{ "schema": "varexis-index-delivery/1", "catalog_version": "2026-10-14T20:21:57.226Z", "route_id": "agentic_pack_tool_admission_v1", "question": "Check declared tool permissions, authority and changes before integration?", "answer": "Compare exact actions, resources and recipients across GitHub, Playwright, Notion and Slack declarations; identify authority conflicts, changes and missing verification. A local validation pass describes supplied declarations only; it does not inspect effective permissions, verify records exist, enforce policy, certify compliance or approve deployment. Complete source evidence, schemas and two worked scenarios remain free.", "records": [ { "record_id": "VXI-EXT-TOOL-TRUST-GITHUB-01-v1", "url": "/varexis-index/records/github-mcp-repository-access-trust.json", "content_sha256": "572335e5f6d8f99afe3760a11daf78adbf89833501909166782351350be027f8", "evidence": { "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-11T21:09:20.344Z", "record_id": "VXI-EXT-TOOL-TRUST-GITHUB-01-v1", "record_kind": "external_reference", "title": "GitHub MCP: Repository access and write controls", "system": "GitHub MCP", "evidence_family": "agent_tool_trust_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "How can an agent review repository access without enabling GitHub MCP writes?", "near_questions": [ "How can I review repository access without enabling writes?", "Can GitHub MCP be restricted to reading pull requests?", "Does a GitHub MCP toolset reduce token permissions?", "What does GitHub MCP lockdown leave unproven?", "Which repositories can this code review connector read?", "Can an issue contain instructions an agent should ignore?", "Does read-only repository access prevent data leaving the client?", "What authentication does the official GitHub MCP use?", "Is the local GitHub MCP operated by GitHub?", "What should be checked before enabling repository write tools?", "What should a saved GitHub connector review contain?", "Does this GitHub trust record test my configuration?" ], "supported_claims": [ { "claim": "GitHub documents a read-only server mode that removes write tools and a separate choice of toolsets. Review both the credential's repository access and the configured server mode. Lockdown is a content filter with stated limitations. This profile helps scope a repository-review connection; it does not verify your token, server configuration or resistance to prompt injection.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent tool execution or security testing", "Vendor certification, guaranteed safety or no-training assurance" ], "public_summary": "GitHub documents a read-only server mode that removes write tools and a separate choice of toolsets. Review both the credential's repository access and the configured server mode. Lockdown is a content filter with stated limitations. This profile helps scope a repository-review connection; it does not verify your token, server configuration or resistance to prompt injection.", "related_record_ids": [ "VXI-EXT-TOOL-TRUST-GITLAB-01-v1", "VXI-EXT-TOOL-TRUST-PLAYWRIGHT-01-v1" ], "source_review": { "source_type": "official_external_documentation", "source_title": "GitHub MCP server: hosting and authentication", "source_url": "https://github.com/github/github-mcp-server", "checked_on": "2026-10-11", "candidate_record_id": "VXI-EXT-TOOL-TRUST-GITHUB-01-v1", "candidate_record_sha256": "5f2e8ea373885332f961a342962445ce6ef7fef62e46adb367c1ccabf3dca50a", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "GitHub documents a read-only server mode that removes write tools and a separate choice of toolsets. Review both the credential's repository access and the configured server mode. Lockdown is a content filter with stated limitations. This profile helps scope a repository-review connection; it does not verify your token, server configuration or resistance to prompt injection.", "required_buyer_context": "GitHub-hosted remote MCP and the documented local server configuration; deployment, release and organization policies must be supplied by the buyer. Actual token grants, effective tool list, enterprise hosting configuration and client retention/training terms.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "trust_profile": { "schema": "varexis-agent-tool-trust/1", "identity": { "tool": "GitHub MCP", "variant": "GitHub-hosted remote MCP and the documented local server configuration; deployment, release and organization policies must be supplied by the buyer." }, "review_status": "documentation_review_only", "checked_on": "2026-10-11", "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.", "plan_scope": "Buyer plan, feature entitlement and effective configuration are not verified.", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "GitHub publishes the server and hosts the remote service; a local deployment has its own operator.", "source_ids": [ "github-main", "github-config" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "Review repository content, issues and pull requests.", "source_ids": [ "github-main", "github-config" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "Repository files, issues and pull requests accessible through the selected tools and credential.", "source_ids": [ "github-main", "github-config" ] }, { "field": "writes", "label": "Write capability", "status": "documented", "statement": "Write-capable toolsets exist; documented read-only mode excludes their write tools.", "source_ids": [ "github-main", "github-config" ] }, { "field": "auth", "label": "Authentication", "status": "documented", "statement": "Remote OAuth or PAT authentication is documented; actual repository grants and organization policy require inspection.", "source_ids": [ "github-main", "github-config" ] }, { "field": "permissions", "label": "Permission surface", "status": "documented", "statement": "Toolset selection, exclusions and read-only mode are configurable. Lockdown does not reduce the underlying credential's authority.", "source_ids": [ "github-main", "github-config" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "review_inference", "statement": "Repository results return to the connected client. If that client uses a hosted model, selected content may leave the repository service; inspect that client's data policy.", "source_ids": [ "github-main", "github-config" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "Overbroad credentials; assuming lockdown prevents all hostile content; enabling a write tool during a review-only task.", "source_ids": [ "github-main", "github-config" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "Actual token grants, effective tool list, enterprise hosting configuration and client retention/training terms.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "For a review-only task, stop before writes; resolve unknown repository grants before reading private repositories.", "source_ids": [] } ], "evidence_sources": [ { "source_id": "github-main", "url": "https://github.com/github/github-mcp-server", "final_url": "https://github.com/github/github-mcp-server", "title": "GitHub MCP server: hosting and authentication", "checked_on": "2026-10-11", "sha256": "34700e0a6091c606a24b73a2ea5e8de5152f0523884f10a74d62f1fb63d4680b", "bytes": 834307 }, { "source_id": "github-config", "url": "https://github.com/github/github-mcp-server/blob/main/docs/server-configuration.md", "final_url": "https://github.com/github/github-mcp-server/blob/main/docs/server-configuration.md", "title": "GitHub MCP server configuration", "checked_on": "2026-10-11", "sha256": "ffc582722b19340b75f3fefa625360f2cbb5e7e0753779ddb1da819e005b85c2", "bytes": 369942 }, { "source_id": "mcp-hints", "url": "https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/", "final_url": "https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/", "title": "MCP tool annotations and enforcement boundaries", "checked_on": "2026-10-11", "sha256": "82888044d831c3bd18f03d87a846ce5d27e028bd67a095edc04ba377fc622163", "bytes": 52715 } ], "observed_tool_execution": false, "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.", "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.", "paid_value": { "decision_context": "Retain the documented read-only and credential boundaries used when reviewing a repository connector.", "free": "Complete profile, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.", "specific_watch": "Review the effective tool inventory and client data policy before a new integration decision." }, "change_history": [ { "version": 1, "date": "2026-10-11", "change": "Initial documentation review; no earlier vendor assessment claimed." } ] }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#github-mcp-repository-access-trust", "machine_readable_record": "/varexis-index/records/github-mcp-repository-access-trust.json" } }, { "record_id": "VXI-EXT-TOOL-TRUST-PLAYWRIGHT-01-v1", "url": "/varexis-index/records/playwright-mcp-browser-session-trust.json", "content_sha256": "31bcff69fce09710d75d7f21be3bd97d7e5e3b4f9f3a44d8903e1e3b4b549c72", "evidence": { "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-11T21:09:20.344Z", "record_id": "VXI-EXT-TOOL-TRUST-PLAYWRIGHT-01-v1", "record_kind": "external_reference", "title": "Playwright MCP: Browser identity and session boundaries", "system": "Playwright MCP", "evidence_family": "agent_tool_trust_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "Does an isolated Playwright MCP browser session prevent privileged web actions or data disclosure?", "near_questions": [ "Does browser session isolation prevent privileged website actions?", "Can a browser automation tool use an existing logged-in session?", "Do Playwright MCP origin filters cover redirects?", "Is an isolated browser automatically read-only?", "What authority does a browser MCP inherit from cookies?", "Can saved browser state let someone impersonate an account?", "Does running a browser locally keep model processing local?", "Who operates a local Playwright MCP process?", "What should an agent check before submitting a web form?", "Does this browser trust profile certify network isolation?", "What does a saved Playwright trust record contain?", "Which browser state needs review before automation?" ], "supported_claims": [ { "claim": "Playwright MCP documents persistent, isolated and existing-browser session modes. Isolation concerns session state; it does not make authenticated web actions read-only. Its origin filters explicitly exclude redirects from their protection, and the project states that MCP itself is not a security boundary. Review browser identity, destinations and task authorization separately.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent tool execution or security testing", "Vendor certification, guaranteed safety or no-training assurance" ], "public_summary": "Playwright MCP documents persistent, isolated and existing-browser session modes. Isolation concerns session state; it does not make authenticated web actions read-only. Its origin filters explicitly exclude redirects from their protection, and the project states that MCP itself is not a security boundary. Review browser identity, destinations and task authorization separately.", "related_record_ids": [ "VXI-EXT-TOOL-TRUST-GITHUB-01-v1", "VXI-EXT-TOOL-TRUST-GITLAB-01-v1" ], "source_review": { "source_type": "official_external_documentation", "source_title": "Playwright MCP profiles and security boundary", "source_url": "https://github.com/microsoft/playwright-mcp", "checked_on": "2026-10-11", "candidate_record_id": "VXI-EXT-TOOL-TRUST-PLAYWRIGHT-01-v1", "candidate_record_sha256": "fd811e405ea48aad0bfe8613631ffe904f1fb3ad18ae0b2993cf95ce8faacf44", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "Playwright MCP documents persistent, isolated and existing-browser session modes. Isolation concerns session state; it does not make authenticated web actions read-only. Its origin filters explicitly exclude redirects from their protection, and the project states that MCP itself is not a security boundary. Review browser identity, destinations and task authorization separately.", "required_buyer_context": "Microsoft's Playwright MCP in a local/operator-run browser setup; installed package version, launch settings and browser state were not inspected. Installed release, loaded cookies, browser permissions, network enforcement and client data handling.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "trust_profile": { "schema": "varexis-agent-tool-trust/1", "identity": { "tool": "Playwright MCP", "variant": "Microsoft's Playwright MCP in a local/operator-run browser setup; installed package version, launch settings and browser state were not inspected." }, "review_status": "documentation_review_only", "checked_on": "2026-10-11", "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.", "plan_scope": "Buyer plan, feature entitlement and effective configuration are not verified.", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "Microsoft publishes Playwright MCP; the organization running the process operates the browser connection.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "Inspect and interact with web pages through browser automation.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "Page content and browser-visible information under the active session.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "writes", "label": "Write capability", "status": "documented", "statement": "Browser interactions can submit forms and change remote state using the session's authority.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "auth", "label": "Authentication", "status": "documented", "statement": "Websites use the browser's authentication state; isolated mode can load saved state. No hosted vendor OAuth login is assumed for local stdio.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "permissions", "label": "Permission surface", "status": "documented", "statement": "Origin filters are documented as incomplete boundaries. Browser identity and surrounding runtime/network controls require separate review.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "review_inference", "statement": "The browser contacts websites and returns content to the MCP client; a local browser process does not establish local-only model processing.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "Reusing a privileged browser session; treating isolation as read-only authority; sharing a saved state file that enables impersonation.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "Installed release, loaded cookies, browser permissions, network enforcement and client data handling.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "Use an authorized session and destination set; stop before form submissions outside the task and keep saved auth state out of evidence exports.", "source_ids": [] } ], "evidence_sources": [ { "source_id": "playwright-main", "url": "https://github.com/microsoft/playwright-mcp", "final_url": "https://github.com/microsoft/playwright-mcp", "title": "Playwright MCP profiles and security boundary", "checked_on": "2026-10-11", "sha256": "2fbbc3dcbb59f2924e1ee433d40a49ecab2d34cc3c5287a716b7f240be4b9d0e", "bytes": 636267 }, { "source_id": "playwright-auth", "url": "https://playwright.dev/docs/auth", "final_url": "https://playwright.dev/docs/auth", "title": "Playwright authentication state", "checked_on": "2026-10-11", "sha256": "4e739589b0cf3fda2b65536a8cb3455f00342dc0765ad2cba38adcfe31592918", "bytes": 232035 }, { "source_id": "mcp-hints", "url": "https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/", "final_url": "https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/", "title": "MCP tool annotations and enforcement boundaries", "checked_on": "2026-10-11", "sha256": "82888044d831c3bd18f03d87a846ce5d27e028bd67a095edc04ba377fc622163", "bytes": 52715 } ], "observed_tool_execution": false, "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.", "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.", "paid_value": { "decision_context": "Save browser-state and destination limitations considered when choosing an automation tool.", "free": "Complete profile, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.", "specific_watch": "Review the effective tool inventory and client data policy before a new integration decision." }, "change_history": [ { "version": 1, "date": "2026-10-11", "change": "Initial documentation review; no earlier vendor assessment claimed." } ] }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#playwright-mcp-browser-session-trust", "machine_readable_record": "/varexis-index/records/playwright-mcp-browser-session-trust.json" } }, { "record_id": "VXI-EXT-TOOL-TRUST-NOTION-01-v1", "url": "/varexis-index/records/notion-mcp-content-sharing-trust.json", "content_sha256": "b465e42e280f6667dbb8ee8a67764b505783dd2d93945eab3ea42b38af7e9659", "evidence": { "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-11T21:09:20.344Z", "record_id": "VXI-EXT-TOOL-TRUST-NOTION-01-v1", "record_kind": "external_reference", "title": "Notion MCP: Content access and external sharing", "system": "Notion MCP", "evidence_family": "agent_tool_trust_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "Can an agent assume Notion content stays inside Notion when using its MCP connector?", "near_questions": [ "Does a workspace connector keep documents inside the workspace?", "Can Notion MCP send page content to another system?", "What can the official Notion MCP update?", "Does Notion OAuth establish a no-training guarantee?", "Which Notion user's access does an MCP connection use?", "Can a Notion page inject instructions into an agent?", "Who can revoke a Notion MCP connection?", "Does a trusted connector make every client trustworthy?", "What is missing before sharing private Notion documents?", "Can the Notion connector create databases?", "What should a saved Notion tool review record?", "Does this Notion profile verify our client policy?" ], "supported_claims": [ { "claim": "Notion documents a hosted OAuth connector that can read and update accessible content. Its security guidance explicitly warns that connected clients may send returned content outside Notion. Check the client and model data policy as well as workspace access. The connector's publisher and valid login do not establish a no-egress or no-training guarantee.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent tool execution or security testing", "Vendor certification, guaranteed safety or no-training assurance" ], "public_summary": "Notion documents a hosted OAuth connector that can read and update accessible content. Its security guidance explicitly warns that connected clients may send returned content outside Notion. Check the client and model data policy as well as workspace access. The connector's publisher and valid login do not establish a no-egress or no-training guarantee.", "related_record_ids": [ "VXI-EXT-TOOL-TRUST-ATLASSIAN-01-v1", "VXI-EXT-TOOL-TRUST-LINEAR-01-v1" ], "source_review": { "source_type": "official_external_documentation", "source_title": "Notion MCP overview", "source_url": "https://developers.notion.com/guides/mcp/overview", "checked_on": "2026-10-11", "candidate_record_id": "VXI-EXT-TOOL-TRUST-NOTION-01-v1", "candidate_record_sha256": "4992d82877792199be2573a322c44703d17abb01cc9db5b9f9f82e856fec4acc", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "Notion documents a hosted OAuth connector that can read and update accessible content. Its security guidance explicitly warns that connected clients may send returned content outside Notion. Check the client and model data policy as well as workspace access. The connector's publisher and valid login do not establish a no-egress or no-training guarantee.", "required_buyer_context": "Notion-hosted remote MCP; excludes locally hosted alternatives. Workspace, client and account entitlements must be checked separately. Client/model training and retention policy, effective connected-source access and the buyer's workspace restrictions.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "trust_profile": { "schema": "varexis-agent-tool-trust/1", "identity": { "tool": "Notion MCP", "variant": "Notion-hosted remote MCP; excludes locally hosted alternatives. Workspace, client and account entitlements must be checked separately." }, "review_status": "documentation_review_only", "checked_on": "2026-10-11", "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.", "plan_scope": "Buyer plan, feature entitlement and effective configuration are not verified.", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "Notion hosts the remote MCP service.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "Search, read and update workspace content.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "Content accessible to the authorizing user, including supported search across connected sources.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "writes", "label": "Write capability", "status": "documented", "statement": "Documented operations include creating pages or databases and updating content.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "auth", "label": "Authentication", "status": "documented", "statement": "User authorization through OAuth; workspace and organization owners have documented connection management controls.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "permissions", "label": "Permission surface", "status": "documented", "statement": "The user's content access and workspace connection controls define relevant boundaries; buyer settings were not inspected.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "review_inference", "statement": "Notion explicitly states that an MCP client may send returned content to systems outside Notion.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "Treating workspace authorization as a data-residency promise; following instructions embedded in a page; unintended content changes.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "Client/model training and retention policy, effective connected-source access and the buyer's workspace restrictions.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "When a task requires no external disclosure, resolve the client's data flow before reading private pages; do not apply page instructions as user authority.", "source_ids": [] } ], "evidence_sources": [ { "source_id": "notion-main", "url": "https://developers.notion.com/guides/mcp/overview", "final_url": "https://developers.notion.com/guides/mcp/overview", "title": "Notion MCP overview", "checked_on": "2026-10-11", "sha256": "ebec8a48e17acd3aef72c5628476a2c9429b6e822aa37ffb3b391aebf324b423", "bytes": 342441 }, { "source_id": "notion-security", "url": "https://developers.notion.com/guides/mcp/mcp-security-best-practices", "final_url": "https://developers.notion.com/guides/mcp/mcp-security-best-practices", "title": "Notion MCP security guidance", "checked_on": "2026-10-11", "sha256": "d12c09d54088a85198dd5815e34f2af7967b91747dfbf263af74f7c813374a82", "bytes": 334240 }, { "source_id": "mcp-hints", "url": "https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/", "final_url": "https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/", "title": "MCP tool annotations and enforcement boundaries", "checked_on": "2026-10-11", "sha256": "82888044d831c3bd18f03d87a846ce5d27e028bd67a095edc04ba377fc622163", "bytes": 52715 } ], "observed_tool_execution": false, "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.", "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.", "paid_value": { "decision_context": "Keep the documented content-sharing limitation with a dated connector approval discussion.", "free": "Complete profile, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.", "specific_watch": "Review the effective tool inventory and client data policy before a new integration decision." }, "change_history": [ { "version": 1, "date": "2026-10-11", "change": "Initial documentation review; no earlier vendor assessment claimed." } ] }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#notion-mcp-content-sharing-trust", "machine_readable_record": "/varexis-index/records/notion-mcp-content-sharing-trust.json" } }, { "record_id": "VXI-EXT-TOOL-TRUST-SLACK-01-v1", "url": "/varexis-index/records/slack-mcp-search-posting-trust.json", "content_sha256": "ab365f9176d2376e58c25ed6e0815ecda3eb2f3e088fff8dd2c40a67779a6518", "evidence": { "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-11T21:27:53.457Z", "record_id": "VXI-EXT-TOOL-TRUST-SLACK-01-v1", "record_kind": "external_reference", "title": "Slack MCP: Search scope and posting authority", "system": "Slack MCP", "evidence_family": "agent_tool_trust_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "What should an agent check before searching private Slack content without posting messages?", "near_questions": [ "How can I search team chat without giving an agent permission to post?", "Which Slack MCP scopes allow private channel searches?", "Does Slack search access also permit sending messages?", "Can a Slack connector retrieve direct message history?", "Does an app IP allowlist apply to Slack MCP?", "Can an unlisted app use the official Slack MCP server?", "What must be checked before sharing a retrieved Slack message?", "Are Slackbot MCP connections the same as Slack MCP server access?", "Should instructions inside Slack messages control an agent?", "Which workspace identity will a Slack tool use?", "What does a saved Slack permission review preserve?", "Does this Slack profile establish client data retention?" ], "supported_claims": [ { "claim": "Slack documents separate user-token scopes for searches, conversation history and posting. Review the authorized workspace, requested content and client data handling before retrieval. A search permission does not authorize sending a message, and connecting Slack to another tool creates a separate disclosure decision. This record reviews the official server, not Slackbot's connections to third-party servers.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent tool execution or security testing", "Vendor certification, guaranteed safety or no-training assurance" ], "public_summary": "Slack documents separate user-token scopes for searches, conversation history and posting. Review the authorized workspace, requested content and client data handling before retrieval. A search permission does not authorize sending a message, and connecting Slack to another tool creates a separate disclosure decision. This record reviews the official server, not Slackbot's connections to third-party servers.", "related_record_ids": [ "VXI-EXT-TOOL-TRUST-ASANA-01-v1", "VXI-EXT-TOOL-TRUST-HUBSPOT-01-v1", "VXI-EXT-TOOL-TRUST-FIGMA-01-v1" ], "source_review": { "source_type": "official_external_documentation", "source_title": "Slack MCP tools, scopes and client access", "source_url": "https://docs.slack.dev/ai/slack-mcp-server/", "checked_on": "2026-10-11", "candidate_record_id": "VXI-EXT-TOOL-TRUST-SLACK-01-v1", "candidate_record_sha256": "167d749a41ab098ea05f099f04c876ead01b1446479b5da1dbebb66a0d1a007a", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "Slack documents separate user-token scopes for searches, conversation history and posting. Review the authorized workspace, requested content and client data handling before retrieval. A search permission does not authorize sending a message, and connecting Slack to another tool creates a separate disclosure decision. This record reviews the official server, not Slackbot's connections to third-party servers.", "required_buyer_context": "Slack's official hosted MCP server for external clients; not the Slackbot MCP client or a community Slack connector. Actual workspace grants, channel visibility, client recipients and retention.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "trust_profile": { "schema": "varexis-agent-tool-trust/1", "identity": { "tool": "Slack MCP", "variant": "Slack's official hosted MCP server for external clients; not the Slackbot MCP client or a community Slack connector." }, "review_status": "documentation_review_only", "checked_on": "2026-10-11", "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.", "plan_scope": "Buyer plan, feature entitlement and effective configuration are not verified.", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "Slack operates the official hosted server.", "source_ids": [ "slack-main" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "Retrieve workspace context and perform supported Slack actions.", "source_ids": [ "slack-overview" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "Searches, files and conversation history require their respective user-token scopes.", "source_ids": [ "slack-main" ] }, { "field": "writes", "label": "Write capability", "status": "documented", "statement": "Posting, reactions, canvases and channel creation have separate write scopes.", "source_ids": [ "slack-main" ] }, { "field": "auth", "label": "Authentication", "status": "documented", "statement": "Confidential OAuth is documented for Marketplace or internal apps; unlisted apps are excluded.", "source_ids": [ "slack-main" ] }, { "field": "permissions", "label": "Permission surface", "status": "documented", "statement": "Scope grants and configured app IP allowlists apply to MCP requests.", "source_ids": [ "slack-main" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "review_inference", "statement": "Slack content reaches the connected client; onward sharing depends on the client and other tools.", "source_ids": [ "slack-main" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "Overbroad private-channel access, unintended posting, or following instructions inside retrieved messages.", "source_ids": [ "slack-main" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "Actual workspace grants, channel visibility, client recipients and retention.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "For a search task, withhold posting and cross-tool sharing unless separately authorized.", "source_ids": [] } ], "evidence_sources": [ { "source_id": "slack-main", "url": "https://docs.slack.dev/ai/slack-mcp-server/", "final_url": "https://docs.slack.dev/ai/slack-mcp-server/", "title": "Slack MCP tools, scopes and client access", "checked_on": "2026-10-11", "sha256": "2974027071b91d6963a15f8c9365fd732daa864b87762d10beee746622653141", "bytes": 60455 }, { "source_id": "slack-overview", "url": "https://docs.slack.dev/ai/mcp-overview/", "final_url": "https://docs.slack.dev/ai/mcp-overview/", "title": "Slack MCP server and client distinction", "checked_on": "2026-10-11", "sha256": "59b1df50cfb0680feb7961ac67be0b1d5d5c39f9de04de317ec537bfae3dc0e1", "bytes": 40353 } ], "observed_tool_execution": false, "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.", "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.", "paid_value": { "decision_context": "Preserve the scope and disclosure questions used when approving a chat-search connector.", "free": "Complete profile, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.", "specific_watch": "Recheck user-token scopes, app distribution status and IP allowlists when the connection changes." }, "change_history": [ { "version": 1, "date": "2026-10-11", "change": "Initial documentation review; no earlier vendor assessment claimed." } ] }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#slack-mcp-search-posting-trust", "machine_readable_record": "/varexis-index/records/slack-mcp-search-posting-trust.json" } } ], "basis": "No new source review is performed. New deterministic VAREXIS declaration checks informed by unchanged, dated documentation-review records. Synthetic tests establish checker behavior only.", "boundary": "One-time GBP 49 plus applicable VAT for the versioned local admission executable and one-buyer internal-use licence. Separate purchase; not included in existing GBP 5/19 offers or subscriptions. No per-run fee, updates, monitoring, redistribution or support SLA. Retain your key and downloaded result; server retention is not guaranteed permanently.", "pack": { "schema": "varexis-index-evidence-pack/1", "pack_id": "agent-tool-admission", "version": "1.0.0", "title": "Agent Tool Admission & Permission Control", "prepared_at_utc": "2026-10-16T22:00:00Z", "review_status": "documentation_review_only", "source_checked_on": [ "2026-10-11" ], "source_capture_date": null, "source_capture_boundary": "The records report when sources were checked. A separate source capture timestamp and an independently tested runtime version are not established.", "summary_markdown": "Compare exact actions, resources and recipients across GitHub, Playwright, Notion and Slack declarations; identify authority conflicts, changes and missing verification. A local validation pass describes supplied declarations only; it does not inspect effective permissions, verify records exist, enforce policy, certify compliance or approve deployment. Complete source evidence, schemas and two worked scenarios remain free.\n\nOne-time GBP 49 plus applicable VAT for the versioned local admission executable and one-buyer internal-use licence. Separate purchase; not included in existing GBP 5/19 offers or subscriptions. No per-run fee, updates, monitoring, redistribution or support SLA. Retain your key and downloaded result; server retention is not guaranteed permanently.", "comparison": [ { "record_id": "VXI-EXT-TOOL-TRUST-GITHUB-01-v1", "tool": "GitHub MCP", "review_status": "documentation_review_only", "checked_on": "2026-10-11", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "GitHub publishes the server and hosts the remote service; a local deployment has its own operator.", "source_ids": [ "github-main", "github-config" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "Review repository content, issues and pull requests.", "source_ids": [ "github-main", "github-config" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "Repository files, issues and pull requests accessible through the selected tools and credential.", "source_ids": [ "github-main", "github-config" ] }, { "field": "writes", "label": "Write capability", "status": "documented", "statement": "Write-capable toolsets exist; documented read-only mode excludes their write tools.", "source_ids": [ "github-main", "github-config" ] }, { "field": "auth", "label": "Authentication", "status": "documented", "statement": "Remote OAuth or PAT authentication is documented; actual repository grants and organization policy require inspection.", "source_ids": [ "github-main", "github-config" ] }, { "field": "permissions", "label": "Permission surface", "status": "documented", "statement": "Toolset selection, exclusions and read-only mode are configurable. Lockdown does not reduce the underlying credential's authority.", "source_ids": [ "github-main", "github-config" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "review_inference", "statement": "Repository results return to the connected client. If that client uses a hosted model, selected content may leave the repository service; inspect that client's data policy.", "source_ids": [ "github-main", "github-config" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "Overbroad credentials; assuming lockdown prevents all hostile content; enabling a write tool during a review-only task.", "source_ids": [ "github-main", "github-config" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "Actual token grants, effective tool list, enterprise hosting configuration and client retention/training terms.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "For a review-only task, stop before writes; resolve unknown repository grants before reading private repositories.", "source_ids": [] } ] }, { "record_id": "VXI-EXT-TOOL-TRUST-PLAYWRIGHT-01-v1", "tool": "Playwright MCP", "review_status": "documentation_review_only", "checked_on": "2026-10-11", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "Microsoft publishes Playwright MCP; the organization running the process operates the browser connection.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "Inspect and interact with web pages through browser automation.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "Page content and browser-visible information under the active session.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "writes", "label": "Write capability", "status": "documented", "statement": "Browser interactions can submit forms and change remote state using the session's authority.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "auth", "label": "Authentication", "status": "documented", "statement": "Websites use the browser's authentication state; isolated mode can load saved state. No hosted vendor OAuth login is assumed for local stdio.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "permissions", "label": "Permission surface", "status": "documented", "statement": "Origin filters are documented as incomplete boundaries. Browser identity and surrounding runtime/network controls require separate review.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "review_inference", "statement": "The browser contacts websites and returns content to the MCP client; a local browser process does not establish local-only model processing.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "Reusing a privileged browser session; treating isolation as read-only authority; sharing a saved state file that enables impersonation.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "Installed release, loaded cookies, browser permissions, network enforcement and client data handling.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "Use an authorized session and destination set; stop before form submissions outside the task and keep saved auth state out of evidence exports.", "source_ids": [] } ] }, { "record_id": "VXI-EXT-TOOL-TRUST-NOTION-01-v1", "tool": "Notion MCP", "review_status": "documentation_review_only", "checked_on": "2026-10-11", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "Notion hosts the remote MCP service.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "Search, read and update workspace content.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "Content accessible to the authorizing user, including supported search across connected sources.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "writes", "label": "Write capability", "status": "documented", "statement": "Documented operations include creating pages or databases and updating content.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "auth", "label": "Authentication", "status": "documented", "statement": "User authorization through OAuth; workspace and organization owners have documented connection management controls.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "permissions", "label": "Permission surface", "status": "documented", "statement": "The user's content access and workspace connection controls define relevant boundaries; buyer settings were not inspected.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "review_inference", "statement": "Notion explicitly states that an MCP client may send returned content to systems outside Notion.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "Treating workspace authorization as a data-residency promise; following instructions embedded in a page; unintended content changes.", "source_ids": [ "notion-main", "notion-security" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "Client/model training and retention policy, effective connected-source access and the buyer's workspace restrictions.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "When a task requires no external disclosure, resolve the client's data flow before reading private pages; do not apply page instructions as user authority.", "source_ids": [] } ] }, { "record_id": "VXI-EXT-TOOL-TRUST-SLACK-01-v1", "tool": "Slack MCP", "review_status": "documentation_review_only", "checked_on": "2026-10-11", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "Slack operates the official hosted server.", "source_ids": [ "slack-main" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "Retrieve workspace context and perform supported Slack actions.", "source_ids": [ "slack-overview" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "Searches, files and conversation history require their respective user-token scopes.", "source_ids": [ "slack-main" ] }, { "field": "writes", "label": "Write capability", "status": "documented", "statement": "Posting, reactions, canvases and channel creation have separate write scopes.", "source_ids": [ "slack-main" ] }, { "field": "auth", "label": "Authentication", "status": "documented", "statement": "Confidential OAuth is documented for Marketplace or internal apps; unlisted apps are excluded.", "source_ids": [ "slack-main" ] }, { "field": "permissions", "label": "Permission surface", "status": "documented", "statement": "Scope grants and configured app IP allowlists apply to MCP requests.", "source_ids": [ "slack-main" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "review_inference", "statement": "Slack content reaches the connected client; onward sharing depends on the client and other tools.", "source_ids": [ "slack-main" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "Overbroad private-channel access, unintended posting, or following instructions inside retrieved messages.", "source_ids": [ "slack-main" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "Actual workspace grants, channel visibility, client recipients and retention.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "For a search task, withhold posting and cross-tool sharing unless separately authorized.", "source_ids": [] } ] } ], "members": [ { "schema": "varexis-index-delivery/1", "catalog_version": "2026-10-14T20:21:57.226Z", "route_id": "agentic_reviewed_github_mcp_repository_access_trust", "question": "How can an agent review repository access without enabling GitHub MCP writes?", "answer": "GitHub documents a read-only server mode that removes write tools and a separate choice of toolsets. Review both the credential's repository access and the configured server mode. Lockdown is a content filter with stated limitations. This profile helps scope a repository-review connection; it does not verify your token, server configuration or resistance to prompt injection.", "basis": "A saved snapshot of the reviewed public route and source records. No fresh source review, independent experiment, deployment assessment or bespoke claim analysis is performed by this delivery.", "boundary": "Public answers remain free. Payment provides automatic retrieval, version binding and a saved delivery. It does not upgrade evidence or disclose protected material.", "snapshot_sha256": "eb5bf8ee35598f2a504d20a544e26f93a965ce291386ceee7ca22ae8eee7de7e", "record_ids": [ "VXI-EXT-TOOL-TRUST-GITHUB-01-v1" ] }, { "schema": "varexis-index-delivery/1", "catalog_version": "2026-10-14T20:21:57.226Z", "route_id": "agentic_reviewed_playwright_mcp_browser_session_trust", "question": "Does an isolated Playwright MCP browser session prevent privileged web actions or data disclosure?", "answer": "Playwright MCP documents persistent, isolated and existing-browser session modes. Isolation concerns session state; it does not make authenticated web actions read-only. Its origin filters explicitly exclude redirects from their protection, and the project states that MCP itself is not a security boundary. Review browser identity, destinations and task authorization separately.", "basis": "A saved snapshot of the reviewed public route and source records. No fresh source review, independent experiment, deployment assessment or bespoke claim analysis is performed by this delivery.", "boundary": "Public answers remain free. Payment provides automatic retrieval, version binding and a saved delivery. It does not upgrade evidence or disclose protected material.", "snapshot_sha256": "94008f2569c1b1e8a4317a921e0efa119d77215124d041f76b4748018bc96f60", "record_ids": [ "VXI-EXT-TOOL-TRUST-PLAYWRIGHT-01-v1" ] }, { "schema": "varexis-index-delivery/1", "catalog_version": "2026-10-14T20:21:57.226Z", "route_id": "agentic_reviewed_notion_mcp_content_sharing_trust", "question": "Can an agent assume Notion content stays inside Notion when using its MCP connector?", "answer": "Notion documents a hosted OAuth connector that can read and update accessible content. Its security guidance explicitly warns that connected clients may send returned content outside Notion. Check the client and model data policy as well as workspace access. The connector's publisher and valid login do not establish a no-egress or no-training guarantee.", "basis": "A saved snapshot of the reviewed public route and source records. No fresh source review, independent experiment, deployment assessment or bespoke claim analysis is performed by this delivery.", "boundary": "Public answers remain free. Payment provides automatic retrieval, version binding and a saved delivery. It does not upgrade evidence or disclose protected material.", "snapshot_sha256": "4546c08bd555f3f7bc775752165eae07261d5e6215e3dbd6444a2e0bc3d9f4fd", "record_ids": [ "VXI-EXT-TOOL-TRUST-NOTION-01-v1" ] }, { "schema": "varexis-index-delivery/1", "catalog_version": "2026-10-14T20:21:57.226Z", "route_id": "agentic_reviewed_slack_mcp_search_posting_trust", "question": "What should an agent check before searching private Slack content without posting messages?", "answer": "Slack documents separate user-token scopes for searches, conversation history and posting. Review the authorized workspace, requested content and client data handling before retrieval. A search permission does not authorize sending a message, and connecting Slack to another tool creates a separate disclosure decision. This record reviews the official server, not Slackbot's connections to third-party servers.", "basis": "A saved snapshot of the reviewed public route and source records. No fresh source review, independent experiment, deployment assessment or bespoke claim analysis is performed by this delivery.", "boundary": "Public answers remain free. Payment provides automatic retrieval, version binding and a saved delivery. It does not upgrade evidence or disclose protected material.", "snapshot_sha256": "c240ad6fcb406a2580157e1388b6a394b87bb127caf161a3ca4dd84c2a194e51", "record_ids": [ "VXI-EXT-TOOL-TRUST-SLACK-01-v1" ] } ], "rights_review": { "reviewed_on": "2026-10-16", "scope": "Rights-reviewed VAREXIS authored public summaries plus new original consistency checks and synthetic examples.", "included": "Existing public VAREXIS review records and their limitations; an attributed comparison using the same documented findings.", "excluded": "Upstream documentation bodies, source code, screenshots, logos, private operator templates and protected evidence.", "redistribution_boundary": "Source links and hashes identify upstream material; they do not grant rights to redistribute that material. This package includes no upstream document bodies or code. Existing VAREXIS service terms apply to the supplied compilation.", "terms_url": "https://varexis.tech/checkout-terms", "independent_testing": false }, "delivery_unit": { "kind": "one_licensed_product", "member_count": 4, "developer_query_units": 0, "research_query_units": 0, "extra_member_purchases": false, "automatic_refresh": false, "service_id": "tool_admission", "existing_subscriptions_eligible": false } }, "paid_artifact": { "schema": "varexis-paid-artifact/1", "filename": "varexis-agent-tool-admission-v1.zip", "media_type": "application/zip", "encoding": "base64", "archive_sha256": "9195c6d66da1165a66a3a86b70405528cc00023b580178596477fd9b93732034", "manifest_sha256": "c8c43e58a526681ba83ec58d170c579af97c5ba3bebfb5235666d481641c5f8f", "bytes": 46637, "runtime": "Node.js 24; tested 24.13.0", "licence": "VAREXIS Agent Tool Admission & Permission Control v1.0.0\nOne-time licence for one purchasing individual or one legal entity, including its staff and agents acting internally on its behalf. Reusable local execution and internal CI use; no per-run fee. No sublicensing, redistribution of executable/rules, hosted customer service, API resale or external agent distribution. The other product profile is not licensed. Public evidence retains its existing terms. No updates, monitoring, deployment assurance, certification or support SLA is included. Billing and delivery support follows https://varexis.tech/checkout-terms. Statutory rights are unaffected.\n", "extract_and_run": "Verify ZIP SHA-256 against this saved result. Extract and follow QUICKSTART.txt with this external manifest_sha256. No customer-data upload." }, "snapshot_sha256": "b55f6563d2e5e87e26fb04159805708582652e3d2598290d5a0560c9e12fab25", "preview_kind": "paid_executable_manifest", "preview_payload_sha256": "bfd8799327e3dbaa77d31cd49307bfbd0b0592ed346d388bf8256dfcf75f7f95" }