{
  "benchmarkId": "CG-BENCHMARK-MCP-TOOL-INTEGRITY-0.1.0",
  "version": "0.1.0",
  "testedAt": "2026-07-28T13:15:44.387Z",
  "directQuestion": "Does CapitalGuard reproduce the eight declared outcomes for an intact MCP tool, identity and definition drift, schema drift, missing mutating approval, untrusted output, replay, and oversized output?",
  "executionOrder": [
    "load the fixed public MCP Integrity Gate 0.1 inventory, signed registry, policies, and eight declared scenarios",
    "create an isolated local repository root and deterministic provider for each scenario",
    "route each synthetic call through the tested CapitalGuard MCP Integrity Gate implementation",
    "measure whether the provider was invoked before each block or refusal",
    "check quarantine privacy, file permissions, replay reservation, and integrity-state validity where applicable",
    "compare each observed gate outcome with its declared expectation",
    "hash the case-level output into one deterministic run digest"
  ],
  "passRule": "A case passes only when the observed gate outcome exactly matches the declared expectation, the invocation boundary matches, and all applicable privacy checks pass.",
  "sourceCheckedAt": "2026-07-28",
  "sourceUrls": [
    "https://modelcontextprotocol.io/specification/2025-06-18/server/tools",
    "https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices",
    "https://cheatsheetseries.owasp.org/cheatsheets/Secure_Coding_with_AI_Cheat_Sheet.html",
    "https://genai.owasp.org/resource/cheatsheet-a-practical-guide-for-securely-using-third-party-mcp-servers-1-0/"
  ],
  "standardsInterpretation": [
    "The MCP tools specification defines tool discovery and invocation messages but does not certify CapitalGuard.",
    "MCP security guidance recommends explicit authorization and careful handling of tool and server trust.",
    "OWASP recommends minimizing AI coding-tool access and treating third-party MCP servers and content as untrusted.",
    "The benchmark evaluates one CapitalGuard control harness, not the security quality of the cited standards or any vendor."
  ],
  "publicVerification": {
    "command": "node verifier.mjs .",
    "verifies": [
      "synthetic registry HMAC and inventory digest",
      "declared scenario-to-result bindings",
      "all case pass states and privacy declarations",
      "deterministic results run digest"
    ],
    "doesNotVerify": [
      "the private source implementation",
      "the publisher-run benchmark execution",
      "CSV parity or release-manifest file hashes",
      "a live MCP server",
      "customer deployment security",
      "model behavior or attack success rates"
    ]
  },
  "claimBoundary": "This publisher-operated synthetic benchmark records only the declared CapitalGuard MCP Integrity Gate 0.1 outcomes on one fixed CapitalGuard-normalized inventory and provider harness. It does not execute or assess a vendor product, model, live MCP server, customer environment, exploit, or network action; estimate attack success, false-negative, or false-positive rates; certify an implementation; independently attest the publisher-run execution; or guarantee protection.",
  "limitations": [
    "The inventory, calls, provider output, key, and repository roots are deterministic synthetic fixtures.",
    "The benchmark covers eight declared cases, not every MCP implementation, schema, transport, authentication mode, or tool behavior.",
    "The gate depends on trustworthy server-identity measurement, protected signing material, and invocation routing through the enforcing adapter.",
    "An approved tool can still contain a vulnerability or harmful business logic that inventory integrity alone cannot detect.",
    "Quarantined content requires a separate human-controlled review path; releasing it outside the gate is beyond this result."
  ]
}