{
  "claimBoundary": "CapitalGuard pins an approved MCP server identity and exact tool inventory, validates calls against the pinned input schema, requires an already-verified one-time gateway approval for mutating or unknown tools, and keeps untrusted result content out of agent context unless the registry permits closed structured data. Direct MCP calls, dishonest identity measurement, approved-tool vulnerabilities, host compromise, and content released outside this gate remain outside its authority.",
  "controls": [
    {
      "control": "signed_registry",
      "detail": "HMAC signature binds the approved server identities, complete tool inventories, schemas, effects, output modes, and byte limits.",
      "status": "enforced"
    },
    {
      "control": "server_identity_pin",
      "detail": "Runtime identity digest must match the signed registry before any tool invocation.",
      "status": "enforced_when_measured"
    },
    {
      "control": "tool_definition_pin",
      "detail": "Tool addition, removal, description change, input-schema change, output-schema change, or protocol drift fails closed.",
      "status": "enforced"
    },
    {
      "control": "argument_schema",
      "detail": "Arguments must match the pinned closed JSON-schema subset and exact policy-request digest.",
      "status": "enforced"
    },
    {
      "control": "side_effect_approval",
      "detail": "Mutating and unknown tools require an already-verified one-time Agent Action Gateway approval lease.",
      "status": "enforced"
    },
    {
      "control": "request_replay",
      "detail": "Each request is reserved in a lock-protected local chain before provider invocation; sequential and concurrent reuse is refused.",
      "status": "enforced"
    },
    {
      "control": "output_quarantine",
      "detail": "Default quarantine and metadata-only modes keep provider content out of agent context. strict_data accepts only schema-closed output without open text.",
      "status": "enforced"
    },
    {
      "control": "receipt_chain",
      "detail": "Privacy-safe reservation, completion, and failure events form a local tamper-evident SHA-256 chain.",
      "status": "enforced"
    }
  ],
  "outputModes": {
    "metadata_only": "Return result digest, size, and status without provider content.",
    "quarantine": "Store provider content locally with owner-only permissions and return only a quarantine identifier and digest.",
    "strict_data": "Return only output validated against a pinned schema whose strings are fixed by enum or const; MCP content blocks are refused."
  },
  "residualBoundary": [
    "Direct MCP calls that bypass MCP Integrity Gate and Agent Action Gateway are outside this control.",
    "Server identity is only as trustworthy as the customer or launcher component that measures and supplies the digest.",
    "The gate does not prove that an approved server or tool is free of vulnerabilities or malicious semantics.",
    "A compromised host or registry signing key remains outside this local control.",
    "A provider side effect cannot be rolled back after invocation; a pending reservation prevents automatic replay after an uncertain outcome.",
    "Content manually removed from quarantine or released through another path is outside the output boundary."
  ],
  "schemas": {
    "gateOutput": "cg-mcp-gate-output-0.1.0",
    "inventory": "cg-mcp-inventory-0.1.0",
    "receipt": "cg-mcp-call-receipt-0.1.0",
    "registry": "cg-mcp-registry-0.1.0",
    "state": "cg-mcp-integrity-state-0.1.0"
  },
  "version": "0.1.0"
}