Fail closed tool execution when streamed arguments are incomplete

I’m looking for feedback on a tool execution failure mode that has already been reproduced upstream.

In AI SDK, tool execution could occur even when the enclosing generation ended in an unsafe terminal state: https://github.com/vercel/ai/issues/19063

GitHub

Tool execution does not respect unsafe `finishReason` values in `streamText()` and `generateText()` · Issue #19063 · vercel/ai

Description Valid tool calls are auto-executed even when the enclosing model call terminates with length, error, content-filter, or other. I reproduced this on current main (54686d6, ai 7.0.68, @ai...

Atomic Agent reproduced a similar issue with malformed or truncated tool arguments reaching execution: https://github.com/AtomicBot-ai/atomic-agent/pull/144

The core invariant is simple: parsed arguments alone should not authorize a side effect. Raw arguments, tool identity, schema validity, and safe stream termination should all be proven first.

I maintain an open source implementation of this boundary here: https://github.com/canblmz1/prefix-safe-json

I’d be interested in feedback from anyone using AI SDK with MCP, parallel tool calls, custom streaming adapters, or OpenAI compatible providers.