Synthex Forge — x402 Paid Agent Services

Assess Tool Permission

assess_tool_permission

Read-onlyIdempotent

Tool Permission Threatmodel. use it rather than assess_dependency_risk for permission, not dependency risk; an object with 45 fields including algorithm, analysedAt. $0.25 USDC.

Input Schema

Name	Required	Description	Default
`manifest`	No	The manifest describing the delivered or expected artifact.
`ownership_proof`	No	The ownership proof this operation operates on. See the schema for its type and whether it is required.

Output Schema

Name	Required	Description
`kind`	No	The `kind` field of the response.
`name`	No	The `name` field of the response.
`note`	No	A note on how the answer was produced.
`tool`	No	The `tool` field of the response.
`tools`	No	The `tools` field of the response.
`detail`	Yes	Human-readable explanation of the verdict.
`sha256`	No	The `sha256` field of the response.
`framing`	No	The `framing` field of the response.
`metrics`	No	The `metrics` field of the response.
`verdict`	Yes	The decision this tool returned.
`coverage`	No	How much of the underlying corpus the answer is based on.
`protocol`	No	The `protocol` field of the response.
`signedBy`	No	The `signedBy` field of the response.
`algorithm`	No	The `algorithm` field of the response.
`analysedAt`	No	The `analysedAt` field of the response.
`ed25519Sig`	No	The `ed25519Sig` field of the response.
`serverName`	No	The `serverName` field of the response.
`description`	No	The `description` field of the response.
`permissions`	No	The `permissions` field of the response.
`evidenceCore`	No	The `evidenceCore` field of the response.
`impliedClass`	No	The `impliedClass` field of the response.
`mutatesState`	No	The `mutatesState` field of the response.
`observations`	No	The `observations` field of the response.
`publicKeyHex`	No	The `publicKeyHex` field of the response.
`tools_scored`	No	The `tools_scored` field of the response.
`tools_usable`	No	The `tools_usable` field of the response.
`verdictLevel`	No	The `verdictLevel` field of the response.
`tools_skipped`	No	The `tools_skipped` field of the response.
`evidenceDigest`	No	The `evidenceDigest` field of the response.
`ownershipProof`	No	The `ownershipProof` field of the response.
`sprawlFindings`	No	The `sprawlFindings` field of the response.
`tools_supplied`	No	The `tools_supplied` field of the response.
`canonicalSha256`	No	The `canonicalSha256` field of the response.
`ownership_proof`	No	The `ownership_proof` field of the response.
`reproducibility`	No	The `reproducibility` field of the response.
`requiresPayment`	No	The `requiresPayment` field of the response.
`sprawl_findings`	No	The `sprawl_findings` field of the response.
`declaredMaxClass`	No	The `declaredMaxClass` field of the response.
`overallRiskScore`	No	The `overallRiskScore` field of the response.
`verificationHint`	No	The `verificationHint` field of the response.
`permissionClasses`	No	The `permissionClasses` field of the response.
`overall_risk_score`	No	The `overall_risk_score` field of the response.
`riskClassHistogram`	No	The `riskClassHistogram` field of the response.
`server_name_present`	No	The `server_name_present` field of the response.
`tools_with_permissions`	No	The `tools_with_permissions` field of the response.

Schema Changelog

Changes observed during successful MCP inspections.

Changed47 schema fields changedOct 31, 2026

addedOutput schema / properties / algorithm

Added value: +{
+  "description": "The `algorithm` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / analysedAt

Added value: +{
+  "description": "The `analysedAt` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / canonicalSha256

Added value: +{
+  "description": "The `canonicalSha256` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / coverage

Added value: +{
+  "description": "How much of the underlying corpus the answer is based on.",
+  "type": "object"
+}

addedOutput schema / properties / declaredMaxClass

Added value: +{
+  "description": "The `declaredMaxClass` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / description

Added value: +{
+  "description": "The `description` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / detail

Added value: +{
+  "description": "Human-readable explanation of the verdict.",
+  "type": "string"
+}

addedOutput schema / properties / ed25519Sig

Added value: +{
+  "description": "The `ed25519Sig` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / evidenceCore

Added value: +{
+  "description": "The `evidenceCore` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / evidenceDigest

Added value: +{
+  "description": "The `evidenceDigest` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / framing

Added value: +{
+  "description": "The `framing` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / impliedClass

Added value: +{
+  "description": "The `impliedClass` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / kind

Added value: +{
+  "description": "The `kind` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / metrics

Added value: +{
+  "description": "The `metrics` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / mutatesState

Added value: +{
+  "description": "The `mutatesState` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / name

Added value: +{
+  "description": "The `name` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / note

Added value: +{
+  "description": "A note on how the answer was produced.",
+  "type": "string"
+}

addedOutput schema / properties / observations

Added value: +{
+  "description": "The `observations` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / overallRiskScore

Added value: +{
+  "description": "The `overallRiskScore` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / overall_risk_score

Added value: +{
+  "description": "The `overall_risk_score` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / ownershipProof

Added value: +{
+  "description": "The `ownershipProof` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / ownership_proof

Added value: +{
+  "description": "The `ownership_proof` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / permissionClasses

Added value: +{
+  "description": "The `permissionClasses` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / permissions

Added value: +{
+  "description": "The `permissions` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / protocol

Added value: +{
+  "description": "The `protocol` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / publicKeyHex

Added value: +{
+  "description": "The `publicKeyHex` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / reproducibility

Added value: +{
+  "description": "The `reproducibility` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / requiresPayment

Added value: +{
+  "description": "The `requiresPayment` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / riskClassHistogram

Added value: +{
+  "description": "The `riskClassHistogram` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / serverName

Added value: +{
+  "description": "The `serverName` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / server_name_present

Added value: +{
+  "description": "The `server_name_present` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / sha256

Added value: +{
+  "description": "The `sha256` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / signedBy

Added value: +{
+  "description": "The `signedBy` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / sprawlFindings

Added value: +{
+  "description": "The `sprawlFindings` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / sprawl_findings

Added value: +{
+  "description": "The `sprawl_findings` field of the response.",
+  "type": "object"
+}

removedOutput schema / properties / status

Removed value: -{
-  "type": "string"
-}

addedOutput schema / properties / tool

Added value: +{
+  "description": "The `tool` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / tools

Added value: +{
+  "description": "The `tools` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / tools_scored

Added value: +{
+  "description": "The `tools_scored` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / tools_skipped

Added value: +{
+  "description": "The `tools_skipped` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / tools_supplied

Added value: +{
+  "description": "The `tools_supplied` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / tools_usable

Added value: +{
+  "description": "The `tools_usable` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / tools_with_permissions

Added value: +{
+  "description": "The `tools_with_permissions` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / verdict

Added value: +{
+  "description": "The decision this tool returned.",
+  "type": "string"
+}

addedOutput schema / properties / verdictLevel

Added value: +{
+  "description": "The `verdictLevel` field of the response.",
+  "type": "object"
+}

addedOutput schema / properties / verificationHint

Added value: +{
+  "description": "The `verificationHint` field of the response.",
+  "type": "object"
+}

addedOutput schema / required

Added value: +[
+  "detail",
+  "verdict"
+]

AddedOct 31, 2026

TDQS

A3.5/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish read-only, idempotent, non-destructive, closed-world behavior. The description adds the $0.25 USDC cost, which is useful, but its output-field note is redundant with the output schema and it says nothing about auth, rate limits, or deeper behavioral constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is short and includes key routing and cost information, but the structure is fragmented: sentence fragments and semicolons make it read awkwardly. The output-field detail is also wasted because an output schema exists.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers purpose, one key alternative, cost, and a hint of output shape, while annotations and the output schema cover safety and returns. However, it remains cryptic about what permission assessment entails and does not compensate for the generic schema descriptions of manifest and ownership_proof.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description does not mention manifest or ownership_proof at all, so it adds no parameter meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description identifies the resource as a "Tool Permission Threatmodel" and explicitly distinguishes it from assess_dependency_risk. The verb is implicit rather than stated, but an agent can infer it assesses permission-related risk rather than dependency risk.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit alternative: use this rather than assess_dependency_risk for permission, not dependency risk. It does not cover other sibling tools or broader when/when-not conditions, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Synthex Forge — x402 Paid Agent Services tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.