Expand description
The one spelling of “you may not” that every authorization gate uses
(spec 2026-09-12 execution-limits §3.8, D9). The gates stay where they
are; this is how their refusals are recognised across a process boundary
— an MCP server’s isError text, a tool’s error — so the loop can treat
them as terminal for the tool instead of as something to retry.
Constants§
Functions§
- is_
not_ authorized - Does this text (possibly wrapped by an MCP server as
Error: …) carry a refusal? Prefix only — a tool that merely mentions authorization in its output is not refusing. - not_
authorized not authorized: <msg>— the message every gate emits.