From 08e3d998ca97456802a38f094940550c30036e77 Mon Sep 17 00:00:00 2001 From: Gautam Bharti <3028386+gautamgb@users.noreply.github.com> Date: Thu, 17 Sep 2026 09:48:26 -0700 Subject: [PATCH] datasets: drop affiliation from both entries' contributor object Per the attribution policy ratified in #75: name and orcid only. Two-line change per file, nothing else touched. --- ...clared-effect-flip-stale-autoapproval.json | 262 +++++++++++++++++ ...ut-schema-expansion-context-overshare.json | 273 ++++++++++++++++++ .../index.csv | 2 + 3 files changed, 537 insertions(+) create mode 100644 datasets/agentdataflow_toolexchange_traces/entries/DSGAI-TRACE-mcp-declared-effect-flip-stale-autoapproval.json create mode 100644 datasets/agentdataflow_toolexchange_traces/entries/DSGAI-TRACE-mcp-output-schema-expansion-context-overshare.json diff --git a/datasets/agentdataflow_toolexchange_traces/entries/DSGAI-TRACE-mcp-declared-effect-flip-stale-autoapproval.json b/datasets/agentdataflow_toolexchange_traces/entries/DSGAI-TRACE-mcp-declared-effect-flip-stale-autoapproval.json new file mode 100644 index 0000000..a152546 --- /dev/null +++ b/datasets/agentdataflow_toolexchange_traces/entries/DSGAI-TRACE-mcp-declared-effect-flip-stale-autoapproval.json @@ -0,0 +1,262 @@ +{ + "$schema": "../schema.json", + "trace_id": "DSGAI-TRACE-mcp-declared-effect-flip-stale-autoapproval", + "title": "Tool re-declares itself destructive after an agent has already auto-approved it", + "description": "An agent binds a tool whose contract declares destructiveHint false, and an approval policy uses that declaration to place the tool in an auto-approve class. The server later re-publishes the same tool with destructiveHint true, without changing its declared server version. Because the approval decision was made once at bind time and keyed to the tool name, the next call runs a destructive operation under a classification the tool no longer satisfies, and no human approval is ever requested. The trace captures the full sequence including the contract change itself.", + "category": "tool_call", + "disposition": "unintentional_failure", + + "dsgai_mapping": ["DSGAI06", "DSGAI05", "DSGAI07"], + "owasp_llm_top10_mapping": ["LLM06:2025", "LLM03:2025"], + + "agent": { + "framework": "custom", + "tool_protocol": "mcp", + "topology": "single agent with an orchestrator-side approval policy over remote tools", + "autonomy": "human_approves_flagged_actions" + }, + + "provenance": { + "tier": "derived_from_public_documentation", + "collection_method": "Constructed as a minimal agent session around a condition the Model Context Protocol permits by construction: a tool's annotations can change after a client has bound and classified the tool, and the tool definition carries no version a client could compare. The agent, orchestrator, approval policy, and every payload are synthetic.", + "evidence": [ + { + "type": "url", + "citation": "https://modelcontextprotocol.io/specification/2025-06-18/schema", + "locator": "ToolAnnotations > destructiveHint", + "supports": "destructiveHint is a server-declared, optional boolean: 'If true, the tool may perform destructive updates to its environment. If false, the tool performs only additive updates. Default: true.' It is a property of the tool's own declared annotations, not of any external check, so re-declaring it is entirely within what the server is allowed to do at any time." + }, + { + "type": "url", + "citation": "https://modelcontextprotocol.io/specification/2025-06-18/server/tools", + "locator": "Data Types > Tool, trust and safety warning", + "supports": "The specification conditions trust on the server, not the annotation: 'clients MUST consider tool annotations to be untrusted unless they come from trusted servers.' A server a client has already bound and classified is, by construction, one the client currently trusts - so the warning does not forbid an auto-approve policy keyed to a trusted server's annotations. What it does not address is whether that trust should survive the server changing the annotation later, which is the condition this trace models: the initial classification is not re-evaluated when the value it was based on changes." + }, + { + "type": "url", + "citation": "https://modelcontextprotocol.io/specification/2025-06-18/server/tools", + "locator": "Capabilities; List Changed Notification; Data Types > Tool", + "supports": "A tool definition is name, title, description, inputSchema, outputSchema and annotations, with no version field, and it may change during a session. The only change signal is notifications/tools/list_changed, which servers that declared the listChanged capability SHOULD send, so a client holding a binding made at an earlier tools/list has neither a guaranteed notification nor a version to compare." + }, + { + "type": "cve", + "citation": "CVE-2025-54136", + "locator": "NVD description; advisory GHSA-24mc-g4xr-4395", + "supports": "The same failure shape reached shipped software one layer down: an MCP entry a collaborator had already accepted could be swapped for a different command 'without triggering any warning or re-prompt' (Cursor 1.2.4 and below, fixed in 1.3). The CVE concerns the server command in an approved configuration rather than a tool annotation, so what it establishes is narrower than this trace: a once-granted approval outliving a change to what was approved is observed client behaviour, not only a protocol possibility." + } + ] + }, + + "sanitization": { + "attestation": true, + "techniques": ["not_applicable_fully_synthetic", "name_generalization", "shape_only_payloads"], + "notes": "No real server, tool, operator, or tenant is named. The trace is fully synthetic and uses a generic server identity on purpose: attributing a failure mechanism to a named third party is a disclosure act rather than a dataset contribution. The only vendor named in this entry is the one in the cited CVE, which is already public." + }, + + "spans": [ + { + "span_id": "s1", + "parent_span_id": null, + "t_offset_ms": 0, + "actor": "orchestrator", + "actor_id": "orchestrator://session-1", + "operation": "tool.discover", + "summary": "Client lists tools from a remote server and reads the declared effect annotations.", + "payload": { + "server": "tool://server-a", + "tool": "remove_from_roster", + "declared_server_version": "", + "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": false }, + "input_schema_digest": "" + }, + "data_classes": ["tool_schema"], + "sensitivity": "none" + }, + { + "span_id": "s2", + "parent_span_id": "s1", + "t_offset_ms": 40, + "actor": "policy_engine", + "actor_id": "policy://approval", + "operation": "policy.decision", + "summary": "Approval policy reads destructiveHint false and places the tool in the auto-approve class. The decision is cached against the tool name.", + "payload": { + "rule": "write tools may auto-approve when annotations.destructiveHint is not true", + "decision": "auto_approve", + "decision_key": "server-a/remove_from_roster", + "cache_ttl": "session", + "revalidate_on_contract_change": false + }, + "data_classes": ["tool_schema"], + "sensitivity": "none", + "finding": { + "dsgai_id": "DSGAI07", + "note": "The authorization decision is derived from a mutable, self-declared attribute of the counterparty and is then cached with no binding to the contract it was derived from. Nothing in the record ties the decision to the specific contract that justified it.", + "severity": "Medium" + } + }, + { + "span_id": "s3", + "parent_span_id": "s2", + "t_offset_ms": 900, + "actor": "agent", + "actor_id": "agent://roster-assistant", + "operation": "tool.call", + "summary": "First call. Runs without a human approval prompt, correctly, under the contract as declared at bind time.", + "payload": { + "tool": "server-a/remove_from_roster", + "arguments": { "roster_id": "", "member_id": "", "dry_run": true } + }, + "data_classes": ["tool_schema"], + "sensitivity": "low" + }, + { + "span_id": "s4", + "parent_span_id": "s3", + "t_offset_ms": 1480, + "actor": "tool", + "actor_id": "tool://server-a/remove_from_roster", + "operation": "tool.result", + "summary": "Tool returns a preview of the change. No data is removed.", + "payload": { "status": "ok", "would_remove": 1, "removed": 0 }, + "data_classes": ["tool_output"], + "sensitivity": "low" + }, + { + "span_id": "s5", + "parent_span_id": null, + "t_offset_ms": 86400000, + "actor": "external_service", + "actor_id": "tool://server-a", + "operation": "contract.change", + "summary": "Server re-publishes the same tool with destructiveHint true. The declared server version is unchanged, so nothing downstream of a version check observes the change.", + "payload": { + "tool": "server-a/remove_from_roster", + "path": "annotations.destructiveHint", + "change_kind": "annotation-flip-to-destructive", + "before": false, + "after": true, + "declared_server_version_before": "", + "declared_server_version_after": "", + "version_delta": "same" + }, + "data_classes": ["tool_schema"], + "sensitivity": "none", + "finding": { + "dsgai_id": "DSGAI05", + "note": "The counterparty's declared effect changed while every integrity signal available to the client - declared version, tool name, endpoint - held steady. A client that validates on version alone cannot detect this transition.", + "severity": "High" + } + }, + { + "span_id": "s6", + "parent_span_id": null, + "t_offset_ms": 90000000, + "actor": "orchestrator", + "actor_id": "orchestrator://session-2", + "operation": "tool.bind", + "summary": "A later session resumes from the cached binding. No re-discovery is performed, so the new contract is never fetched.", + "payload": { + "bound_from": "cache", + "decision_key": "server-a/remove_from_roster", + "contract_refetched": false + }, + "data_classes": ["tool_schema"], + "sensitivity": "none", + "finding": { + "dsgai_id": "DSGAI06", + "note": "The binding is keyed by tool name, so it survives a change to everything the name refers to. This is the step that converts a supplier-side change into a client-side authorization failure.", + "severity": "High" + } + }, + { + "span_id": "s7", + "parent_span_id": "s6", + "t_offset_ms": 90000600, + "actor": "agent", + "actor_id": "agent://roster-assistant", + "operation": "tool.call", + "summary": "Second call, this time for real. The tool now declares itself destructive; the agent does not know that.", + "payload": { + "tool": "server-a/remove_from_roster", + "arguments": { "roster_id": "", "member_id": "", "dry_run": false } + }, + "data_classes": ["tool_schema"], + "sensitivity": "moderate" + }, + { + "span_id": "s8", + "parent_span_id": "s7", + "t_offset_ms": 90000610, + "actor": "policy_engine", + "actor_id": "policy://approval", + "operation": "policy.decision", + "summary": "Policy hits the cached auto-approve decision from s2. No approval request is emitted to the human approver.", + "payload": { + "decision": "auto_approve", + "decision_source": "cache", + "decision_derived_from_contract": "s1", + "contract_in_effect": "s5", + "approval_requested": false + }, + "data_classes": ["tool_schema"], + "sensitivity": "high", + "finding": { + "dsgai_id": "DSGAI06", + "note": "The auto-approve class was earned by a contract that is no longer in force. The gap between decision_derived_from_contract and contract_in_effect is the whole defect, and it is invisible to every party at runtime.", + "severity": "High" + } + }, + { + "span_id": "s9", + "parent_span_id": "s7", + "t_offset_ms": 90001250, + "actor": "tool", + "actor_id": "tool://server-a/remove_from_roster", + "operation": "tool.result", + "summary": "Destructive operation executes. Records are removed with no human in the loop.", + "payload": { "status": "ok", "removed": 1, "reversible": false }, + "data_classes": ["tool_output"], + "sensitivity": "high" + }, + { + "span_id": "s10", + "parent_span_id": "s9", + "t_offset_ms": 90001300, + "actor": "orchestrator", + "actor_id": "orchestrator://session-2", + "operation": "context.append", + "summary": "Result is appended to the model context and summarized back to the user as a completed action.", + "payload": { "appended_bytes": "", "presented_as": "completed action" }, + "data_classes": ["tool_output"], + "sensitivity": "low" + } + ], + + "security_observations": [ + "An approval decision derived from a self-declared, mutable attribute of a third party inherits that attribute's mutability, but caching hides the inheritance.", + "A declared version is not an integrity signal for a tool contract. The protocol puts no version on a tool definition at all, so a client has nothing to compare, and the one change signal it defines is a SHOULD from servers that opted into announcing it.", + "Name-keyed tool bindings are the failure amplifier: they let a supplier-side change silently inherit a client-side authorization grant.", + "The failure is fully invisible in the trace as most systems record it. Without the contract.change span at s5, spans s6 through s9 look like a correct, policy-compliant run.", + "No adversary is required. This flow is what ordinary supplier maintenance does to a client that trusts declared effects." + ], + + "mitigations": [ + "Bind approval decisions to a contract digest, not a tool name. Re-derive the decision whenever the digest changes.", + "Re-fetch and re-diff tool contracts at session start rather than restoring a cached binding, and treat any change to declared effect annotations as an approval-invalidating event.", + "Escalate to human approval on the transition itself, independent of the destination state: a tool that becomes destructive is a stronger signal than one that always was.", + "Do not treat a declared server version as evidence that a contract is unchanged; compare the contract.", + "Record, in the action log, which contract version justified each authorization decision, so the gap at s8 is auditable after the fact." + ], + + "contributor": { + "name": "Bharti, Gautam", + "orcid": "0009-0001-4448-1438" + }, + + "date_added": "2026-08-07", + + "tags": ["mcp", "tool-contract-drift", "declared-effect", "approval-bypass", "excessive-agency", "supply-chain"], + + "notes": "MITRE ATLAS mapping is deliberately omitted. Repository issues #59 and #60 show ATLAS identifiers and their names have both moved across releases, and asserting an unverified pair here would add to that debt. The schema supports a release-pinned mapping; this entry should gain one once the repository settles on a pinned release. This entry also does not claim intent on the part of any tool supplier: a contract diff is an observation about declared effect, not a safety verdict." +} diff --git a/datasets/agentdataflow_toolexchange_traces/entries/DSGAI-TRACE-mcp-output-schema-expansion-context-overshare.json b/datasets/agentdataflow_toolexchange_traces/entries/DSGAI-TRACE-mcp-output-schema-expansion-context-overshare.json new file mode 100644 index 0000000..8ab4598 --- /dev/null +++ b/datasets/agentdataflow_toolexchange_traces/entries/DSGAI-TRACE-mcp-output-schema-expansion-context-overshare.json @@ -0,0 +1,273 @@ +{ + "$schema": "../schema.json", + "trace_id": "DSGAI-TRACE-mcp-output-schema-expansion-context-overshare", + "title": "Tool output schema widens under a stable version, and the extra fields flow straight into model context", + "description": "An agent calls a lookup tool whose declared output schema returns a narrow projection of a record. The orchestrator appends whole tool results to the model context without projecting them against the schema it bound to. The server later widens the output schema to return the full record, without changing its declared version. The next identical call pulls contact, note, and billing fields into the context window, into the model's answer, and into the observability sink, with no change on the agent side and no error anywhere.", + "category": "context_accumulation", + "disposition": "unintentional_failure", + + "dsgai_mapping": ["DSGAI15", "DSGAI01", "DSGAI14", "DSGAI05"], + "owasp_llm_top10_mapping": ["LLM02:2025", "LLM05:2025"], + + "agent": { + "framework": "custom", + "tool_protocol": "mcp", + "topology": "single agent with schema-agnostic tool-result passthrough into context", + "autonomy": "fully_autonomous" + }, + + "provenance": { + "tier": "derived_from_public_documentation", + "collection_method": "Constructed as a minimal agent session around a change the Model Context Protocol permits without giving the client a signal it can rely on: a tool's declared output schema widening between two calls under a stable server identity. The agent, the record contents and the downstream sinks are synthetic.", + "evidence": [ + { + "type": "url", + "citation": "https://modelcontextprotocol.io/specification/2025-06-18/server/tools", + "locator": "Data Types > Tool Result > Output Schema", + "supports": "outputSchema, where a server declares one, is the client's statement of what a tool returns, and both obligations attach to the current schema: 'Servers MUST provide structured results that conform to this schema' and 'Clients SHOULD validate structured results against this schema'. A client validating against the schema the server publishes now cannot detect that the schema is wider than the one the agent bound to." + }, + { + "type": "url", + "citation": "https://modelcontextprotocol.io/specification/2025-06-18/server/tools", + "locator": "Capabilities; List Changed Notification; Data Types > Tool", + "supports": "outputSchema sits inside a tool definition that carries no version field and may change during a session, announced only by notifications/tools/list_changed, which servers that declared the listChanged capability SHOULD send. A version comparison is not an available trigger for re-inspecting an output schema." + } + ] + }, + + "sanitization": { + "attestation": true, + "techniques": ["not_applicable_fully_synthetic", "shape_only_payloads", "name_generalization"], + "notes": "Record contents are represented as typed placeholders rather than values, which is also the point being made: a trace of this class is publishable precisely because the payload shape, not the payload, carries the finding." + }, + + "spans": [ + { + "span_id": "s1", + "parent_span_id": null, + "t_offset_ms": 0, + "actor": "orchestrator", + "actor_id": "orchestrator://support-flow", + "operation": "tool.discover", + "summary": "Agent binds a lookup tool. The declared output schema returns three fields.", + "payload": { + "tool": "server-b/lookup_record", + "declared_server_version": "", + "output_schema_fields": ["record_id", "status", "updated_at"], + "output_schema_digest": "" + }, + "data_classes": ["tool_schema"], + "sensitivity": "none" + }, + { + "span_id": "s2", + "parent_span_id": "s1", + "t_offset_ms": 620, + "actor": "agent", + "actor_id": "agent://support-assistant", + "operation": "tool.call", + "summary": "Agent looks up a record on behalf of a tier-1 support user.", + "payload": { + "tool": "server-b/lookup_record", + "arguments": { "record_id": "" }, + "caller_entitlements": ["record.status.read"] + }, + "data_classes": ["user_prompt"], + "sensitivity": "low" + }, + { + "span_id": "s3", + "parent_span_id": "s2", + "t_offset_ms": 1140, + "actor": "tool", + "actor_id": "tool://server-b/lookup_record", + "operation": "tool.result", + "summary": "Tool returns the narrow projection the agent bound to.", + "payload": { + "record_id": "", + "status": "open", + "updated_at": "" + }, + "data_classes": ["tool_output"], + "sensitivity": "low" + }, + { + "span_id": "s4", + "parent_span_id": "s3", + "t_offset_ms": 1160, + "actor": "orchestrator", + "actor_id": "orchestrator://support-flow", + "operation": "context.append", + "summary": "Whole tool result is appended to context. No projection is applied against the bound schema; the result happens to be safe because the tool happens to be narrow.", + "payload": { + "projection_applied": false, + "fields_appended": 3, + "allowlist_configured": false + }, + "data_classes": ["tool_output"], + "sensitivity": "low", + "finding": { + "dsgai_id": "DSGAI15", + "note": "The control that keeps this flow safe is the supplier's schema, not the client's policy. That is a control the client does not own and cannot see change.", + "severity": "Medium" + } + }, + { + "span_id": "s5", + "parent_span_id": null, + "t_offset_ms": 172800000, + "actor": "external_service", + "actor_id": "tool://server-b", + "operation": "contract.change", + "summary": "Server widens the output schema from a projection to the full record. Declared server version is unchanged.", + "payload": { + "tool": "server-b/lookup_record", + "path": "outputSchema", + "change_kind": "output-schema-changed", + "fields_before": ["record_id", "status", "updated_at"], + "fields_after": ["record_id", "status", "updated_at", "contact_email", "internal_notes", "billing_account_ref"], + "declared_server_version_before": "", + "declared_server_version_after": "", + "version_delta": "same" + }, + "data_classes": ["tool_schema"], + "sensitivity": "none", + "finding": { + "dsgai_id": "DSGAI05", + "note": "A widening output schema is a data-classification change disguised as a compatibility-preserving one. Nothing breaks, so nothing alerts.", + "severity": "High" + } + }, + { + "span_id": "s6", + "parent_span_id": null, + "t_offset_ms": 176400000, + "actor": "agent", + "actor_id": "agent://support-assistant", + "operation": "tool.call", + "summary": "Byte-identical call to s2. Same tier-1 caller, same entitlements, same arguments.", + "payload": { + "tool": "server-b/lookup_record", + "arguments": { "record_id": "" }, + "caller_entitlements": ["record.status.read"] + }, + "data_classes": ["user_prompt"], + "sensitivity": "low" + }, + { + "span_id": "s7", + "parent_span_id": "s6", + "t_offset_ms": 176400910, + "actor": "tool", + "actor_id": "tool://server-b/lookup_record", + "operation": "tool.result", + "summary": "Tool returns the full record. Three of the six fields are data the caller has no entitlement to.", + "payload": { + "record_id": "", + "status": "open", + "updated_at": "", + "contact_email": "", + "internal_notes": "", + "billing_account_ref": "" + }, + "data_classes": ["tool_output", "pii", "proprietary", "financial"], + "sensitivity": "high", + "finding": { + "dsgai_id": "DSGAI01", + "note": "Entitlement was enforced at the caller, once, against a schema that has since changed. The tool now returns more than the caller is authorized to receive, and the authorization layer never re-runs.", + "severity": "High" + } + }, + { + "span_id": "s8", + "parent_span_id": "s7", + "t_offset_ms": 176400930, + "actor": "orchestrator", + "actor_id": "orchestrator://support-flow", + "operation": "context.append", + "summary": "Same schema-agnostic append as s4. Six fields now enter the context window instead of three.", + "payload": { + "projection_applied": false, + "fields_appended": 6, + "unexpected_fields": ["contact_email", "internal_notes", "billing_account_ref"], + "unexpected_field_alert": false + }, + "data_classes": ["tool_output", "pii", "proprietary", "financial"], + "sensitivity": "high", + "finding": { + "dsgai_id": "DSGAI15", + "note": "The over-share happens here, in code that did not change, on a path that has no idea anything changed. A schema-agnostic passthrough turns a supplier's schema change into a context-window authorization failure.", + "severity": "High" + } + }, + { + "span_id": "s9", + "parent_span_id": "s7", + "t_offset_ms": 176400935, + "actor": "external_service", + "actor_id": "observability://trace-sink", + "operation": "egress", + "summary": "The same tool result is mirrored to the tracing backend as a span attribute, outside the AI security boundary.", + "payload": { + "sink": "third-party tracing backend", + "captured": "full tool result", + "retention_days": "", + "redaction_rules_cover_new_fields": false + }, + "data_classes": ["telemetry", "pii", "financial"], + "sensitivity": "high", + "finding": { + "dsgai_id": "DSGAI14", + "note": "Redaction rules in the observability pipeline were written against the fields that existed when the tool was integrated. New fields arrive unredacted by default, and persist for the retention window.", + "severity": "High" + } + }, + { + "span_id": "s10", + "parent_span_id": "s8", + "t_offset_ms": 176403200, + "actor": "model", + "actor_id": "model://assistant", + "operation": "model.completion", + "summary": "Model answers the tier-1 user's question and, being helpful, includes the contact address it now has in context.", + "payload": { + "answer_includes_fields": ["status", "updated_at", "contact_email"], + "user_entitled_to": ["status", "updated_at"] + }, + "data_classes": ["pii"], + "sensitivity": "high", + "finding": { + "dsgai_id": "DSGAI01", + "note": "Disclosure completes here. The model is behaving correctly with respect to its context; the context is what is wrong.", + "severity": "High" + } + } + ], + + "security_observations": [ + "Where a tool result is appended to context without projection, the supplier's output schema is the de facto data-classification boundary for the agent.", + "Output-schema widening raises no error on either side of the call: the server still conforms to the schema it now publishes, and a client validating against that same schema passes. The only defined change signal, notifications/tools/list_changed, is a SHOULD a server can decline to send, so a widened schema can reach the client with nothing that forces it to look again.", + "A server version exists - it is returned in serverInfo at session start - but nothing binds it to any one tool's contract, so a client comparing that version across sessions learns nothing about whether a given tool's output schema changed.", + "One tool-result object reaches three sinks with different trust boundaries - model context, the user-facing answer, and the observability backend - and the redaction posture of each was set against a schema that no longer holds.", + "The client-side diff between the safe run and the unsafe run is zero lines of code and zero configuration changes." + ], + + "mitigations": [ + "Project tool results against an explicit client-side field allowlist before appending to context. Treat fields outside the allowlist as an alertable event, not as data to pass through.", + "Pin the bound output-schema digest and re-diff on each session; fail closed or re-approve when the digest moves.", + "Classify entitlements per field rather than per tool, so a widened result cannot inherit a narrower call's authorization.", + "Make observability redaction default-deny for tool-result attributes: allowlist the fields that may be captured rather than denylisting the ones that may not.", + "Alert on the arrival of previously unseen fields in a tool result, which is cheap, needs no schema fetch, and catches this class at s7." + ], + + "contributor": { + "name": "Bharti, Gautam", + "orcid": "0009-0001-4448-1438" + }, + + "date_added": "2026-08-07", + + "tags": ["mcp", "tool-contract-drift", "output-schema", "context-window", "over-sharing", "telemetry-leakage"], + + "notes": "MITRE ATLAS mapping deliberately omitted pending a pinned ATLAS release in this repository; see issues #59 and #60. The trace asserts a mechanism and no prevalence claim: what is established here is that the protocol permits an output schema to widen without a reliable signal to the client, not how often that happens, and not that any specific agent handled it badly." +} diff --git a/datasets/agentdataflow_toolexchange_traces/index.csv b/datasets/agentdataflow_toolexchange_traces/index.csv index 60191bb..fc43ac8 100644 --- a/datasets/agentdataflow_toolexchange_traces/index.csv +++ b/datasets/agentdataflow_toolexchange_traces/index.csv @@ -1,2 +1,4 @@ trace_id,title,category,disposition,provenance_tier,primary_dsgai,dsgai_mapping,owasp_llm_top10_mapping,agent_framework,tool_protocol,span_count,finding_count,max_sensitivity,data_classes,evidence_count,primary_evidence,date_added,tags +DSGAI-TRACE-mcp-declared-effect-flip-stale-autoapproval,Tool re-declares itself destructive after an agent has already auto-approved it,tool_call,unintentional_failure,derived_from_public_documentation,DSGAI06,DSGAI06|DSGAI05|DSGAI07,LLM06:2025|LLM03:2025,custom,mcp,10,4,high,tool_output|tool_schema,4,https://modelcontextprotocol.io/specification/2025-06-18/schema,2026-08-07,mcp|tool-contract-drift|declared-effect|approval-bypass|excessive-agency|supply-chain +DSGAI-TRACE-mcp-output-schema-expansion-context-overshare,"Tool output schema widens under a stable version, and the extra fields flow straight into model context",context_accumulation,unintentional_failure,derived_from_public_documentation,DSGAI15,DSGAI15|DSGAI01|DSGAI14|DSGAI05,LLM02:2025|LLM05:2025,custom,mcp,10,6,high,financial|pii|proprietary|telemetry|tool_output|tool_schema|user_prompt,2,https://modelcontextprotocol.io/specification/2025-06-18/server/tools,2026-08-07,mcp|tool-contract-drift|output-schema|context-window|over-sharing|telemetry-leakage DSGAI-TRACE-overbroad-search-context-egress-self-report-gap,Over-broad search scope leaks an HR document through a full-context email the agent's own record does not mention,tool_call,unintentional_failure,hypothetical,DSGAI06,DSGAI06|DSGAI15,,custom,,7,2,high,file_path|financial|pii|retrieved_document|telemetry|token|tool_output|user_prompt,0,,2026-09-15,workspace-search|email-egress|context-oversharing|observability-gap|self-report-divergence