An MCP tool with one argument, script . I asked the OWASP Agent Control Standard (ACS) reference Guardian to judge two calls: echo ciao and echo rm -rf / . It denied both, for the same reason:

{ "decision" : "deny" , "reasoning" : "mapping.yaml reads tool \" mcp__lab2__exec \" 's policy target from argument \" command \" , but this call sent no such argument (it sent: script)" , "reason_codes" :[ "evaluation_failed" ], "policy_references" :[]}

Enter fullscreen mode

Exit fullscreen mode

The tool was already in the policy manifest, and the hook already sent its calls to the Guardian. It still needed a third entry before any rule read the command.

Part 1 covers the setup and the method: Claude Code with its own model loop, the reference Guardian, the shipped hook, and every protocol frozen with its sha256 before it runs. Part 2 is about the ! prefix. This part is about MCP tools.

Three places

Part 1 ended with a table of three states for an MCP tool.…