When Tool Calls Succeed but Workflows Fail: Anomalies at the Agent–Tool Boundary

Atomix is classified as partially covering A1 and A3, covering compensation-safe A4 and speculation-safe A5-A6, and partially covering externally mediated A7; its known-outcome path assumes idempotence, it lacks crash-safe exactly-once behavior, and it has an A2 gap for multi-effect release.

None of the eight boundary capabilities required by the anomaly catalog is fully expressible in current standard MCP tool annotations: A1 has only a limited idempotence hint, A7 exposes externality only, and A2-A6 and A8 have no corresponding expression.

Shepherd supplies per-effect reversibility tiers and observed A7 in a supervisor use case, but is described as a meta-agent substrate rather than a runtime guarantee; irreversible effects are logged.

CoAgent is classified as partially covering externally mediated A7: reordering prevents some conflicts, registered inverses enable repair, and irreversible effects are gated, but this is an achievability condition rather than an unconditional guarantee.

Tool-level signatures over true, false, or omitted values for the four annotation fields were highly concentrated: 66 of 81 possible signatures occurred, the leading signature covered 39.9% of tools, no annotations was second at 26.0%, and the top three covered 75.8%.

Annotation differentiation within servers was common but coarse: among multi-tool servers emitting at least one field, 76.7% used more than one signature, while the median dominant signature accounted for 79.4% of an emitting server's tools.

RAC is classified as partially compensation-safe for A4, but it has no gating or idempotency and therefore does not address A1-A3.

Cordon is classified as partially covering A1 and A3, covering compensation-safe A4, and partially covering speculation-safe A5, conditional on idempotent tools and task-scoped staged effects.

The paper identifies four boundaries at which black-box tool invocation alone is argued to be insufficient for a general guarantee: ambiguous outcomes, irreversible non-commuting effects without mediation, open-world reactions, and atomic release of multiple irreversible effects across tools.

The catalog defines eight external-effect anomalies in three structurally motivated families: uncertainty (A1 duplicated, A2 missing, A3 orphaned), workflow (A4 residue, A5 premature, A6 contaminated), and interaction (A7 conflicting, A8 phantom).

ACRFence is classified as partially targeting unknown-safe execution for A1; the proposed attack was validated, but the system was not implemented.

Although destructiveHint was serialized on 65.8% of tools, only 12.9% of all tools carried an applicable destructive classification and only 3.1% asserted that the operation was destructive.

Across the six reviewed systems, coverage depends on runtime-owned declarations rather than a reusable shared contract; none controls exogenous reactions (A8), and no system covers the full anomaly catalog.

Standard MCP annotation fields were widely serialized, but a majority pairing made destructiveHint inapplicable because readOnlyHint was true, and the paper cautions that emitted values may come from defaults or templates rather than deliberate declarations.

The MCP census used a full official-registry snapshot from 2026-07-27, retained the latest version of each distinct server, anonymously queried tools/list on all remote targets, made no tool calls, and obtained 98,291 tools from the targets that returned at least one tool.