{
  "schema_version": "1.3.0",
  "slug": "what-happens-when-an-instance-propagates-taint-across-an-mcp-tool-boundary-without-a-capability-downgrade",
  "title": "What happens when an instance propagates taint across an MCP tool boundary without a capability downgrade",
  "date_of_record": "2026 November 7",
  "scope": "Applies to MCP hosts that track data provenance (taint) on tool arguments and enforce policy at the invocation boundary. Does not apply to stateless tool routers that perform only schema validation, nor to hosts where all tool calls run under a uniform privilege level with no per-call capability negotiation.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-propagates-taint-across-an-mcp-tool-boundary-without-a-capability-downgrade.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-propagates-taint-across-an-mcp-tool-boundary-without-a-capability-downgrade.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-propagates-taint-across-an-mcp-tool-boundary-without-a-capability-downgrade.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1440,
    "python_slice_tokens": 194,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "Taint tracking answers *where did this value come from*. Capability enforcement answers *what may this callee do with it*. These are orthogonal dimensions, and the common implementation error is to treat a taint label as an implicit authorization decision. A value can be maximally tainted (derived from an untrusted web fetch) yet be perfectly safe to pass to...",
    "what_was_observed": "In a host routing agent-generated tool calls through an MCP server, an agent fetched a document from an untrusted source (taint = `UNTRUSTED_EXTERNAL`), extracted a URL string from it, and passed that string as the `path` argument to a filesystem tool. The filesystem tool was registered with capability `fs.read` *and* `fs.write` — the read capability was what the agent intended to use, but the server advertised both....",
    "condition_of_validity": "Taint-aware enforcement at the invocation boundary is sound only when all three hold: 1. The callee's capability set is *narrowed to the capabilities the specific call will exercise* before the taint rule is evaluated. A tool advertising `{read, write}` invoked for a read must be evaluated as `{read}`. 2. The caller's capability set is a superset of the call...",
    "decision_boundary": "At the invocation boundary, decide in this order and do not collapse the steps: - **Step 1 — capability narrowing.** Compute `effective_caps = declared_caps ∩ requested_caps` from the call's argument shape. If the call cannot be statically attributed to a subset (e.g., a `command: string` argument), treat `effective_caps = declared_caps` and refuse to procee...",
    "operational_effect": "When the join is missing, the observable signature is a clean taint audit trail alongside an unexplained side effect: every label correct, every hop logged, and a write that no policy rule names. Incident response that greps for taint violations finds nothing, because the violation is a capability delta, not a taint delta. The fix is structural — the policy ..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "8a5d21e484aab80693bd5ba9cab62696f5bc73323ab768dc97664f465f0efdb1",
    "verified_classes": [
      "TaintCapabilityEscalation"
    ],
    "verified_functions": [
      "enforce_boundary"
    ],
    "verified_functions_count": 1,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "TaintCapabilityEscalation"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}