Current bid/ask for one symbol.

Open positions.

Cash, equity, exposure and day P&L.

The risk limits in force.

Readable on purpose: an agent that can see the limits can plan within them instead of discovering them by rejection. Readable is not writable -- there is no corresponding setter anywhere in the server.

Quotes plus headline text for the allowed symbols.

The headlines are the untrusted-content channel: this is where an injected instruction would arrive in a real deployment (news, filings, social). The tool is read-only by construction, so the worst an injection can do is persuade the model -- and the model cannot reach the order path except through rails that never read this text.

The most recent pre-trade decisions, from the audit log.

Submit an order. Subject to pre-trade risk limits.

By the time this body runs the middleware has already approved the order -- it is unreachable otherwise. The handler therefore uses the vetted intent from the middleware rather than re-parsing its own arguments, so there is no second interpretation of the agent's input that could differ from the one the rails checked.