[mattzcarey]

The direct tools (?codemode=false, with or without experimentalForge) now check every JSON response, success or error, against the response schemas forge generates, and record each mismatch as a response_schema_mismatch Analytics Engine event. npm run report:schema-mismatches lists them by product → operation → violation for the owning teams.

We want to advertise outputSchema on direct tools, but clients that validate structuredContent would reject correct responses that don't match their schemas. This soaks the schemas we'd advertise first, so we can fix what breaks. Part of #320.

• Schemas: forge's MCP target now generates each tool's responses (forge.json → cloudflare/forge's forge-mcp branch at 9561734, kept rebased on its main). tools/list never sends them.
• Where it runs: the check runs in the forge tools service, which already holds the schemas, so nothing is fetched or parsed per isolate and the main Worker never loads them. The main Worker trims each array to 25 items and calls checkResponse over RPC in waitUntil. Tool results never change or fail, and a check costs at most ~10 ms.
• No customer data: events and logs hold keywords, schema locations and instance paths, with indices and undeclared keys as *.
• Traceable: generate-tools.ts records the openapi.forge.json release in source.json. Each mismatch names it and the generated tool, and the report links to it.
• Cost: the forge tools bundle grows from 0.76 MB to 1.2 MB gzipped, and its startup evaluation from ~70 ms to ~135 ms (Node).
• Spec: regenerated from openapi@fdbc7d9, the first release whose account_or_zone has its accounts/zones enum and description (account_or_zone has no enum or description in openapi.forge.json forge#59). The forge tools stop adding them and only make account_or_zone_id optional.
• Known false positive: forge doesn't read writeOnly yet, so required write-only fields (Hyperdrive's origin.password, for one) show up as missing-property violations until Read writeOnly so required write-only fields don't break response schemas forge#63 lands.
• Config: new RESPONSE_VALIDATION_SAMPLE_RATE var (1 everywhere) and new dependency @cfworker/json-schema.

checkResponse({ toolName, method, pathTemplate, status, body, bodyChars, props })

Tests ran (npm run check), including worker tests through both surfaces against the real generated schemas. scripts/bench-response-validation.ts measures the check.