Diagrams · Fig. 11

Blast radius

To an agent, a search and an irreversible delete are both just "a tool call" until something labels them.

Blast radiusTwo tool calls look identical to an agent. Running each through the deterministic blast-radius classifier separates them: search_docs is a read that touches documents, has no reversal question and stays local, so its autonomy ceiling is autonomous. delete_repo is a delete that touches a repository, is not reversible and stays local, so its ceiling is ask a human. The grade is read from the tool declared contract and does not run the tool. Ambiguous contracts grade toward the more dangerous class, never down. It is advisory: mcpindex labels the blast radius and your agent or IDE decides.TO YOUR AGENT, BOTH OF THESE ARE JUST “A TOOL CALL”search_docs(query)delete_repo(name)ACTIONreaddeleteTOUCHESdocumentsa repositoryREVERSIBLEnothing to undonot reversibleEGRESSstays on this machinestays on this machineAUTONOMY CEILINGautonomousask a humanDeterministic and static, read from the tool’s own declared contract — it does not run the tool.Ambiguous contracts grade toward the more dangerous class, never down. Advisory: mcpindexlabels the blast radius, your agent or IDE decides.
Fig. 11 · To an agent, a search and an irreversible delete are both just "a tool call" until something labels them.
Read Fig. 11 as text
  to your agent, both of these are just "a tool call":

    search_docs(query)                      delete_repo(name)
          |                                       |
   ACTION | read                           delete |
  TOUCHES | documents                      a repo |
  REVERSE | n/a                     not reversible|
   EGRESS | stays local                stays local|
          v                                       v
   CEILING  autonomous                    ask a human

  deterministic and static, read from the tool's own declared contract.
  it does not run the tool. ambiguous contracts grade toward the more
  dangerous class, never down. advisory: mcpindex labels the blast radius,
  your agent or IDE decides.
What the figure says

Two tool calls look identical to an agent. Running each through the deterministic blast-radius classifier separates them: search_docs is a read that touches documents, has no reversal question and stays local, so its autonomy ceiling is autonomous. delete_repo is a delete that touches a repository, is not reversible and stays local, so its ceiling is ask a human. The grade is read from the tool declared contract and does not run the tool. Ambiguous contracts grade toward the more dangerous class, never down. It is advisory: mcpindex labels the blast radius and your agent or IDE decides.

Where this is explained
/scan
Use this diagram

Licensed CC BY 4.0. Use it anywhere, including commercially. Keep the credit.

Credit line (HTML)

Paste under the figure. That is the whole licence obligation.

<a href="https://mcpindex.ai/diagrams/blast-radius">Blast radius - mcpindex.ai</a> (CC BY 4.0)
Direct SVG

Standalone image/svg+xml. Vector, editable, no stylesheet needed.

https://mcpindex.ai/diagrams/blast-radius/svg

Last reviewed 2026-07-27 · derived live from well-known:blast_radius.fields · never hand-typed

Questions this answers

mcp blast radius &middot; mcp tool autonomy &middot; agent tool approval &middot; mcp destructive tool detection