UNIDROIT Principles 2016
by arxo.io · remote · local (npm) · no sign-in to list tools · v0.3.11 · published by io.arxo
UNIDROIT Principles 2016 as executable rules: closed questions answered with grounds and source text
20 tools: 1 can delete or cancel things, 2 do something that can't be undone, 14 change things and 3 only read.
Scanned Oct 21, 2026
- Deletes or cancels1Claude Code: deny: see these tools
- Can't be undone2Claude Code: ask: see these tools
- Changes things14Claude Code: ask: see these tools
- Only reads3Claude Code: allow: see these tools
5 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http picc https://mcp.arxo.io/mcp/piccFindings
Matches of fixed checks, with the text they matched.
The server marks "law_capture_answer" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "law_capture_answer" says "capture": a word that usually means money moves, which cannot be taken back.
- Warnlaw_ask
The server marks "law_ask" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The description's first verb is "put": a word for a change.
- Warnlaw_process_run
The server marks "law_process_run" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "law_process_run" says "run": a word for a change.
- Infolaw_packages
The description is 2,188 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...preview of these lists and names the count and the ready-made call for the mode."
- Infolaw_query
The description is 2,397 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...cution (QUERY_TOO_BROAD), a continuation on another snapshot as SNAPSHOT_CHANGED."
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
20 tools
Deletes or cancels 1Claude Code: deny
law_revoke_answerRevoke a published document using its separate secret.No findings
Why it is in this group
- The name "law_revoke_answer" says "revoke": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Revoke a published document using its separate secret. The public id alone grants no control; revocation closes the HTML page, the API and the download.
Annotations the server declares
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: false
- title: Revoke a write-up
Can't be undone 2Claude Code: ask
law_capture_answerRun a registered producer and obtain producerControl/0.2 for a later verifiable preparation of a Lens.1 finding
Why it is in this group
- The name "law_capture_answer" says "capture": a word that usually means money moves, which cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "law_capture_answer" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "law_capture_answer" says "capture": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it Run a registered producer and obtain producerControl/0.2 for a later verifiable preparation of a Lens. The producer is chosen only from the shipped registry.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: true
- title: Capture a result for a Lens
law_publish_answerPublish a prepared document.No findings
Why it is in this group
- The name "law_publish_answer" says "publish": a word for a change that another call does not undo.
Description, as the server wrote it Publish a prepared document. Repeating it with the same preparationId idempotently returns the same URL and the same separate revocation secret.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: false
- title: Publish a write-up
Changes things 14Claude Code: ask
law_answer_capabilitiesA machine-readable matrix of the Lens producers that are actually installed, of replay/projection checks, profiles, limits and the contract tests that confirm them.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it A machine-readable matrix of the Lens producers that are actually installed, of replay/projection checks, profiles, limits and the contract tests that confirm them. declared_only means a schema with no executable witness.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: true
- title: Lens capabilities
law_argueHow robust a conclusion is: the map of the dispute under the argumentation profile §274 (DECISION-0039).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it How robust a conclusion is: the map of the dispute under the argumentation profile §274 (DECISION-0039). The answer falls into four classes: SKEPTICALLY_ACCEPTED — the conclusion is invulnerable (it survives in the grounded extension); CREDULOUSLY_ACCEPTED — merely defensible (there is a position for it and a position against); REJECTED — it survives nowhere; NO_ARGUMENT — there are no arguments at all. It builds ALL arguments out of the facts and the rules of the instrument (chains that did not fire in ordinary inference included), the rebut/undermine/undercut attacks and the defeats by priority. Predicate names come from law_packages. On large instruments a refusal by cap is possible — narrow facts or raise limits.maxArguments.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: true
- title: Robustness of a conclusion
law_askPut a question to formalised law.1 finding
Why it is in this group
- The description's first verb is "put": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "law_ask" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The description's first verb is "put": a word for a change.
Description, as the server wrote it Put a question to formalised law. When the answer is "not established" it carries whyNot — the engine's why_not report §185: the candidate rules and the state of every conjunct (satisfied / not satisfied / undetermined); the missing facts are visible there and need not be guessed. BEFORE THE FIRST call obtain the predicate names through law_search (a question in your own words → addresses) or law_packages (the signatures of a known instrument) — an invented name will be rejected. If the tool returned an error or "not established", THAT IS THE ANSWER: pass it to the user and do not substitute general knowledge about the law of some other country. But "I found no suitable instrument" is NOT an answer until law_search has been asked: silence of the catalogue is a property of searching by title, not a conclusion about the corpus. kind='truth' — whether a fact is established (the answer follows §62: established / refuted / contradiction / not established); kind='collect' — enumerate the records; kind='deadline' — compute a time limit on the official calendar; kind='positions' — which DUTIES arose from the facts and what their statuses are (active / fulfilled / violated, §134–§138); kind='why_not' — the why_not report §185 on the same goal, whatever the status of the answer. The answer carries the rules applied, the warnings and the provenance with hashes; truth/collect also carry a signature block (parameter types, the closure of types, constants; DECISION-0139) for presentation. The server does not guess: where a norm is not formalised, the answer is "not established" or an error.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: true
- title: Ask the law
law_case_askThe ask operation §168.4 (DECISION-0165, DECISION-0399): run a registered case of a case package over its pinned dependencies and return the canonical evaluation document with a pr…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it The ask operation §168.4 (DECISION-0165, DECISION-0399): run a registered case of a case package over its pinned dependencies and return the canonical evaluation document with a proof and a manifest. The question is JSON per query.schema.json (query), an evaluate string (evaluate + queryId), a saved queryId without query, or card + args. A refusal to prepare is an error with an LDC-* code, never an empty answer.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: true
- title: Case package: ask
law_editionsThe axis of editions (O-2): what changed in an instrument between two dates of the law — the state of the editions, the dating of the norms and the semantic diff §215 between the D…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it The axis of editions (O-2): what changed in an instrument between two dates of the law — the state of the editions, the dating of the norms and the semantic diff §215 between the D1 projections. The verdict NOT_DATED means "there was nothing to date it by", not "nothing changed". The outcome of a particular question on a date comes from law_ask with legalTime.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: true
- title: Axis of editions
law_packagesThe catalogue of formalised law: instruments, predicates with signatures, the boundaries of coverage.1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Info
The description is 2,188 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...preview of these lists and names the count and the ready-made call for the mode."
Description, as the server wrote it The catalogue of formalised law: instruments, predicates with signatures, the boundaries of coverage. This is where the NAMES of predicates come from — they must never be guessed. But do NOT start from the catalogue when looking for the right instrument: the overview is large, and the title of an instrument rarely matches the words of a question ("Newton's laws of motion" contains no word "physics"). A question in your own words goes to law_search first, which returns addresses; the catalogue is for the exact signature of what you found. With no arguments — the overview: one line per instrument (key, title, legal order, counters of rules, facts, signatures, norms, constants); a whole instrument — package="kz-gpk"; a search over the signatures, labels and constants of every instrument — query="substring". All three modes are PAGED: limit and offset, with the remainder named in the text (`showing a–b of N; k more`) and in structuredContent (total, truncated, next — a ready-made continuation call). The unit of a page is named by pageUnit: the overview and query page over INSTRUMENTS (20 and 20 by default), package=… pages over the SIGNATURES of one instrument (20 by default, 300 at most) — large codes carry thousands. package=… together with catalog=… pages a separate list of the instrument: "questions" — the CATALOGUE OF QUESTIONS (DECISION-0190): which enquiries are provided for (a question in words, a form, a predicate or norms) and what the instrument does NOT answer, with the type of reason; a card is a template of an enquiry, not an answer, and not every instrument has one; "norms" — the NORMS of the instrument (modality §107 and label), "constants" — the CONSTANTS (names of declarations). "task-guides" — TASK GUIDES (DECISION-0414): the order of applying a canon to a document — what to gather, which cards to ask and how to read the answers; a guide answers nothing. catalog="task-guides" is allowed without package too — every guide of the profile; guide=… — the detail of one guide; the walkthrough — MCP Prompts under the same name. The detail of an instrument prints a preview of these lists and names the count and the ready-made call for the mode.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: true
- title: Catalogue of law
law_passportPassport of an exact release: purpose, interface, boundaries, checks and performance.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Passport of an exact release: purpose, interface, boundaries, checks and performance. The reports section holds the history of measurements, failures included. Entries are paged by JSON Pointer; next continues the answer.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: true
- title: Release passport
law_prepare_answerAt the explicit request of the user, repeat between 1 and 12 earlier law_ask or law_process_run calls (the course of a case, DECISION-0160), compare their replayControl strictly, a…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it At the explicit request of the user, repeat between 1 and 12 earlier law_ask or law_process_run calls (the course of a case, DECISION-0160), compare their replayControl strictly, and prepare a non-public frozen document for 24 hours. The client never supplies the machine answer: the server obtains it only by executing afresh. A divergence in any input, in the law, in a resource, in the server code, in the engine library or in the result rejects the document as a whole.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Prepare a public write-up
law_processWhich stages the procedure established by an instrument consists of, and whether it carries a structural defect (O-5, DECISION-0052).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Which stages the procedure established by an instrument consists of, and whether it carries a structural defect (O-5, DECISION-0052). The stages, the transitions and the condition of every transition are reconstructed from the formalisation rather than retold: what leads from where to where, and under what condition. The check of the graph: unreachable stages, dead transitions, a transition that enters no stage at all. Without package — the list of instruments whose procedure is formalised. A stage with no exit is named but is NOT counted as a defect: whether it is terminal by design cannot be seen from the formalisation.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: true
- title: The instrument as a procedure
law_process_runHow a particular case will run, step by step (O-5, DECISION-0052): a log of {date, attempt?, facts?} is executed frame by frame, and the law of each frame is the law of ITS date.1 finding
Why it is in this group
- The name "law_process_run" says "run": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "law_process_run" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "law_process_run" says "run": a word for a change.
Description, as the server wrote it How a particular case will run, step by step (O-5, DECISION-0052): a log of {date, attempt?, facts?} is executed frame by frame, and the law of each frame is the law of ITS date. The answer says: which stages have been entered; which attempted transition produced NO legal effect (§164 — "the act was performed but did not take place"); which duties are violated and which time limits are running; what is available next and WHAT EXACTLY is missing for the rest. The names of transitions come from law_process. Stages entered means "was it ever entered", not "where it is now": the core 0.1 does not compute points of the current state.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: true
- title: The course of a case
law_reportA REPORT of a divergence between the formalisation and the source: the answer contradicts the pinned text, a norm of the source is not expressed by a rule, a §218 label diverges fr…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it A REPORT of a divergence between the formalisation and the source: the answer contradicts the pinned text, a norm of the source is not expressed by a rule, a §218 label diverges from the text, an address cannot be found. A report is a hypothesis for triage by a formaliser: it does NOT change the law, it never reaches the answers of the other tools, and "not derived" does not become "derived" because of it. An address is required and is checked against the catalogue: package, fragment (a StableId from law_sources) and/or predicate; callId is the X-Law-Call-Id of the answer you disagree with. The entry goes into the server log.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: true
- title: Report a divergence in the formalisation
law_rulesThe rules of formalised law put into words: exactly how a predicate is derived (premises, source articles).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it The rules of formalised law put into words: exactly how a predicate is derived (premises, source articles). Call this BEFORE supplying facts to law_ask — the rules say which facts are needed instead of leaving them to be guessed. For large instruments package=… returns a table of contents; the full text comes from predicate=…. The listing by package is paged: limit (20 by default, 500 at most) and offset; the remainder is named in the text (`showing a–b of N; k more`) and in structuredContent (total, truncated, next — a ready-made continuation call).
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: true
- title: Rules of inference
law_screenBuild a necessary condition — a superset — for the preliminary selection of rows from an external source (DECISION-0120).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Build a necessary condition — a superset — for the preliminary selection of rows from an external source (DECISION-0120). This is NOT a legal answer and NOT SQL: the result is a typed tree and a manifest of the extensions up to TRUE. Every row that passes must then be computed in full by the engine, with a proof graph, on the same snapshot of the data. The binding is passed as a pinnable object; sourceSchemaContentHash is the actual hash of the source schema and is compared loudly with the pin. Case facts that carry provenance (origin, document, quote, extractor) are supplied to law_ask, not here. The confidence figure is read by the package EvidencePolicy, not by this tool and not by the engine.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: true
- title: Population screening
law_sourcesSources: by default short excerpts (view=summary), 5 texts per page, with the address of the full text in fragments[].full.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Sources: by default short excerpts (view=summary), 5 texts per page, with the address of the full text in fragments[].full. Either package or fragment is required (a StableId from law_search/law_rules). view=full returns exact parts of the text: textRange sets a range of Unicode characters, fragments[].next is the continuation with a contentHash. The hash refers to the WHOLE source, not to the excerpt or the part. textOffset/textLimit require fragment; a continuation requires contentHash. Lists are paged with offset/limit; the answer budget may shrink a page.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: true
- title: Official text
Only reads 3Claude Code: allow
law_explainUnfold the proof of a law_ask answer into a chain "rule ← premises → conclusion".No findings
Why it is in this group
- The name "law_explain" says "explain": a word for reading.
Description, as the server wrote it Unfold the proof of a law_ask answer into a chain "rule ← premises → conclusion". The compact input: question (the original law_ask arguments, truth/collect), resultHash and codeHash from the provenance of the answer. The server repeats the computation and compares the hashes; if anything changed it refuses explicitly. Alternatively pass the evaluation from law_ask(proof=true). answerResource=fullAnswer.uri explains a stored compact snapshot without recomputing and without the client loading pages; by default only the proofRef chain. nodeId selects one node and all of its premises (up to 24 KB, otherwise an explicit refusal). proofHash refers to the whole graph; scope marks the part selected.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: true
- title: Unfold the proof
law_queryA deterministic LawQL query over the CLIR of a formalization: a question about the model of the act itself, not about a case.1 finding
Why it is in this group
- The name "law_query" says "query": a word for reading.
Findings
- Info
The description is 2,397 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...cution (QUERY_TOO_BROAD), a continuation on another snapshot as SNAPSHOT_CHANGED."
Description, as the server wrote it A deterministic LawQL query over the CLIR of a formalization: a question about the model of the act itself, not about a case. Relations: nodes(id,kind,package,package_name,path), edges(from,to,role), anchors(node,anchor,act,locator,path), labels(node,lang,text,status), fields(node,field,value,value_kind), rules(id,strength,head_predicate,head_polarity,head_variables,body_variables,body_predicates), norms(id,modality,goal_kind,condition_predicates), positions(norm,kind,bearer_type), windows(norm,kind,deadline), imports(package,imported,semantic_hash), links(from,to,kind: imports|alias|subtype|produces|reads|anchored), literals(node,context,predicate,polarity), variables(node,context,name,type), interpretations(id,predicate,role). Functions: anchor, labels, short, contains, overlaps, starts_with, ends_with, position, derivation; exists/not exists over a bound variable; equality and membership only, no arithmetic and no ordering comparisons. Scope: corpus by package.name (for example kz.corpus.labour_code, not a file name) or a glob; without corpus, the whole profile slice; a scope outside the profile is empty (CORPUS_EMPTY). Examples: `from r in rules where r.head_predicate == "urn:…#eligible" select r.id as producer, r.strength as strength, anchor(r.id) as anchors` — who produces; `from l in literals where l.predicate == "urn:…#eligible" select l.node as reader, l.context as context` — who reads; `query eligible over "pkg" { for x: Person; where applicant(x); select eligible(x); }` — inference by the core. This is orchestration over the CLIR and the core; no new legal semantics is implemented here. Instead of text, a question from the catalog with arguments: producers, readers, anchors-of, imports-of, links-of, type-step (predicate/node/type parameters are URNs, pkg is a package.name or a glob). A structural answer is a queryPage: resultHash of the full queryResult, snapshot (hash of the scope package list), rowCount, rows by rowLimit (20, at most 5000) and rowOffset, next with the snapshot for continuation; full: true returns the full queryResult when the scope is one package. Every row carries provenance (CLIR nodes); an empty answer carries the explain funnel (emptyAt names the clause); errors carry LDC-Qxxxx codes with hints; a source product too wide is refused before execution (QUERY_TOO_BROAD), a continuation on another snapshot as SNAPSHOT_CHANGED.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: true
- title: LawQL query
law_searchA semantic SEARCH over formalised law: a question or a notion in your own words → candidates with addresses — predicates with signatures, rules, article fragments.No findings
Why it is in this group
- The name "law_search" says "search": a word for reading.
Description, as the server wrote it A semantic SEARCH over formalised law: a question or a notion in your own words → candidates with addresses — predicates with signatures, rules, article fragments. This is the layer of DISCOVERY, not of the answer: the result says WHAT to ask next (law_ask by signature, law_rules, law_sources) and establishes neither a fact nor a norm. The ranking is a deterministic lexical embedder (DECISION-0040), and similarity of text is not applicability of a norm. If you know the exact name, go straight to law_packages/law_ask; an empty result does NOT mean the norm does not exist.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: true
- title: Search by meaning
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 0.3.11. Values in angle brackets are yours to fill in.
claude mcp add --transport http picc https://mcp.arxo.io/mcp/piccRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__picc__law_search",
"mcp__picc__law_explain",
"mcp__picc__law_query"
],
"ask": [
"mcp__picc__law_passport",
"mcp__picc__law_answer_capabilities",
"mcp__picc__law_capture_answer",
"mcp__picc__law_prepare_answer",
"mcp__picc__law_publish_answer",
"mcp__picc__law_packages",
"mcp__picc__law_ask",
"mcp__picc__law_screen",
"mcp__picc__law_rules",
"mcp__picc__law_case_ask",
"mcp__picc__law_sources",
"mcp__picc__law_argue",
"mcp__picc__law_process",
"mcp__picc__law_process_run",
"mcp__picc__law_editions",
"mcp__picc__law_report"
],
"deny": [
"mcp__picc__law_revoke_answer"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as picc. Review it before you use it.