August 2026 · PRIVI research
Tools that say what they change
4,445 tools. 199 assessed repositories. Just 103 stated whether they change state.
When this was measured
Session 4 corpus measurement, frozen aggregate computed 6 August 2026 at 20:13 EDT (7 August, 00:13 UTC). This is an aggregate timestamp, not a new scan.
Historical result, not current accuracy. Note written 1 November 2026.
An agent can choose a tool from its description. That makes a fairly ordinary question important: does the description say whether the tool changes anything? Reading a record, sending a message and deleting a file are different kinds of authority. A useful declaration should give a reviewer something concrete to compare with the implementation.
In the historical PRIVI research corpus, 4,445 tools were observed across 199 assessed public agent repositories. Of those tools, 103, or 2.3%, stated anything about whether they changed state. The selection frame contained 200 repositories; one failed to scan. A failed scan was not silently counted as a repository with no tools.
The frame was committed before measurement, and the repositories were fetched at pinned commits. This was static analysis of a selected corpus. Nothing in those repositories was executed. The result describes what the instruments could observe in that sample at that time. It does not describe every agent tool, and it does not show what those tools actually did during a live run.
The small declaration count matters more to me than an apparently reassuring second number. Among 100 tools whose claims could be checked against their implementations, the analysis found zero contradictions. That is a result about a small, checkable subset. It cannot establish that the thousands of undeclared tools were safe, read-only or correctly described. Silence is not a permission boundary.
One detail in the method is worth keeping: an HTTP POST was not automatically counted as a write. Search, inference and other retrieval-oriented operations can use POST without the state change the study was looking for. Treating a transport verb as a declaration of authority would have answered an easier question and inflated the finding.
The aggregate was frozen in August 2026. I keep it as a research record, with PRIVI retired as a product. The practical lesson is modest: before comparing what an agent is allowed to do with what its code does, check that the first half of the comparison exists. A missing declaration is not evidence of misconduct. It is a missing piece of the argument, and a reason to ask a more precise question before relying on the system.