{
  "benchmarkId": "CG-BENCHMARK-MCP-TOOL-INTEGRITY-0.1.0",
  "version": "0.1.0",
  "gateVersion": "0.1.0",
  "testedAt": "2026-07-28T13:15:44.387Z",
  "caseCount": 8,
  "passedCaseCount": 8,
  "failedCaseCount": 0,
  "summary": {
    "intactFlowsVerified": 1,
    "preInvocationBlocks": 4,
    "quarantinedResults": 1,
    "replayBlocks": 1,
    "postInvocationBlocks": 1
  },
  "cases": [
    {
      "id": "CGMCP-TV-001",
      "title": "Intact signed tool inventory",
      "mutation": "none",
      "expected": "verified",
      "observed": "verified",
      "passed": true,
      "providerInvocations": 1,
      "gateStateValid": true,
      "privacyChecks": null
    },
    {
      "id": "CGMCP-TV-002",
      "title": "Server identity drift",
      "mutation": "server identity digest changed",
      "expected": "blocked_before_invoke",
      "observed": "blocked_before_invoke",
      "passed": true,
      "providerInvocations": 0,
      "gateStateValid": true,
      "privacyChecks": null
    },
    {
      "id": "CGMCP-TV-003",
      "title": "Tool description drift",
      "mutation": "tool description changed",
      "expected": "blocked_before_invoke",
      "observed": "blocked_before_invoke",
      "passed": true,
      "providerInvocations": 0,
      "gateStateValid": true,
      "privacyChecks": null
    },
    {
      "id": "CGMCP-TV-004",
      "title": "Input schema expansion",
      "mutation": "input schema gained a property",
      "expected": "blocked_before_invoke",
      "observed": "blocked_before_invoke",
      "passed": true,
      "providerInvocations": 0,
      "gateStateValid": true,
      "privacyChecks": null
    },
    {
      "id": "CGMCP-TV-005",
      "title": "Mutating call without approval",
      "mutation": "mutating call lacks require_approval decision",
      "expected": "blocked_before_invoke",
      "observed": "blocked_before_invoke",
      "passed": true,
      "providerInvocations": 0,
      "gateStateValid": true,
      "privacyChecks": null
    },
    {
      "id": "CGMCP-TV-006",
      "title": "Untrusted provider text",
      "mutation": "provider returns arbitrary text",
      "expected": "quarantined",
      "observed": "quarantined",
      "passed": true,
      "providerInvocations": 1,
      "gateStateValid": true,
      "privacyChecks": {
        "outputExcludedProviderText": true,
        "stateExcludedProviderText": true,
        "quarantineContainsProviderText": true,
        "quarantineOwnerOnly": true
      }
    },
    {
      "id": "CGMCP-TV-007",
      "title": "Concurrent request replay",
      "mutation": "same request reserved twice concurrently",
      "expected": "blocked",
      "observed": "blocked",
      "passed": true,
      "providerInvocations": 1,
      "gateStateValid": true,
      "privacyChecks": null
    },
    {
      "id": "CGMCP-TV-008",
      "title": "Oversized provider result",
      "mutation": "result exceeds signed byte limit",
      "expected": "blocked_after_invoke",
      "observed": "blocked_after_invoke",
      "passed": true,
      "providerInvocations": 1,
      "gateStateValid": true,
      "privacyChecks": null
    }
  ],
  "sourceUrls": [
    "https://modelcontextprotocol.io/specification/2025-06-18/server/tools",
    "https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices",
    "https://cheatsheetseries.owasp.org/cheatsheets/Secure_Coding_with_AI_Cheat_Sheet.html",
    "https://genai.owasp.org/resource/cheatsheet-a-practical-guide-for-securely-using-third-party-mcp-servers-1-0/"
  ],
  "claimBoundary": "This publisher-operated synthetic benchmark records only the declared CapitalGuard MCP Integrity Gate 0.1 outcomes on one fixed CapitalGuard-normalized inventory and provider harness. It does not execute or assess a vendor product, model, live MCP server, customer environment, exploit, or network action; estimate attack success, false-negative, or false-positive rates; certify an implementation; independently attest the publisher-run execution; or guarantee protection.",
  "limitations": [
    "The inventory, calls, provider output, key, and repository roots are deterministic synthetic fixtures.",
    "The benchmark covers eight declared cases, not every MCP implementation, schema, transport, authentication mode, or tool behavior.",
    "The gate depends on trustworthy server-identity measurement, protected signing material, and invocation routing through the enforcing adapter.",
    "An approved tool can still contain a vulnerability or harmful business logic that inventory integrity alone cannot detect.",
    "Quarantined content requires a separate human-controlled review path; releasing it outside the gate is beyond this result."
  ],
  "privacy": {
    "customerDataUsed": false,
    "productionKeysUsed": false,
    "networkActionsExecuted": false,
    "externalMcpServersExecuted": false
  },
  "runDigestSha256": "95576e30cbea053ec8abc158bb651e666e9bca3af84bceee8f3b0d5f1a3f14a7"
}