The six checks
- Connection: can you connect as yourself, with consent recorded and revocable.
- Discovery: what exactly is advertised, and how is that list kept honest.
- Authorization: does a low-privilege account get refused on a restricted action.
- Confirmation: does a destructive or outbound action return a preview first.
- Execution: does the action leave a record you can open in the normal interface.
- Evidence: does an audit entry name the actor and the authorizing person.
Questions that produce specific answers
- Which advertised tools have deployed handlers today?
- How is the organization determined for a tool call?
- Which action categories require a second confirmed call?
- What happens when the same mutation is sent twice?
- Where do I read the audit record without asking support?
Red flags
- A live endpoint offered as proof of capability.
- A single shared credential for the whole company.
- Confirmation described as a setting rather than a protocol step.
- Verification that requires the vendor to look at logs for you.
- Claims of full parity with a human operator.