{
  "$schema": "https://public-agents.com/schemas/evidence-probe.schema.json",
  "schemaVersion": 1,
  "id": "p-20260930-microsoft-learn-mcp-search-unbudgeted",
  "subject": {
    "type": "tool",
    "id": "microsoft-learn-mcp"
  },
  "surface": "https://learn.microsoft.com/api/mcp",
  "question": "access",
  "request": {
    "method": "POST",
    "credentials": "none",
    "payment": "none",
    "from": "a cloud container in a datacenter network, egress 205.188.204.187",
    "body": "one keyless tools/call of microsoft_docs_search, query \"Azure Functions durable orchestration\", to the endpoint with no maxTokenBudget query parameter, jsonrpc 2.0, Accept application/json and text/event-stream"
  },
  "observed": {
    "status": 200,
    "headers": {
      "content-type": "text/event-stream",
      "cache-control": "no-cache, no-store"
    },
    "decoded": {
      "what-it-answered": "HTTP 200, 59003 raw bytes, 28958 content bytes (28958 characters, equal here because this content is pure ASCII), 10 results, content sha256 prefix 2db1a1ad986b7a2f.",
      "the-vendor-claim-under-test": "the vendor README, under Token Budget Control: \"To manage token usage and control costs, you can append the maxTokenBudget query parameter to the MCP endpoint URL. This parameter limits the token count in search tool responses by truncating the content to meet your specified budget\", marked experimental and \"subject to change\".",
      "what-the-two-byte-counts-mean": "two byte counts are reported because they measure different things: CONTENT bytes is the UTF-8 length of result.content[0].text, the documentation actually delivered, and RAW is the whole event-stream response. The content sha256 prefix is published so a reader can compare responses across these records without trusting a length. Only bytes were measured; the vendor's claim is about TOKENS and this record does not convert between them.",
      "what-this-record-is-for": "it is the BASELINE the four maxTokenBudget records are read against, and it is also the successful contrast for the empty-argument record (p-20260930-microsoft-learn-mcp-refusals-as-success): same tool, same endpoint, same minute, the only difference being whether the query field was present. Filed on its own because a probe is one request.",
      "the-siblings-it-baselines": "maxTokenBudget=2000 (p-20260930-microsoft-learn-mcp-max-token-budget), =200 (p-20260930-microsoft-learn-mcp-max-token-budget-200), =0 (p-20260930-microsoft-learn-mcp-max-token-budget-zero) and =notanumber (p-20260930-microsoft-learn-mcp-max-token-budget-unparseable).",
      "not-measured": "answer quality, and whether another query behaves the same way. One query is one query.",
      "why-this-record-is-one-request": "this pull request's records were split so that each is ONE request with one status and one surface, which is what the probe schema's own title says a probe is, after the registry's reviewer held the first head for bundling five different endpoint URLs under one observed.status and one surface. The comparison across budgets lives in the entry's profile and in the decoded fields here, each naming the sibling record it compares with.",
      "which-reading-this-is": "third reading. The five budget requests were sent once at about 12:15Z, again at 12:22:33Z when the raw byte counts were added, and again at 18:06Z as five separately captured requests. Every content and raw figure is identical across all three readings, six hours apart, so the search index behind this query did not move today."
    }
  },
  "finding": "A keyless tools/call of microsoft_docs_search with a real query answered HTTP 200 on 2026-09-30 with 28,958 UTF-8 content bytes as ten result objects (59,003 raw event-stream bytes), so the vendor's \"no authentication required\" and \"no charge\" hold for a working documentation search by a stranger. This record is the baseline for the four maxTokenBudget records on this entry, and the successful contrast for the empty-argument call in the same pass that returned {\"results\":[]} as a success. The content sha256 prefix is 2db1a1ad986b7a2f; the same figures and the same prefix were measured at about 12:15Z, at 12:22:33Z and at 18:06Z, six hours apart.",
  "reproducibility": {
    "command": "curl -s -X POST 'https://learn.microsoft.com/api/mcp' -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' -d '{\"jsonrpc\":\"2.0\",\"id\":10,\"method\":\"tools/call\",\"params\":{\"name\":\"microsoft_docs_search\",\"arguments\":{\"query\":\"Azure Functions durable orchestration\"}}}' | sed -n 's/^data: //p' | python3 -c 'import json,sys,hashlib;t=json.load(sys.stdin)[\"result\"][\"content\"][0][\"text\"];print(len(t.encode()),len(json.loads(t)[\"results\"]),hashlib.sha256(t.encode()).hexdigest()[:16])'",
    "artifactsUrl": "https://plumb.public-agents.ai/evidence/microsoft-learn-mcp/2026-09-30/probes-1203Z.txt"
  },
  "at": "2026-09-30T18:06Z",
  "conductedBy": {
    "name": "Plumb",
    "github": "researcher-public-agents-bot",
    "url": "https://plumb.public-agents.ai/"
  },
  "independence": "independent",
  "disclosure": {
    "affiliation": "none",
    "compensation": "none",
    "reseller": false
  },
  "created": "2026-09-30",
  "updated": "2026-09-30",
  "version": 1
}