Per-tool disclosure for
MCP servers.

Why per-tool disclosure for MCP?

MCP makes it trivial for an agent to invoke a tool. That same ease is the security problem: an agent talking to an unfamiliar MCP server has no machine-readable way to ask 'is this tool read-only? what PII does it expose? has it been tested with my model?' MCP Tool Cards fills that gap.

A canonical example

{
  "tool_card_version": "0.1",
  "tool": {
    "server_id": "kg-billing-mcp",
    "name": "billing-lookup",
    "version": "1.4.0",
    "mcp_server_uri": "https://billing.kineticgain.com/mcp",
    "description": "Looks up a customer's current invoice, plan tier, and usage-to-date. Read-only."
  },
  "schema": {
    "input_schema_inline": {
      "type": "object",
      "required": ["customer_id"],
      "properties": { "customer_id": { "type": "string" } }
    }
  },
  "safety": {
    "side_effect_class": "read",
    "external_systems": ["stripe-api"],
    "reversible": true,
    "rate_limited": true,
    "pii_exposure": "low",
    "secrets_exposure": "none",
    "human_approval_required": false,
    "refusal_modes": ["cross_tenant_access", "rate_limit_exceeded"]
  },
  "tested_with": [
    { "llm": "claude-opus-4-7", "provider": "Anthropic",
      "test_suite_uri": "https://eval.kineticgain.com/suites/mcp-billing-v2",
      "pass_rate": 0.98, "tested_at": "2026-05-08T10:00:00Z" }
  ],
  "performance": { "p50_latency_ms": 120, "p99_latency_ms": 580, "measurement_window": "last_7d" },
  "audit": { "log_uri": "https://audit.kineticgain.com/mcp/billing-lookup", "retention_days": 365 }
}