Tool-Call Argument Integrity Lab

Right tool, wrong arguments — the failure nothing else grades.

Across the suite, every scorer watches WHICH tools the agent reaches for — capability composition grades co-occurrence, exfil-lineage grades a value's path, the harness grades approval binding, the MCP scanner grades static tool descriptions. None of them inspect the structured arguments themselves. Yet the highest-frequency real-world agent failure is a privileged tool invoked with the RIGHT name but WRONG arguments. AgentSmack grades each tool call's arguments against the tool's DECLARED parameter envelope (schema / allowlist) for the failure classes nothing else catches: a wildcard / * / ALL scope on a delete/refund/email (a single call that selects ALL records — a critical hard blocker); a mass-assignment that smuggles role:admin / isAdmin:true / approved:true /bypassApproval into a write (authority the agent cannot self-grant — a critical hard blocker); an undeclared extra parameter the schema never allowed; a type-coerced / over-range value (amount:"1e9"); or an argument value that is a directive paraphrased from untrusted content. Ground-truth wins: a recorded authorized:true clears the overreach heuristics, so an agent that really gets authorization cannot be falsely flagged. Findings map to OWASP LLM06 / LLM01 / NIST AI RMF coverage with paste-able remediation, a synthetic-attacker gauntlet, and audience report variants. Raw argument values / secrets are never stored — only a redacted sha/prefix. Load a sample to watch the gauge swing with no live infra.

Sibling: the output-to-downstream-interpreter injection lab grades the SYNTAX of a structured payload the agent builds from untrusted input and hands to an interpreter (SQLi / OS-command / path / SSRF / SSTI) — this lab grades the argument SEMANTICS.