Where do documented agent tools require evidence?

The market is wiring AI agents into systems that move money, change permissions, and delete production. This report measures a narrower question: does the documented tool surface declare a required receipt input for a detected high-risk action?

We ran the fire drill across 43,801 servers in the public MCP registry. At least 10% advertise a high-risk capability — and in a tool-level sample, 90% omit a required receipt declaration on at least one detected dangerous tool.

Two lenses, both honest. Registry-wide (43,801 servers): a scan of each server's advertised name + description — a conservative floor, since most servers don't name a dangerous verb in their blurb. Tool-level (10-server sample, 14 missing declarations, mean static score 10/100): the deeper look at documented schemas. Neither is a live deployment scan, a vulnerability claim, or evidence that declared controls are enforced. Run npx @emilia-protocol/fire-drill on your stack to add a data point.

What the fire drill measures.

For each operation in an MCP manifest, OpenAPI spec, or tool list, the scanner classifies it into a high-risk family and checks whether a dangerous one structurally declares a required receipt input. The score is the share of detected dangerous operations with that declaration. EG-1 is not assessed by this report.

Static assessment from the manifest/spec. A complete declaration result is a review prerequisite only; runtime verification, trust anchoring, and replay consumption require EG-1 conformance.