# Tool Schemas Scope Boundary Audit

> Tool Schemas Scope Boundary Audit is a paid API for AI agents from www.mahastrategies.com, paid per call via x402, $0.038304/call, status unknown (last checked 2026-10-20).

Validates tool-schema declarations by comparing owner, revision, scope, and allowed target boundaries to detect mismatches or authorization overreach.

## Facts

- Endpoint: POST https://www.mahastrategies.com/api/v1/verify/tool-schemas/scope-boundary-audit?utm_source=zero.xyz
- Price: $0.038304/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-20
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/tool-schemas-scope-boundary-audit-83f2afe2
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Oa7VVq-b-_b5oB83jahHl

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability tool-schemas-scope-boundary-audit-83f2afe2 -d '<json body>'
```

Example prompt: Audit the scope boundary for tool schema owner 'org:acme', revision 'v2.1', scope 'payments:write', with allowed targets ['https://api.acme.com/charge', 'https://api.acme.com/refund'] against our two declared contracts — data class is synthetic and this is nonpersonal metadata only.

## When to prefer this

Choose this endpoint when you need to formally audit whether a tool schema's declared scope and allowed targets are consistent with its owner and revision references, particularly in agentic or multi-tool environments where scope overreach is a governance concern. It is specifically designed for typed, nonpersonal, offline metadata validation — not for runtime authorization enforcement or personal data processing. Prefer this over generic schema validators when HTTP path boundaries, transport-level target declarations, and contract-level scope alignment are all required in a single audit pass.

## Known failure modes

- Missing required ownerRef or scopeRef causes validation rejection
- Contracts array below minItems:1 or above maxItems:32 triggers schema error
- nonpersonalMetadata not set to true (const) causes request rejection
- Invalid dataClass value outside 'public' or 'synthetic' enum fails validation
- Malformed revision string may cause comparison to fail
- allowedTargets array exceeding 32 items is rejected
- Payment authorization failure via x402 protocol blocks access

## How this service works

Compare tool-schema declaration owner, revision, scope and allowed target declarations exactly. HTTP paths include method and segment boundaries; tool targets include transport. Labels grant no authorization. Offline typed nonpersonal metadata only. Result retention: 24 hours; minimal receipt metadata: 90 days.

## Output

Returns a structured audit report comparing the declared tool schema's owner reference, revision, scope reference, and allowed target declarations against the supplied contracts. Highlights any boundary violations, mismatched HTTP method/segment declarations, transport-level target discrepancies, and scope overreach. Result is available for 24 hours; minimal receipt metadata is retained for 90 days.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "ownerRef": {
   "type": "string"
  },
  "revision": {
   "type": "string"
  },
  "scopeRef": {
   "type": "string"
  },
  "contracts": {
   "type": "array",
   "maxItems": 32,
   "minItems": 1
  },
  "dataClass": {
   "enum": [
    "public",
    "synthetic"
   ],
   "type": "string"
  },
  "allowedTargets": {
   "type": "array",
   "maxItems": 32,
   "minItems": 1
  },
  "nonpersonalMetadata": {
   "type": "boolean",
   "const": true
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/tool-schemas-scope-boundary-audit-83f2afe2/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from www.mahastrategies.com](https://www.zero.xyz/host/www.mahastrategies.com/llms.txt)