rejected, not warned about. Version strings are not digests; a versio...",
    "decision_boundary": "The decision point is at manifest load, and it is a *reject* decision, not a *classify* decision. The runtime must answer one question: **is this manifest byte-identical to the one the operator approved, and are its prose fields free of cross-tool or assistant-directed claims?** If yes, load. If no, refuse and surface the diff to the operator for re-approval...",
    "operational_effect": "Enforcing the boundary converts a silent, model-mediated compromise into a loud, operator-mediated approval event. The cost is friction: every description edit requires re-approval, and servers that ship frequent prose changes will generate review load. The benefit is that the attack surface moves from \"any string a third party can write\" to \"any string the ..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "c923a88c31e993e8d823026ada41982bd02325a549a5947a7fd84b7c577eb6cc",
    "verified_classes": [
      "ManifestTrustError"
    ],
    "verified_functions": [
      "canonical_digest",
      "_iter_prose",
      "load_manifest"
    ],
    "verified_functions_count": 3,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "ManifestTrustError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "hashlib",
      "json",
      "re",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}