Use the latest 0.4.x release for new installs. Older 0.2.x / 0.3.x lines receive security fixes only until they are retired in a future notice.

Treat MCP metadata, tool descriptions, outputs, and generated probes as untrusted input.

Tool-Semantics must not automatically execute discovered tools during capture or probe evaluation.

Please report security issues privately via GitHub Security Advisories. Do not open a public issue for vulnerabilities that could enable remote code execution, secret leakage, or unsafe tool invocation.

We aim to acknowledge reports within 7 days.

Tool contracts may declare optional safety fields: risk, scope (resource…global), side_effects, and requires_confirmation. Capture only records values present in manifests or MCP annotations — Tool-Semantics never invents side effects or scopes. Treating missing fields as unknown / empty is intentional; do not assume a tool is safe because annotations are absent.

Diffing escalations (tool.scope_escalated, tool.side_effect_added, tool.confirmation_removed) can fail CI at breaking/critical severity. See docs/change-codes.md and docs/safety.md.