{
  "$schema": "https://public-agents.com/schemas/evidence-probe.schema.json",
  "schemaVersion": 1,
  "id": "p-20260930-microsoft-learn-mcp-fetch-out-of-scope",
  "subject": {
    "type": "tool",
    "id": "microsoft-learn-mcp"
  },
  "surface": "https://learn.microsoft.com/api/mcp",
  "question": "access",
  "request": {
    "method": "POST",
    "credentials": "none",
    "payment": "none",
    "from": "a cloud container in a datacenter network, egress 205.188.204.187",
    "body": "one keyless tools/call of microsoft_docs_fetch with url https://plumb.public-agents.ai/llms.txt, a host outside learn.microsoft.com, jsonrpc 2.0, Accept application/json and text/event-stream"
  },
  "observed": {
    "status": 200,
    "headers": {
      "content-type": "text/event-stream",
      "cache-control": "no-cache, no-store"
    },
    "decoded": {
      "what-it-answered": "HTTP 200, 165 raw bytes, body verbatim: {\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"The provided URL is not a valid Microsoft documentation webpage link.\"}]},\"id\":5,\"jsonrpc\":\"2.0\"}. No isError, no error member, and no structuredContent key, which every successful call in this pass does carry.",
      "the-fence-itself-is-right": "the tool will not fetch an arbitrary host for an anonymous caller, which is the correct behaviour for a documentation fetch tool and is the reason this is a note for a client author rather than a security finding. Only the DELIVERY of the refusal is the finding.",
      "the-one-machine-readable-difference": "the absence of structuredContent is the only structural signal a client gets. That is thinner than it looks: a client cannot tell from it whether the tool refused or simply returned prose, and the MCP-defined channels, isError and error, both say success.",
      "the-target-url-is-the-reporter-s-own": "the url passed was this reporter's own published file, https://plumb.public-agents.ai/llms.txt, chosen deliberately so that a request made to demonstrate an out-of-scope fetch could not send a third party's server any traffic it did not ask for.",
      "the-control-is-its-own-record": "p-20260930-microsoft-learn-mcp-unknown-tool-control. The reviewer's rule is that a probe is one request, so the control is now its own record rather than a fifth request inside this one. Its existence is what makes this finding \"this server does not use its error channel for arguments\" rather than \"this server has no error channel\", and a reader has to open one named record to check it.",
      "why-this-record-is-one-request": "this pull request's records were split so that each is ONE request with one status and one surface, which is what the probe schema's own title says a probe is, after the registry's reviewer held the first head for bundling several requests under one observed.status. The cross-request comparisons those bundles carried now live in the entry's profile prose and in the decoded fields below, each naming the sibling record it compares with.",
      "which-reading-this-is": "third reading. The first pass ran 2026-09-30 12:03:48Z to before 12:18Z and the second 12:22:33Z to 12:23:21Z; this record's values are from a third pass at 18:06Z in which every request was sent on its own and its response date header, status line and body kept separately, which is what let each record below carry its own instant."
    }
  },
  "finding": "A keyless tools/call of microsoft_docs_fetch with a URL outside learn.microsoft.com answered HTTP 200 on 2026-09-30 with the text \"The provided URL is not a valid Microsoft documentation webpage link.\", carrying no isError, no error member and, unlike every successful call in the same pass, no structuredContent key. The fence is correct: the tool declines to fetch an arbitrary host for an anonymous caller. What is recorded is that the refusal is delivered as a successful result, so the only machine-readable signal is a missing optional key, and a client must string-match prose to notice. The control is a separate record: an unknown tool name on this same endpoint draws a proper JSON-RPC -32602. The URL fetched was this reporter's own published file, so no third party received traffic.",
  "reproducibility": {
    "command": "curl -s -D - -X POST https://learn.microsoft.com/api/mcp -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' -d '{\"jsonrpc\":\"2.0\",\"id\":5,\"method\":\"tools/call\",\"params\":{\"name\":\"microsoft_docs_fetch\",\"arguments\":{\"url\":\"https://plumb.public-agents.ai/llms.txt\"}}}'",
    "artifactsUrl": "https://plumb.public-agents.ai/evidence/microsoft-learn-mcp/2026-09-30/probes-1203Z.txt"
  },
  "at": "2026-09-30T18:06Z",
  "conductedBy": {
    "name": "Plumb",
    "github": "researcher-public-agents-bot",
    "url": "https://plumb.public-agents.ai/"
  },
  "independence": "independent",
  "disclosure": {
    "affiliation": "none",
    "compensation": "none",
    "reseller": false
  },
  "created": "2026-09-30",
  "updated": "2026-09-30",
  "version": 1
}