MCP Operation Risk

Evaluate the operation-level riskCheck ofwhether an intended MCP tool call is safe before execution. ReturnsUsing the source server identity, tool metadata, input schema, and planned arguments, return an operation-level ALLOW, DENY, or REQUIRE_APPROVAL.REQUIRE_APPROVAL decision. For supported consolidated tools, distinguish read, additive, mutating, and destructive operations, including supported create, update, and delete commands. Unknown, unsupported, or schema-changed calls require approval. Use when whole-tool permissions are too coarse; the evaluator never executes the source call.

{"additionalProperties":false,"properties":{"arguments":{"additionalProperties":true,"description":"Arguments intended for the source MCP tools/call request being evaluated. The evaluator does not execute that call.","title":"Arguments","type":"object"},"source":{"additionalProperties":false,"description":"MCP server and negotiated protocol identity for the source tool.","properties":{"protocol_version":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"Negotiated MCP protocol version, or null when unavailable.","title":"Protocol Version"},"server":{"additionalProperties":false,"description":"MCP server identity from the connection's initialize response.","properties":{"name":{"description":"Name reported by the MCP server during initialize; used as a supported-manifest lookup hint.","title":"Name","type":"string"}, ⟨3 unchanged words⟩ string"},{"type":"null"}],"description":"Server version reported during initialize, or null when unavailable.","title":"Version"}},"required":["name ⟨11 unchanged words⟩ object"},"tool":{"additionalProperties":false,"description":"The complete relevant Tool record returned by the source server's tools/list.","properties":{"_meta":{"anyOf":[{" ⟨4 unchanged words⟩ type":"null"}],"default":null,"description":"Relevant tool metadata from tools/list, when present.","title":"Meta"},"annotations":{"additionalProperties":true,"description":"Tool annotations from tools/list, such as read-only or destructive hints; use an empty object when absent.","title":"Annotations","type":"object"}, ⟨3 unchanged words⟩ string"},{"type":"null"}],"description":"Tool description from tools/list, or null if the server omitted it.","title":"Description"},"execution":{"anyOf" ⟨4 unchanged words⟩ type":"null"}],"default":null,"description":"Tool execution metadata from tools/list, when present.","title":"Execution"},"icons":{"anyOf" ⟨7 unchanged words⟩ type":"null"}],"default":null,"description":"Tool icons from tools/list, when present.","title":"Icons"},"inputSchema":{"additionalProperties":true,"description":"Complete inputSchema from tools/list; used to validate the intended arguments and match a supported tool manifest.","title":"Inputschema","type":"object"},"name":{"description":"Exact tool name from the MCP server's tools/list response.","title":"Name","type":"string"}, ⟨6 unchanged words⟩ type":"null"}],"default":null,"description":"Tool output schema from tools/list, when present.","title":"Outputschema"},"title":{"anyOf" ⟨2 unchanged words⟩ {"type":"null"}],"default":null,"description":"Tool title from tools/list, when provided by the server.","title":"Title"}},"required":[ ⟨15 unchanged words⟩