All three ARGUS assistants had been running without our marketplace's MCP tools for days. Their containers kept reporting healthy. The assistants could carry on with other capabilities, so the missing connection did not stop the processes or turn their liveness checks red.
The refusal came from WARDEN, the guard inside ARGUS. It compares an MCP server's tool definitions with an approved snapshot before making them available to the model. Tool descriptions enter the model's context, so a change to their instructions matters even if the tool's name stays the same. In this case, the guard reported TOOL_DEF_DRIFT for the hub we operate ourselves.
We had put the live price and the exact free-trial allowance into each paid direct tool's description. It was convenient for a model reading tools/list: the cost was right there. It also made routine tariff changes rewrite a security-pinned definition. Updating a number could cost the assistant access to the entire hub until someone reviewed it again.
Prices out of the pinned description
The November 6 repair moved those amounts out of the descriptions. A paid direct tool now says, "Paid per call; market_search shows the current price." A free tool says "Free." When a trial is enabled, the description mentions a few free calls without inserting the exact quota.
Buyers still need prices. The catalog search results retain price_per_call_usd and max_price_usd; an external check after deployment confirmed both fields on modelmarket.dev. Exact trial settings and remaining calls belong in the runtime settings and result data.
This leaves some meaningful changes in the definition. Switching from free to paid changes the wording, as does enabling or disabling the trial phrase. Changing one positive price to another, or adjusting the numeric trial allowance, now leaves an otherwise identical definition alone.
Six hubs received the update. Five had direct tools with amounts in their descriptions; afterward, all five served the same 13-tool list despite their different prices. The sixth, which had no direct tools, kept its eight-tool list. Two external reads in a row were identical at every endpoint, and all six health checks returned HTTP 200. The MCP server version and packaged server card moved from 1.2.0 to 1.3.0 together.
The smoke checks compared definitions at $0.001 and $0.05 and with a different trial size. They also checked free-tool wording and the version; the recorded gateway and ARGUS test runs passed. Availability can still change the list: a direct tool disappears when its route becomes unsellable, including when a peer has been stale for more than six hours.
Blocked in the health response
ARGUS already knew the hub had been refused. The operator needed that knowledge outside the connection code. It now retains a state for each MCP server it was asked to use: connected, blocked, or failed. A tool list that stops answering after connection moves the server to failed instead of leaving it marked connected.
These fields were recorded in the public health response after deployment:
{
"status": "ok",
"mcp": {
"connected": 0,
"blocked": 1,
"failed": 0
}
}
The top-level ok remains the liveness value our existing monitor expects. The counts alongside it expose the integration's state. An authenticated status endpoint gives per-server details and WARDEN reason codes; the public response carries only counts.
An independent review caught a hole in the first implementation: it reported startup blocks but missed a server becoming blocked during operation. Runtime blocks now produce error-level log entries and, when Telegram is enabled, an owner notification. Repeated runtime notifications are limited to once per server per hour; the events still go to the log. Notes written before the bot has an owner wait and are retried when one becomes available.
The messages use cleaned identifiers and reason codes. Configured servers can be named, while servers discovered through a remote catalog are counted without copying their catalog-chosen identifiers into the owner's message. An approval command appears only for a pin problem it can resolve.
At the close of the November 6 rollout, all three assistants still had one blocked MCP server. The repair had changed the definitions once more, and none had yet received the required reapproval. Each needed a human to review the new snapshot at an interactive terminal, approve it, and restart ARGUS before those marketplace tools could return.
We build WARDEN and ARGUS and operate AIMarket. This article was drafted with AI assistance using our code, test records, and November 6 deployment notes.
