{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-14T20:21:57.226Z",
  "record_id": "VXI-EXT-TOOL-TRUST-CONTENTSTACK-01-v1",
  "record_kind": "external_reference",
  "title": "Contentstack MCP: Delivery reads versus management and automation",
  "system": "Contentstack",
  "evidence_family": "agent_tool_trust_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does connecting a content delivery tool also enable publishing or deployments?",
  "near_questions": [
    "Can a CMS lookup connector also publish content?",
    "Which Contentstack group only reads published content?",
    "Does loading all groups add deployment tools?",
    "Do delivery and management use the same credentials?",
    "Can a content assistant trigger an automation?",
    "Which region receives a content request?",
    "What should procurement request about loaded tool groups?",
    "Does OAuth availability establish every product permission?",
    "Can custom endpoints change the data destination?",
    "Which evidence separates drafting from publishing?",
    "When should content-agent actions need clarification?",
    "Can I preserve a content-platform access decision?"
  ],
  "supported_claims": [
    {
      "claim": "Contentstack separates delivery, management, automation and deployment tool groups. Delivery retrieves published content, while other groups expose state-changing operations and use different credentials. Review the loaded groups and corresponding credentials; a content-oriented connector name does not establish a read-only surface.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "Contentstack separates delivery, management, automation and deployment tool groups. Delivery retrieves published content, while other groups expose state-changing operations and use different credentials. Review the loaded groups and corresponding credentials; a content-oriented connector name does not establish a read-only surface.",
  "related_record_ids": [
    "VXI-EXT-TOOL-TRUST-TWILIO-DOCS-01-v1",
    "VXI-EXT-TOOL-TRUST-CONTENTFUL-01-v1",
    "VXI-EXT-TOOL-TRUST-STRAPI-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Contentstack MCP product tool groups",
    "source_url": "https://www.contentstack.com/docs/developers/contentstack-mcp-server",
    "checked_on": "2026-10-14",
    "candidate_record_id": "VXI-EXT-TOOL-TRUST-CONTENTSTACK-01-v1",
    "candidate_record_sha256": "8fff8afd6437742f92ea03ce028d7a92ead7e20da0d480982e4e2ed3a306e823",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Contentstack separates delivery, management, automation and deployment tool groups. Delivery retrieves published content, while other groups expose state-changing operations and use different credentials. Review the loaded groups and corresponding credentials; a content-oriented connector name does not establish a read-only surface.",
    "required_buyer_context": "Loaded product groups, stack/environment, authentication and regional or custom endpoints.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "trust_profile": {
    "schema": "varexis-agent-tool-trust/1",
    "identity": {
      "tool": "Contentstack",
      "variant": "Local Contentstack MCP with selectable product groups"
    },
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-14",
    "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.",
    "plan_scope": "Buyer plan, entitlement and effective configuration are not verified.",
    "findings": [
      {
        "field": "operator",
        "label": "Publisher and operator",
        "status": "documented",
        "statement": "Contentstack publishes the local server.",
        "source_ids": [
          "contentstack"
        ]
      },
      {
        "field": "purpose",
        "label": "Purpose",
        "status": "documented",
        "statement": "Content delivery and selected Contentstack product operations.",
        "source_ids": [
          "contentstack"
        ]
      },
      {
        "field": "reads",
        "label": "Read capability",
        "status": "documented",
        "statement": "Published content, management data or analytics according to loaded groups.",
        "source_ids": [
          "contentstack"
        ]
      },
      {
        "field": "writes",
        "label": "Write capability",
        "status": "documented",
        "statement": "Management, automation and deployment groups include changes.",
        "source_ids": [
          "contentstack"
        ]
      },
      {
        "field": "auth",
        "label": "Authentication",
        "status": "documented",
        "statement": "OAuth and product-specific tokens; delivery and management use different credentials.",
        "source_ids": [
          "contentstack"
        ]
      },
      {
        "field": "permissions",
        "label": "Permission surface",
        "status": "documented",
        "statement": "Group selection controls tools; credential and target scope also matter.",
        "source_ids": [
          "contentstack"
        ]
      },
      {
        "field": "egress",
        "label": "Data leaving the environment",
        "status": "review_inference",
        "statement": "Content and product information can reach the model.",
        "source_ids": [
          "contentstack"
        ]
      },
      {
        "field": "failures",
        "label": "Failure modes to consider",
        "status": "review_inference",
        "statement": "Loading all groups can expose actions beyond content lookup.",
        "source_ids": [
          "contentstack"
        ]
      },
      {
        "field": "unknown",
        "label": "Unknowns and applicability",
        "status": "unknown",
        "statement": "Buyer token scope, region and group selection are unknown.",
        "source_ids": []
      },
      {
        "field": "gate",
        "label": "Suggested refusal or clarification condition",
        "status": "varexis_review_policy",
        "statement": "Confirm publishing, automation and deployment authority separately from reading.",
        "source_ids": []
      }
    ],
    "evidence_sources": [
      {
        "source_id": "contentstack",
        "url": "https://www.contentstack.com/docs/developers/contentstack-mcp-server",
        "final_url": "https://www.contentstack.com/docs/developers/contentstack-mcp-server",
        "title": "Contentstack MCP product tool groups",
        "checked_on": "2026-10-14",
        "sha256": "fbf213537cc3b175ba5603b6d1a80b0c40c816d6ec7db45b4bbac5ece0794f9b",
        "bytes": 982120
      }
    ],
    "observed_tool_execution": false,
    "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.",
    "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.",
    "paid_value": {
      "decision_context": "Save the approved product groups and the distinction between content delivery and operational changes.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.",
      "specific_watch": "Group membership, authentication methods and endpoint overrides."
    },
    "change_history": [
      {
        "version": 1,
        "date": "2026-10-14",
        "change": "Initial documentation review; no earlier vendor assessment claimed."
      }
    ]
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#contentstack-mcp-product-group-trust",
  "machine_readable_record": "/varexis-index/records/contentstack-mcp-product-group-trust.json"
}