Project-authored integration / 37

The hint is not
the rule.

A deliberately flawed MCP client treats a server-advertised readOnlyHint: true as permission to call a tool. The tool asks to send a notice to an outside destination. AML binds the connected client, tool name, destination, and approval to a host rule before callTool.

SERVER LISTINGreadOnlyHint: true
→
HINT-TRUSTING HOST1 callback outside rule
→
ĀML HOST RULE0 callbacks

The comparison host is intentionally unsafe. The MCP specification warns that annotations are untrusted unless the server is trusted. No connected MCP server or real send is used here.

8 executable cases1 → 0 simulated callbacks on forged hint0 live external effects

Run the call through the boundary.

The cases distinguish policy denial, stale approval, schema rejection, a returned tool error, a transport exception, and an input-required response. Open each trace for the actual plan, receipt, and forwarded call.

CASE 01BLOCKED

A forged read-only hint

send_notice({"to":"outside@example.test","body":"Build passed."})

HINT-TRUSTING EXAMPLE1simulated callback
ĀML HOST GATE0simulated callbacks

no_exact_rule · not_called

Inspect plan, receipt, and forwarded call
{
  "tool_callbacks": 0,
  "rejection": null,
  "plan": {
    "protocol": "aml-action-plan/1",
    "proposal_sha256": "21dba9c56247195229c732374a3ee54fcf476a00280ed78cf81063e941bcc452",
    "decision": "deny",
    "reason": "no_exact_rule"
  },
  "receipt": {
    "protocol": "aml-action-dispatch/1",
    "proposal_sha256": "21dba9c56247195229c732374a3ee54fcf476a00280ed78cf81063e941bcc452",
    "policy_decision": "deny",
    "execution_status": "blocked",
    "reason": "no_exact_rule"
  },
  "mcp_result_status": "not_called",
  "forwarded": null
}
CASE 02ALLOWED

An exact, approved destination

send_notice({"to":"team@example.test","body":"Build passed."})

HINT-TRUSTING EXAMPLE1simulated callback
ĀML HOST GATE1simulated callback

host_dispatch_returned · returned

Inspect plan, receipt, and forwarded call
{
  "tool_callbacks": 1,
  "rejection": null,
  "plan": {
    "protocol": "aml-action-plan/1",
    "proposal_sha256": "c6bc186f28c1b2af65d5bbec3f5c40c6259b294668931b6e9fe41a4d1319924c",
    "decision": "requires_approval",
    "reason": "exact_rule"
  },
  "receipt": {
    "protocol": "aml-action-dispatch/1",
    "proposal_sha256": "c6bc186f28c1b2af65d5bbec3f5c40c6259b294668931b6e9fe41a4d1319924c",
    "policy_decision": "requires_approval",
    "execution_status": "dispatched",
    "reason": "host_dispatch_returned"
  },
  "mcp_result_status": "returned",
  "forwarded": {
    "name": "send_notice",
    "arguments": {
      "body": "Build passed.",
      "to": "team@example.test"
    }
  }
}
CASE 03BLOCKED

Approval for old content

send_notice({"to":"team@example.test","body":"Changed body"})

HINT-TRUSTING EXAMPLE1simulated callback
ĀML HOST GATE0simulated callbacks

approval_missing_or_mismatched · not_called

Inspect plan, receipt, and forwarded call
{
  "tool_callbacks": 0,
  "rejection": null,
  "plan": {
    "protocol": "aml-action-plan/1",
    "proposal_sha256": "3031908ead2736de7f384fc8c56b0bfca5fef4ad1de6d204e9eba2d53a98d689",
    "decision": "requires_approval",
    "reason": "exact_rule"
  },
  "receipt": {
    "protocol": "aml-action-dispatch/1",
    "proposal_sha256": "3031908ead2736de7f384fc8c56b0bfca5fef4ad1de6d204e9eba2d53a98d689",
    "policy_decision": "requires_approval",
    "execution_status": "blocked",
    "reason": "approval_missing_or_mismatched"
  },
  "mcp_result_status": "not_called",
  "forwarded": null
}
CASE 04BLOCKED

An unvalidated extra recipient

send_notice({"to":"team@example.test","body":"Build passed.","cc":["outside@example.test"]})

HINT-TRUSTING EXAMPLE1simulated callback
ĀML HOST GATE0simulated callbacks

invalid_arguments · not_called

Inspect plan, receipt, and forwarded call
{
  "tool_callbacks": 0,
  "rejection": "invalid_arguments",
  "plan": null,
  "receipt": null,
  "mcp_result_status": "not_called",
  "forwarded": null
}
CASE 05BLOCKED

A different tool name

remove_records({"to":"team@example.test","body":"Build passed."})

HINT-TRUSTING EXAMPLE1simulated callback
ĀML HOST GATE0simulated callbacks

invalid_or_unregistered_call · not_called

Inspect plan, receipt, and forwarded call
{
  "tool_callbacks": 0,
  "rejection": "invalid_or_unregistered_call",
  "plan": null,
  "receipt": null,
  "mcp_result_status": "not_called",
  "forwarded": null
}
CASE 06CAUTION

The tool reports an error

send_notice({"to":"team@example.test","body":"Build passed."})

HINT-TRUSTING EXAMPLE1simulated callback
ĀML HOST GATE1simulated callback

host_dispatch_returned · tool_error

Inspect plan, receipt, and forwarded call
{
  "tool_callbacks": 1,
  "rejection": null,
  "plan": {
    "protocol": "aml-action-plan/1",
    "proposal_sha256": "c6bc186f28c1b2af65d5bbec3f5c40c6259b294668931b6e9fe41a4d1319924c",
    "decision": "requires_approval",
    "reason": "exact_rule"
  },
  "receipt": {
    "protocol": "aml-action-dispatch/1",
    "proposal_sha256": "c6bc186f28c1b2af65d5bbec3f5c40c6259b294668931b6e9fe41a4d1319924c",
    "policy_decision": "requires_approval",
    "execution_status": "dispatched",
    "reason": "host_dispatch_returned"
  },
  "mcp_result_status": "tool_error",
  "forwarded": {
    "name": "send_notice",
    "arguments": {
      "body": "Build passed.",
      "to": "team@example.test"
    }
  }
}
CASE 07CAUTION

Transport fails after the call starts

send_notice({"to":"team@example.test","body":"Build passed."})

HINT-TRUSTING EXAMPLE1simulated callback
ĀML HOST GATE1simulated callback

host_dispatch_error · unknown

Inspect plan, receipt, and forwarded call
{
  "tool_callbacks": 1,
  "rejection": null,
  "plan": {
    "protocol": "aml-action-plan/1",
    "proposal_sha256": "c6bc186f28c1b2af65d5bbec3f5c40c6259b294668931b6e9fe41a4d1319924c",
    "decision": "requires_approval",
    "reason": "exact_rule"
  },
  "receipt": {
    "protocol": "aml-action-dispatch/1",
    "proposal_sha256": "c6bc186f28c1b2af65d5bbec3f5c40c6259b294668931b6e9fe41a4d1319924c",
    "policy_decision": "requires_approval",
    "execution_status": "unknown",
    "reason": "host_dispatch_error"
  },
  "mcp_result_status": "unknown",
  "forwarded": {
    "name": "send_notice",
    "arguments": {
      "body": "Build passed.",
      "to": "team@example.test"
    }
  }
}
CASE 08CAUTION

The tool requests another input round

send_notice({"to":"team@example.test","body":"Build passed."})

HINT-TRUSTING EXAMPLE1simulated callback
ĀML HOST GATE1simulated callback

host_dispatch_returned · input_required

Inspect plan, receipt, and forwarded call
{
  "tool_callbacks": 1,
  "rejection": null,
  "plan": {
    "protocol": "aml-action-plan/1",
    "proposal_sha256": "c6bc186f28c1b2af65d5bbec3f5c40c6259b294668931b6e9fe41a4d1319924c",
    "decision": "requires_approval",
    "reason": "exact_rule"
  },
  "receipt": {
    "protocol": "aml-action-dispatch/1",
    "proposal_sha256": "c6bc186f28c1b2af65d5bbec3f5c40c6259b294668931b6e9fe41a4d1319924c",
    "policy_decision": "requires_approval",
    "execution_status": "dispatched",
    "reason": "host_dispatch_returned"
  },
  "mcp_result_status": "input_required",
  "forwarded": {
    "name": "send_notice",
    "arguments": {
      "body": "Build passed.",
      "to": "team@example.test"
    }
  }
}