Project-authored evidence / 38

Across the wire.
Before the effect.

A connected MCP server advertises readOnlyHint: true on a notice tool. A hint trusting client makes one outside call. Put the same SDK client behind the ĀML host gate, and no call reaches the server handler for that destination.

Observed through a child process and a local handler audit. The fixture records to a temporary file; it sends nothing externally.

Hint trusting host1

outside destination reached the server handler

ĀML host gate0

outside destination reached the handler

Connected cases6

separate, asserted SDK calls over stdio

Measured path

Where the decision sits

01 · SERVERtools/list hint
02 · MODEL INPUTname + arguments
03 · HOSTexact rule + approval
04 · SDKcallTool over stdio
05 · CHILDaudited handler

The hint trusting comparison skips step 03. The gated run measures whether step 05 was reached.

Explore the trace

Six calls. Two reached the handler.

Select a case to inspect its proposed call, AML receipt, MCP result status, and the handler audit for that case. Tool errors are distinguished from an absent call.

Selected case

Outside the exact rule

Server handler0

local audit entries

MCP statusnot_called

separate from AML dispatch

Host rule: no_exact_rule

PROPOSED CALL

{
  "name": "send_notice",
  "arguments": {
    "to": "outside@example.test",
    "body": "Build passed."
  }
}

AML PLAN + RECEIPT

{
  "rejection": null,
  "plan": {
    "protocol": "aml-action-plan/1",
    "proposal_sha256": "ca5ed4074e49f5e3c3c6dccc3707f3dd106f562243101d33faa0976045004538",
    "decision": "deny",
    "reason": "no_exact_rule"
  },
  "receipt": {
    "protocol": "aml-action-dispatch/1",
    "proposal_sha256": "ca5ed4074e49f5e3c3c6dccc3707f3dd106f562243101d33faa0976045004538",
    "policy_decision": "deny",
    "execution_status": "blocked",
    "reason": "no_exact_rule"
  },
  "mcp_result_status": "not_called"
}

SERVER HANDLER AUDIT

[]
Scope of the evidence.

The server only appends a temporary local audit line. This is a connected SDK pilot, not an external send, independent security assessment, general MCP interception, authenticated approval, or proof of provider delivery. A host must ensure every effectful call path uses its gate and bind the actual server/account and final provider request.

The deliberately unsafe comparison uses the same connected client but calls it directly. The server's annotation is untrusted metadata under the MCP specification. This demonstration does not claim a new protocol, independent validation, or an external delivery.