Agent-Safe Intent conformance

An OpenAI Responses API function_call item, the record a function tool produces (the OpenAI Agents SDK's function tools produce the same item). The arguments arrive as a JSON-encoded string; everything but the action name and the arguments is the trusted runtime's to add.

parameters

arguments is a JSON string; the adapter parses it into the object that is hashed

effect_correlation

function_call_output echoes call_id

idempotency

call_id identifies the model's call, not a retry boundary; the runtime chooses the key

The framework's record

{
  "id": "fc_synthetic_1",
  "call_id": "call_synthetic_1",
  "type": "function_call",
  "name": "refund_order",
  "arguments": "{\"orderId\":\"synthetic-1\",\"amountMinor\":35000,\"currency\":\"USD\"}"
}

Intent hash

sha256:fbb961ed4a8e5a8b39ff92328c6573b9e688a4aaa9069ab5aaf5bd6ea5b08fea

The vector

A Vercel AI SDK tool-call part, as generateText and streamText return it. The input is already an object; everything but the tool name and the input is the trusted runtime's to add.

effect_correlation

the tool-result part carries the same toolCallId

idempotency

toolCallId identifies the model's call, not a retry boundary; the runtime chooses the key

The framework's record

{
  "type": "tool-call",
  "toolCallId": "call_synthetic_2",
  "toolName": "refund_order",
  "input": {
    "orderId": "synthetic-1",
    "amountMinor": 35000,
    "currency": "USD"
  }
}

Intent hash

sha256:147eb95792bdc1be431e3512c607c8def3dcdec1055c4c8e817c49540de7228f

The vector

A LangChain ToolCall, as an AIMessage carries it in tool_calls (LangGraph agents pass the same object to a ToolNode). The args are already an object and the id is optional; everything but the name and the args is the trusted runtime's to add.

effect_correlation

the ToolMessage carries the same id as tool_call_id; the id is optional on the call

idempotency

id identifies the model's call, not a retry boundary; the runtime chooses the key

The framework's record

{
  "type": "tool_call",
  "id": "call_synthetic_3",
  "name": "refund_order",
  "args": {
    "orderId": "synthetic-1",
    "amountMinor": 35000,
    "currency": "USD"
  }
}

Intent hash

sha256:72e34c9754c82b3cfa820410a470874f7a364dd113cf3be82ed829aebccb8673

The vector

An MCP tools/call request, at the moment the model has chosen a tool and constructed its arguments. Unlike the other three frameworks, the record-to-proposal mapping is not written by the integration: @decionis/agentsafe ships it as bindMcpInvocation, and the tool binding below is what an operator declares.

MCP names the tool and carries its arguments as an object, so the action and the parameters are native and the JSON-RPC id is the correlation the result echoes. What MCP has no place for is what makes an invocation authorizable: which resource the action lands on, who proposed it, when the proposal stops being current, and the key an effect is bound to. The shipped binder derives the target from the arguments rather than accepting one, and the trusted runtime supplies the rest.

The framework's record

{
  "jsonrpc": "2.0",
  "id": "call_synthetic_1",
  "method": "tools/call",
  "params": {
    "name": "delete_customer",
    "arguments": {
      "customerId": "synthetic-1"
    }
  }
}

Intent hash

sha256:b275810adef3e8f9192430270f15e294f1fe41dbea789c916e89d6726b521b30

The vector