Two servers expose delete_user.
Your trust list approves one.
The runtime resolves by name and may execute the other. Nothing errors and the transcript lies.
Quieter failure: MCP ships a version where transfer grows an optional destination_account field.
Yesterday it moved money, today it moves money to a chosen account.
Name unchanged, signature still valid, trust list still stale.
def tool_identity(server_id, name, schema):
canonical = json.dumps(schema, sort_keys=True, separators=(",", ":"))
return f"{server_id}::{name}@{sha256(canonical)[:16]}"
Unreviewed drift suspends the tool.
A flag that stops nothing is a log line.
Full writeup with the field-classification problem: here
Top comments (0)