{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-16T07:59:18.009Z",
  "record_id": "VXI-EXT-TOOL-TRUST-CONFLUENT-01-v1",
  "record_kind": "external_reference",
  "title": "Confluent MCP: Regional access and client-controlled confirmation",
  "system": "Confluent Cloud managed MCP",
  "evidence_family": "agent_tool_trust_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Can an agent assume Confluent MCP cannot change streaming resources?",
  "near_questions": [
    "Can Confluent MCP restart a connector?",
    "Can it create or delete Flink statements?",
    "Which tools are on the regional endpoint?",
    "Will a Cloud API key work on both servers?",
    "Does a global key prove access to every cluster?",
    "Can a client auto-approve the confirmation?",
    "Which organization does the credential belong to?",
    "Can a topic read expose message content?",
    "Does private connectivity enforce every network boundary?",
    "Which audit evidence identifies tool calls?",
    "When should an agent stop before changing a pipeline?",
    "Can I save the streaming-tool access review?"
  ],
  "supported_claims": [
    {
      "claim": "Most documented operations read data, but connector restart/configuration and Flink statement changes are available. Global and regional endpoints accept different key types. Mutation confirmation is presented through the client, whose auto-approval may bypass a visible prompt. Credential permissions remain decisive.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "Most documented operations read data, but connector restart/configuration and Flink statement changes are available. Global and regional endpoints accept different key types. Mutation confirmation is presented through the client, whose auto-approval may bypass a visible prompt. Credential permissions remain decisive.",
  "related_record_ids": [],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Confluent Cloud managed MCP servers",
    "source_url": "https://docs.confluent.io/cloud/current/ai/ai-tools/managed-mcp-server.html",
    "checked_on": "2026-10-16",
    "candidate_record_id": "VXI-EXT-TOOL-TRUST-CONFLUENT-01-v1",
    "candidate_record_sha256": "1b80b95e6b84f126a11a46201bc3b79e3786aa3e6d05a49f3ec816e465da3c1b",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Most documented operations read data, but connector restart/configuration and Flink statement changes are available. Global and regional endpoints accept different key types. Mutation confirmation is presented through the client, whose auto-approval may bypass a visible prompt. Credential permissions remain decisive.",
    "required_buyer_context": "Organization, cloud region, API-key type, RBAC, network scope and client confirmation settings.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "trust_profile": {
    "schema": "varexis-agent-tool-trust/1",
    "identity": {
      "tool": "Confluent Cloud managed MCP",
      "variant": "Global and regional hosted servers"
    },
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-16",
    "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.",
    "plan_scope": "Buyer plan, entitlement and effective configuration are not verified.",
    "findings": [
      {
        "field": "operator",
        "label": "Publisher and operator",
        "status": "documented",
        "statement": "Confluent operates the managed servers.",
        "source_ids": [
          "confluent"
        ]
      },
      {
        "field": "purpose",
        "label": "Purpose",
        "status": "documented",
        "statement": "Inspect streaming resources and perform selected operations.",
        "source_ids": [
          "confluent"
        ]
      },
      {
        "field": "reads",
        "label": "Read capability",
        "status": "documented",
        "statement": "Clusters, topics, messages, schemas and metrics as permitted.",
        "source_ids": [
          "confluent"
        ]
      },
      {
        "field": "writes",
        "label": "Write capability",
        "status": "documented",
        "statement": "Connector restart/configuration and Flink statement changes.",
        "source_ids": [
          "confluent"
        ]
      },
      {
        "field": "auth",
        "label": "Authentication",
        "status": "documented",
        "statement": "HTTP Basic credentials using supported API-key types.",
        "source_ids": [
          "confluent"
        ]
      },
      {
        "field": "permissions",
        "label": "Permission surface",
        "status": "documented",
        "statement": "Key organization, resource permissions and endpoint scope.",
        "source_ids": [
          "confluent"
        ]
      },
      {
        "field": "egress",
        "label": "Data leaving the environment",
        "status": "review_inference",
        "statement": "Streaming content and diagnostics reach the agent.",
        "source_ids": [
          "confluent"
        ]
      },
      {
        "field": "failures",
        "label": "Failure modes to consider",
        "status": "review_inference",
        "statement": "Wrong region, unsupported key or automatic approval can affect execution.",
        "source_ids": [
          "confluent"
        ]
      },
      {
        "field": "unknown",
        "label": "Unknowns and applicability",
        "status": "unknown",
        "statement": "Buyer RBAC, network topology and client approval policy are unknown.",
        "source_ids": []
      },
      {
        "field": "gate",
        "label": "Suggested refusal or clarification condition",
        "status": "varexis_review_policy",
        "statement": "Require exact change authority; do not rely on a prompt alone.",
        "source_ids": []
      }
    ],
    "evidence_sources": [
      {
        "source_id": "confluent",
        "url": "https://docs.confluent.io/cloud/current/ai/ai-tools/managed-mcp-server.html",
        "final_url": "https://docs.confluent.io/cloud/current/ai/ai-tools/managed-mcp-server.html",
        "title": "Confluent Cloud managed MCP servers",
        "checked_on": "2026-10-16",
        "sha256": "660e9f9279b15e7a62bd506f6f29f6d8d57723cf7520ff7ae741ec0144a4da92",
        "bytes": 418543
      }
    ],
    "observed_tool_execution": false,
    "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.",
    "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.",
    "paid_value": {
      "decision_context": "Preserve the exact streaming operation, credential boundary and approval evidence.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.",
      "specific_watch": "Endpoint support, mutating tools, confirmation behaviour and private connectivity."
    },
    "change_history": [
      {
        "version": 1,
        "date": "2026-10-16",
        "change": "Initial documentation review; no earlier vendor assessment claimed."
      }
    ]
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#confluent-managed-mcp-confirmation-boundary",
  "machine_readable_record": "/varexis-index/records/confluent-managed-mcp-confirmation-boundary.json"
}