# H/M Agent Scope

H/M Agent Scope is a free browser-local preflight for MCP `tools/list` responses and function-tool JSON catalogs.

- Human tool: https://hogarmas.net/agent-scope/
- Export schema: https://hogarmas.net/agent-scope/schema.json
- Packet schema: `hm.agent-scope.v1`
- Ruleset: `2026-07-21.1`
- Hosted model calls: `0`
- Catalog upload: `false`
- Tool execution: `false`
- Security verdict: `false`

## Accepted input

The local parser accepts:

1. A JSON array of MCP tools.
2. An object containing `tools`.
3. A JSON-RPC `tools/list` result containing `result.tools`.
4. Function-tool entries shaped as `{ "type": "function", "function": { ... } }`.

The browser limit is 200,000 characters and 200 tools. Local JSON files are read with the browser File API and are not uploaded.

## Method

The deterministic rules inspect:

- coverage of `readOnlyHint`, `destructiveHint`, `idempotentHint`, and `openWorldHint`;
- MCP pessimistic defaults when annotations are absent;
- conflicts between annotations and action language;
- destructive, external, code-execution, financial, identity, credential, and private-data surfaces;
- high-impact string fields without bounds;
- input and output schema structure;
- cross-tool combinations such as local-data access plus external writes, or code execution plus open-world access.

The output recommends one of three gates: `standard-review`, `confirm-each-call`, or `deny-until-isolated`.

## Privacy

The analyzer does not call an AI model, upload the tool catalog, execute any tool, open any destination, or persist input in local storage. Anonymous usage metrics contain fixed page and action identifiers only and are disabled during automated browser QA.

Exports include the input SHA-256, normalized tool names, aggregate schema counts, annotations, findings, and a suggested policy. Exports omit raw catalog JSON, descriptions, examples, and raw schema values.

## Limits

Agent Scope is an early-warning and architecture-review layer, not a security verdict or certification.

- MCP annotations are hints. An untrusted server can misdescribe behavior.
- Static JSON cannot prove implementation behavior, authorization enforcement, sandboxing, token audience validation, or network controls.
- Keyword and schema analysis can miss novel, indirect, runtime, multilingual, or intentionally misleading behavior.
- A suggested confirmation gate is not an enforcement mechanism.
- Real enforcement belongs in authorization, transport, sandbox, network, secret-management, and approval controls outside the model.

## Primary references

- MCP Security Best Practices: https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices
- MCP 2025-11-25 ToolAnnotations schema: https://modelcontextprotocol.io/specification/2025-11-25/schema#toolannotations
- MCP Tool Annotations as Risk Vocabulary: https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/
- OWASP Top 10 for Agentic Applications 2026: https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
- NIST AI 800-5 agent-security response analysis: https://www.nist.gov/publications/summary-analysis-responses-request-information-regarding-security-considerations-ai