MCP security
One tool call, one governed action, nothing else
The Model Context Protocol gave agents a clean way to reach tools. It did not decide which calls are allowed to produce effects. A tool that can act is an execution path, and it needs the same authority checks as any other.
What is checked on a governed tool call
Argument integrity
Arguments altered between the tool boundary and dispatch fail the check rather than executing with the altered values.
Replay resistance
A previously valid call, re-sent, does not produce a second effect.
Forged identity arguments
An identity supplied as a tool argument is not accepted as the acting identity. Identity comes from the authenticated connection.
Revoked authority
A tool call from an agent whose authority has been withdrawn fails at dispatch, not after the effect.
Direct execution attempts
Reaching the execution path around the governed route fails, because the capability that performs the effect is not held by the agent or the tool.
Signed provenance
The tool's provenance is signed inside the evidence envelope, so which tool reached which action is part of the record rather than an inference from logs.
Verdict and stated limitation
MCP governance and bypass resistance
ProvenOne MCP tool call reaches one governed action and nothing else. Altered arguments, replayed calls, forged identity arguments, revoked authority and attempts to reach the execution service directly all fail correctly, and the tool's provenance travels inside the signed envelope rather than in a log beside it.
Limitation · Demonstrated for the unix-socket transport and the service accounts the harness creates on one host. It states nothing about another deployment's accounts.
Scope
This was demonstrated for the unix-socket transport and the accounts the harness creates on one host. A deployment on a different transport or across multiple hosts is not covered by that demonstration and should be treated as untested until it is run.