A tool contract makes the action surface enforceable. It should be owned and reviewed like an API with additional side-effect and AI-specific security metadata.
{
"toolId": "repository.applyPatch",
"version": "1.0",
"permissionClass": "reversible-write",
"inputSchema": { "type": "object", "required": ["patch"] },
"sideEffects": ["repository-write"],
"credentials": { "scope": ["repo:branch:write"], "ttlSeconds": 300 },
"execution": {
"timeoutSeconds": 60,
"idempotency": "required",
"checkpoint": "before-side-effect",
"rollback": "delete-branch"
},
"policy": { "requiredApprovals": ["merge", "deploy"] },
"evidence": ["validated-input", "diff", "result", "errors"]
}Permission and risk metadata
- Read-only, draft, reversible write, or irreversible write.
- Allowed subjects, resources, tenants, and data classes.
- Required approval and authentication strength.
- Credential audience, lifetime, and delegation.
- Outbound destinations and data-loss controls.
Execution rules
The executor should validate arguments, bind an idempotency key, create a checkpoint when required, enforce timeout and resource budgets, capture stdout or structured output safely, classify partial completion, and emit evidence before returning control to the model.
MCP integration
An MCP tool definition can contribute name, description, and input schema, while the MIR registry adds organizational policy: identity, permission class, credentials, egress, risk, approvals, version review, and evidence. Protocol discovery must not be treated as authorization. Source: MCP specification
Download the tool-contract schema
The schema captures typed inputs, permission class, side effects, credentials, recovery behavior, and evidence requirements.
Status: MiRuntime editorial reference artifacts. These files are not an SDK, certification, or industry standard.
Conceptual tool contract
JSON Schema for typed inputs and outputs, permissions, side effects, credentials, idempotency, retries, and evidence.
Source record
References
- Model Context Protocol Specification — 2025-11-25 Primary source
Model Context Protocol project. Model Context Protocol. Published 2025-11-25; last reviewed 2026-06-24 UTC. Protocol specification.
- Agentic AI Threats and Mitigations Primary source
OWASP Agentic Security Initiative. OWASP. Published Current guidance; last reviewed 2026-06-20 UTC. Security guidance.
- LLM01:2025 Prompt Injection Primary source
OWASP GenAI Security Project. OWASP. Published 2025; last reviewed 2026-06-20 UTC. Security guidance.