Typed tool contracts: validate inputs without assuming atomic execution

Specify a schema dialect and version, required fields, types, bounds, and treatment of unknown properties. JSON Schema 2020-12 provides structural validation vocabularies; implementations must configure the relevant features. Its format vocabulary can be annotation rather than an automatically enforced semantic assertion. A string passing a URI or date-related check is not proof that the endpoint exists or the date is applicable. Runtime type checks and generated language types also need agreement on numeric range, nullability, and serialization.

Domain validation adds meaning: an integer quantity may be structurally valid but exceed the remaining stock, refer to another tenant, or use the wrong unit. Resolve authenticated identity and resource ownership from trusted state, not model-provided claims. Check approval and budget requirements separately. Model Context Protocol's versioned tools specification describes schemas and result structures, but those do not replace an application's authorization or effect protocol. Tool annotations or descriptions supplied by an untrusted party are not independent proof of behavior.

A tool wrapper should distinguish rejection before execution, a known committed result, a partial effect, and an unknown outcome. A remote write may succeed while response serialization, output-schema validation, or network delivery fails. Do not map every exception to no effect. Preserve external operation identity, receipt, resource version, and completed suboperations when available. A multi-operation tool can expose partial completion explicitly or be decomposed into smaller journaled effects, with the resulting coordination overhead acknowledged.

Validate returned data before downstream reasoning trusts its structure, but retain evidence even if the expected result shape is broken. A syntactically valid success payload can still describe an incorrect or unauthorized result, requiring domain and permission checks appropriate to the consumer. MCP distinguishes protocol-level and tool-execution errors under its specified semantics; neither automatically grants transaction rollback. The runtime should reconcile an uncertain effect or retry under a valid idempotency contract, rather than infer safety from an error field.

Use malformed arguments, structurally valid but invalid-domain requests, missing scope, expired approval, budget exhaustion, malformed success results, and a crash after the external commit. Verify which checks prevent dispatch and which occur afterward. Keep contract and tool implementation versions in the trace so a replay does not validate old results against an unrelated new schema silently. Test that rejected requests cause no external call under the wrapper's actual implementation, and that post-dispatch uncertainty remains visible to recovery.

The probability lab is only a hypothetical acceptance-count model. Reset, set p=0.80 and n=10, predict eight accepted examples on average, then Play or Step. Separately Reset, set p=0.50 and n=10, predict five, then Play or Step. Its independent trials do not validate schemas, enforce permissions, or model partial writes. Real validation stages can be correlated and deterministic for a given input. Use the expected counts only to practice distinguishing a pass rate from the concrete dispatch and effect outcomes in a labeled test suite.