Function Calling and Typed Action Contracts

The call was valid JSON. The schema accepted it. The argument was an ordinary path string. It read files it was never meant to reach.

The server was @modelcontextprotocol/server-filesystem, the official Model Context Protocol reference filesystem server. The flaw is CVE-2025-53110, published 2 July 2025 and rated High at CVSS v4 7.3. Elad Beber of Cymulate reported it. The advisory title names the mechanism exactly: “Path validation bypass via colliding path prefix”.

The defect was not in the schema and not in the model. The server's directory-containment check compared path strings by prefix. A well-formed path that merely shared a prefix with an allowed directory passed validation. It then reached files it was never meant to touch. The record states it in one sentence: “Versions of Filesystem prior to 0.6.4 or 2025.7.01 could allow access to unintended files in cases where the prefix matches an allowed directory.”

Note what was present here rather than what was missing. There was a boundary. It ran on every call. It compared the argument against the allowed directories and returned a verdict. What it could not do was decide which resource the string actually designated. That is the check nobody had written.

The type system underneath is ordinary and old. JSON Schema is a declarative language for describing the structure and constraints of JSON data. Its current release is 2020-12. Anthropic's API defines a tool as a name, a description and an input_schema, and that schema is a JSON Schema object. So a validator can reject a malformed call. It cannot tell you the call was meant. A syntactically valid path and the path this caller was entitled to reach are two different checks. Only one of them is automatic.

How much room does the model get? A free-form instruction gives it all of it. A typed tool call narrows it. A deterministic API client leaves almost none. Narrower is not always better, and the cost of narrowing has been measured.

Tightening the output format costs accuracy on the reasoning itself. A 2024 study scored GSM8K exact-match under progressively tighter output formats. Adding an explicit JSON schema to JSON output cut claude-3-haiku from 86.99 to 23.44. It cut gpt-3.5-turbo from 74.70 to 49.25. In the zero-shot results, gpt-3.5-turbo fell from 76.6 in plain text to 49.3 in JSON.

The mechanism is worth more than the numbers, because it is a mechanism a schema author controls. Tam and colleagues went and looked at what the JSON answers contained: “Upon inspection, we found that 100% of GPT 3.5 Turbo JSON-mode responses placed the "answer" key before the "reason" key, resulting in zero-shot direct answering instead of zero-shot chain-of-thought reasoning.” The contract did not merely describe the output. By putting one field ahead of another it removed the step the field was meant to record.

So judge each option by whether invalid or ambiguous arguments are rejected before side effects. Then hold the three shapes apart. Free-form instruction: the model describes an action in natural language — flexible wording, ambiguous parsing, a poor enforcement boundary. Typed tool call: the model selects a declared function and fields — machine-readable, supports validation, values can still be wrong. Deterministic API client: code constructs the request without model choice — strongest control, best for known transitions, no semantic selection, and no way to handle a request nobody anticipated. A schema the model satisfies can still describe the wrong action. And as the GSM8K figures show, the schema itself is part of what the model is answering.

Function calling constrains the shape of a model proposal: tool name, arguments, and expected fields. It does not prove that the proposed values are correct, authorized, current, or semantically appropriate. That is not this course's reading of the technology. It is what all three major model APIs say about themselves, in their own developer documentation.

Anthropic's tool-use documentation describes what Claude hands back: “It then returns a structured call that your application executes (client tools) or that Anthropic executes (server tools).” Google's Gemini documentation gives the execution step its own heading, “Execute Function Code (Your Responsibility)”. Underneath it, the division is spelled out: “The model doesn't execute the function itself. Extract the name and args and execute in your application.” OpenAI's function-calling guide makes step three of its five-step flow “Execute code on the application side with input from the tool call”. It states the obligation directly: “When the model calls a function, you must execute it and return the result.”

Three vendors, three documents, one boundary. The model proposes and the application acts. The schema is about shape. Everything about meaning is still yours. The application remains responsible for identity resolution, validation, authorization, execution, and confirmation. In plain terms: work out which record the name refers to — the step that failed in CVE-2025-53110 — check the values, decide whether this user may do it, run it, and tell the user what happened.

A tool declaration invites a model proposal. Runtime validation stands between that proposal and execution. All four stages are worth tracing separately. Execution and the result envelope need separate owners and separate tests.

The tool declaration is a name, purpose, input schema, and behavior visible to the model. The model proposal is a structured request selecting a tool and arguments. Runtime validation checks type, identity, policy, state, and authority — five distinct questions. The prefix comparison in @modelcontextprotocol/server-filesystem attempted one of them, and answered it with a string test. Execution is a trusted component performing the permitted operation. The result envelope returns status, data, provenance, and recoverability.

The envelope is the last stage and the one most often left thin. It is also the only one the model reads. It is what comes back into the context after the side effect has happened. Whatever it omits is invisible to every subsequent turn: an operation that half-succeeded, a record version that moved, an error class that distinguishes retry from stop. What the envelope leaves out is what the model cannot react to.

One function boundary is enough for this exercise. Pick the tool whose arguments could send money, mail, or a deletion to the wrong place — something that already causes a real side effect — and redesign its contract.

A public benchmark has already collected the failure you are looking for. The Berkeley Function-Calling Leaderboard is built from 2,000 question-function-answer pairs: 1,680 Python, plus 100 Java, 50 JavaScript, 70 REST API and 100 SQL. One documented failure mode is a unit error. GPT-4 emitted annual_interest_rate: 5 for “an annual interest rate of 5%”, where the schema's number field wanted 0.05. The field is numeric, the type check passes, the call is accepted. The loan is not the loan the user asked for. The leaderboard's own summary of the class: “GPT underperforms in scenarios where the parameters are not immediately available in the user question but instead require some implicit conversions.”

The same benchmark scores the call a model should decline to make. Its function-relevance-detection category — 875 irrelevance-detection entries in the BFCL V2 Live set — tests whether a model withholds a call when no supplied function fits. Withholding is a measurable behaviour, not a matter of tone. Make it one of the behaviours you test.

Work through five moves. Name the action precisely, with a verb that reflects the actual side effect. Constrain arguments: prefer enums, stable identifiers, limits, and explicit units. The unit is the whole of the annual_interest_rate mistake. Separate proposal and commit, so the model stages a request before an approved execution step. Return structured results carrying status, resource version, error class, and verification handle. Test ambiguous values: names, time zones, currencies, duplicates, and stale identifiers.

You are finished when you can show two calls from that redesign. One that passes validation and still asks for the wrong thing. One that the boundary refuses before anything irreversible happens.

Treat every model-generated tool call as untrusted input to a privileged component. This mental model keeps validation and authorization in the correct layer. There is a numbered, vendor-acknowledged case for it.

Injected text could make M365 Copilot disclose information to an unauthorized attacker over a network. Microsoft published the flaw on 11 June 2025 as CVE-2025-32711, “M365 Copilot Information Disclosure Vulnerability”; researchers named it EchoLeak. Microsoft rated it Critical, with a CVSS 3.1 base score of 9.3, and classified it CWE-74: injection into a downstream component. The record's own description reads: “Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.” NIST's NVD assessed the same vulnerability independently and scored it 7.5 High. Microsoft states that the service-side fix was already fully deployed, with no customer action required.

CWE-74 is the argument compressed into a classification code. The category exists for exactly this shape: content that arrives as data is handed onward to a component that treats it as instruction. A model's tool call is that content. It is generated text, shaped by whatever entered the context, arriving at a component with privileges the text's author does not have.

This also sets the standard for every later schema change, because schema validity can produce false confidence. A well-formed call is only well-formed. The boundary still has to decide whether this caller is allowed to do this thing to this record.