{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-14T20:21:57.226Z",
  "record_id": "VXI-EXT-TOOL-TRUST-STRAPI-01-v1",
  "record_kind": "external_reference",
  "title": "Strapi MCP: Admin-token scope and audit coverage",
  "system": "Strapi",
  "evidence_family": "agent_tool_trust_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does Strapi MCP audit logging prove every content read was recorded?",
  "near_questions": [
    "Is every CMS agent read and write recorded in audit logs?",
    "Which Strapi token controls MCP permissions?",
    "Can fields be hidden while other content remains readable?",
    "Can a content token allow one locale but not another?",
    "Are permissions checked only when the tool list is loaded?",
    "Can a plugin expand the Strapi MCP action surface?",
    "Why might an allowed CMS tool disappear in a client?",
    "Does Strapi audit entitlement depend on plan and version?",
    "Can a read-only content task leave no entry-action audit event?",
    "What evidence proves a particular document action was allowed?",
    "When should CMS audit completeness remain unproven?",
    "Can I retain a Strapi permission and audit review?"
  ],
  "supported_claims": [
    {
      "claim": "The documentation describes permission checks for tools, fields, locales and individual documents. It separately states that MCP entry actions require the documented version and Enterprise audit entitlement, and content-only reads are not logged. Permission enforcement and activity-record completeness therefore need separate evidence.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "The documentation describes permission checks for tools, fields, locales and individual documents. It separately states that MCP entry actions require the documented version and Enterprise audit entitlement, and content-only reads are not logged. Permission enforcement and activity-record completeness therefore need separate evidence.",
  "related_record_ids": [
    "VXI-EXT-TOOL-TRUST-CONTENTSTACK-01-v1",
    "VXI-EXT-TOOL-TRUST-TWILIO-DOCS-01-v1",
    "VXI-EXT-TOOL-TRUST-CONTENTFUL-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Strapi MCP admin permissions and tools",
    "source_url": "https://docs.strapi.io/cms/features/strapi-mcp-server",
    "checked_on": "2026-10-14",
    "candidate_record_id": "VXI-EXT-TOOL-TRUST-STRAPI-01-v1",
    "candidate_record_sha256": "3c9863755b46a7f3551b6a819c6321b08405fc7f66999786d74fb67422f47fc9",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "The documentation describes permission checks for tools, fields, locales and individual documents. It separately states that MCP entry actions require the documented version and Enterprise audit entitlement, and content-only reads are not logged. Permission enforcement and activity-record completeness therefore need separate evidence.",
    "required_buyer_context": "Strapi version/plan, Admin token, content/locale scope, plugins and required audit events.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "trust_profile": {
    "schema": "varexis-agent-tool-trust/1",
    "identity": {
      "tool": "Strapi",
      "variant": "Built-in Strapi CMS MCP endpoint"
    },
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-14",
    "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.",
    "plan_scope": "Buyer plan, entitlement and effective configuration are not verified.",
    "findings": [
      {
        "field": "operator",
        "label": "Publisher and operator",
        "status": "documented",
        "statement": "Strapi provides the endpoint; the buyer operates its CMS deployment.",
        "source_ids": [
          "strapi"
        ]
      },
      {
        "field": "purpose",
        "label": "Purpose",
        "status": "documented",
        "statement": "Content and supported plugin operations.",
        "source_ids": [
          "strapi"
        ]
      },
      {
        "field": "reads",
        "label": "Read capability",
        "status": "documented",
        "statement": "Permitted content fields and locales.",
        "source_ids": [
          "strapi"
        ]
      },
      {
        "field": "writes",
        "label": "Write capability",
        "status": "documented",
        "statement": "Permitted content changes and publication; plugins can add tools.",
        "source_ids": [
          "strapi"
        ]
      },
      {
        "field": "auth",
        "label": "Authentication",
        "status": "documented",
        "statement": "Admin token, independently checked on requests.",
        "source_ids": [
          "strapi"
        ]
      },
      {
        "field": "permissions",
        "label": "Permission surface",
        "status": "documented",
        "statement": "Tool/schema filtering plus runtime document checks.",
        "source_ids": [
          "strapi"
        ]
      },
      {
        "field": "egress",
        "label": "Data leaving the environment",
        "status": "review_inference",
        "statement": "Allowed CMS content can enter the client context.",
        "source_ids": [
          "strapi"
        ]
      },
      {
        "field": "failures",
        "label": "Failure modes to consider",
        "status": "review_inference",
        "statement": "Missing tools may reflect schema compatibility rather than absent permissions.",
        "source_ids": [
          "strapi"
        ]
      },
      {
        "field": "unknown",
        "label": "Unknowns and applicability",
        "status": "unknown",
        "statement": "Buyer entitlement, plugin inventory and actual audit records are unverified.",
        "source_ids": []
      },
      {
        "field": "gate",
        "label": "Suggested refusal or clarification condition",
        "status": "varexis_review_policy",
        "statement": "Do not assert complete read auditing from MCP support.",
        "source_ids": []
      }
    ],
    "evidence_sources": [
      {
        "source_id": "strapi",
        "url": "https://docs.strapi.io/cms/features/strapi-mcp-server",
        "final_url": "https://docs.strapi.io/cms/features/strapi-mcp-server",
        "title": "Strapi MCP admin permissions and tools",
        "checked_on": "2026-10-14",
        "sha256": "34c588cd926c77b452590ce8f7ebbbb45b450c368e666dd3ff0c13b8d30ae632",
        "bytes": 126535
      }
    ],
    "observed_tool_execution": false,
    "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.",
    "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.",
    "paid_value": {
      "decision_context": "Save the separate permission and audit-coverage questions for a CMS procurement review.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.",
      "specific_watch": "Audit version/plan conditions, plugin capabilities and schema compatibility."
    },
    "change_history": [
      {
        "version": 1,
        "date": "2026-10-14",
        "change": "Initial documentation review; no earlier vendor assessment claimed."
      }
    ]
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#strapi-mcp-admin-permission-trust",
  "machine_readable_record": "/varexis-index/records/strapi-mcp-admin-permission-trust.json"
}