{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-14T01:25:58.088Z",
  "record_id": "VXI-EXT-TOOL-TRUST-PRISMA-01-v1",
  "record_kind": "external_reference",
  "title": "Prisma MCP: Workspace actions and CLI guardrail limits",
  "system": "Prisma MCP",
  "evidence_family": "agent_tool_trust_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Do Prisma CLI destructive-command safeguards also protect MCP operations?",
  "near_questions": [
    "Do CLI safety checks also apply to MCP calls?",
    "Can my Prisma assistant manage more than database queries?",
    "Which workspace is selected during Prisma authorisation?",
    "Does an MCP connection approve destructive changes?",
    "What evidence shows the client asks before resource deletion?",
    "Can an assistant inspect deployment information?",
    "Does a CLI refusal prove the MCP will refuse too?",
    "What should procurement ask about agent approval policies?",
    "How should I separate a database read from a resource change?",
    "Can I save the documented Prisma guardrail boundary?",
    "Which client settings affect MCP approvals?",
    "When should a workspace automation review be repeated?"
  ],
  "supported_claims": [
    {
      "claim": "Prisma explicitly limits those safeguards to CLI commands. Its MCP server exposes workspace operations, and the documentation directs users to review approvals in the AI client. A CLI safety claim therefore does not establish the approval behaviour of an MCP call.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "Prisma explicitly limits those safeguards to CLI commands. Its MCP server exposes workspace operations, and the documentation directs users to review approvals in the AI client. A CLI safety claim therefore does not establish the approval behaviour of an MCP call.",
  "related_record_ids": [
    "VXI-EXT-TOOL-TRUST-NEON-01-v1",
    "VXI-EXT-TOOL-TRUST-PLANETSCALE-01-v1",
    "VXI-EXT-TOOL-TRUST-AIVEN-01-v1",
    "VXI-EXT-TOOL-TRUST-MOTHERDUCK-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Prisma MCP workspace access and resource management",
    "source_url": "https://www.prisma.io/docs/ai/tools/mcp-server",
    "checked_on": "2026-10-14",
    "candidate_record_id": "VXI-EXT-TOOL-TRUST-PRISMA-01-v1",
    "candidate_record_sha256": "f6782f21d20014575bdd5cd1a578a2818ad66f405f7b0b546b4d6ca8d4d702da",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Prisma explicitly limits those safeguards to CLI commands. Its MCP server exposes workspace operations, and the documentation directs users to review approvals in the AI client. A CLI safety claim therefore does not establish the approval behaviour of an MCP call.",
    "required_buyer_context": "Identify the workspace, requested operation, client approval policy and target resource.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "trust_profile": {
    "schema": "varexis-agent-tool-trust/1",
    "identity": {
      "tool": "Prisma MCP",
      "variant": "Hosted workspace server"
    },
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-14",
    "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.",
    "plan_scope": "Buyer plan, entitlement and effective configuration are not verified.",
    "findings": [
      {
        "field": "operator",
        "label": "Publisher and operator",
        "status": "documented",
        "statement": "Prisma provides the hosted MCP integration.",
        "source_ids": [
          "prisma"
        ]
      },
      {
        "field": "purpose",
        "label": "Purpose",
        "status": "documented",
        "statement": "Manage Prisma workspace resources from an assistant.",
        "source_ids": [
          "prisma"
        ]
      },
      {
        "field": "reads",
        "label": "Read capability",
        "status": "documented",
        "statement": "Reads database and deployment information.",
        "source_ids": [
          "prisma"
        ]
      },
      {
        "field": "writes",
        "label": "Write capability",
        "status": "documented",
        "statement": "Documents database, Compute and storage management operations.",
        "source_ids": [
          "prisma"
        ]
      },
      {
        "field": "auth",
        "label": "Authentication",
        "status": "documented",
        "statement": "Prisma account authorisation with workspace selection.",
        "source_ids": [
          "prisma"
        ]
      },
      {
        "field": "permissions",
        "label": "Permission surface",
        "status": "documented",
        "statement": "The selected workspace and client approval policy need review; CLI safeguards do not apply to MCP.",
        "source_ids": [
          "prisma"
        ]
      },
      {
        "field": "egress",
        "label": "Data leaving the environment",
        "status": "review_inference",
        "statement": "Requested resource data returns to the connected AI client.",
        "source_ids": [
          "prisma"
        ]
      },
      {
        "field": "failures",
        "label": "Failure modes to consider",
        "status": "review_inference",
        "statement": "Assuming CLI safeguards cover MCP can leave a change unreviewed.",
        "source_ids": [
          "prisma"
        ]
      },
      {
        "field": "unknown",
        "label": "Unknowns and applicability",
        "status": "unknown",
        "statement": "Effective workspace rights and client approval rules are unknown.",
        "source_ids": []
      },
      {
        "field": "gate",
        "label": "Suggested refusal or clarification condition",
        "status": "varexis_review_policy",
        "statement": "Require task authority and the actual MCP approval policy before a destructive operation.",
        "source_ids": []
      }
    ],
    "evidence_sources": [
      {
        "source_id": "prisma",
        "url": "https://www.prisma.io/docs/ai/tools/mcp-server",
        "final_url": "https://www.prisma.io/docs/ai/tools/mcp-server",
        "title": "Prisma MCP workspace access and resource management",
        "checked_on": "2026-10-14",
        "sha256": "b8b61520536d1881d15c7f6ddfacb48d6869e3927b08f954b28d28e53b629882",
        "bytes": 501904
      }
    ],
    "observed_tool_execution": false,
    "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.",
    "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.",
    "paid_value": {
      "decision_context": "Preserve the CLI-versus-MCP control distinction for an onboarding review.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.",
      "specific_watch": "Recheck MCP capabilities and client approval settings."
    },
    "change_history": [
      {
        "version": 1,
        "date": "2026-10-14",
        "change": "Initial documentation review; no earlier vendor assessment claimed."
      }
    ]
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#prisma-mcp-cli-guardrail-trust",
  "machine_readable_record": "/varexis-index/records/prisma-mcp-cli-guardrail-trust.json"
}