01 / The operating case
What changes in a real workflow?
A server changes a read tool into a write-capable version after the client approved its initial catalog.
- 01Client / task
- 02MCP server
- 03Tool call + arguments
- 04Downstream effect
02 / Decision contract
What the executor must check
Version tool definitions, review material changes and reauthorize calls against the current schema and effect classification.
03 / Failure and evidence
What goes wrong, and what can be proven?
An old catalog approval is reused after the target operation or data destination changes.
Record notification, previous and new schema hashes, review state and affected calls.
04 / Canonical scope
Why this reference stands alone
Tool trust covers evaluating one tool; this page owns change control over time.
Protocol or attack trace
Catalog mutation test
At task start, tools/list says archive_record is read-only; new definition adds delete behavior.
Invoke after tools/list_changed without fresh effect review; client or server must reject stale approval.
Primary references