# Tool changes — source dossier and editorial boundaries

**Public copy prepared 2026-10-22.** Pins re-checked: SDK commit `6032170` (committer date 2026-09-16T16:51:56Z) and the `mcp.ts` blob at that commit, with every line anchor re-derived; the 2025-11-25 tools specification (`notifications/tools/list_changed` and the untrusted-annotations rule present); the Invariant Labs report URL (reachable). Not re-checked: the Invariant report body against its April 2025 wording, and any current client behavior.

**Research ID K08 · Checked September 21, 2026 · Public-source inspection only.** Supports [When the tool changes](/blog/when-the-tool-changes) and its [review worksheet](/resources/tool-change-review.md). No exploit, client session or SDK test was run. SDK source files were read as text; no package was installed or executed.

## Admission test

- **Decision:** what invalidates a team's prior acceptance of an MCP integration?
- **Concrete implementation:** MCP TypeScript server registration, update and dispatch at a fixed revision.
- **Unresolved question:** what does a particular consuming host bind its acceptance to?
- **RA contribution:** distinguish definition, executable behavior and authority changes; compare controls and construct useful maintenance cases.
- **What changes the view:** a verified host/provider contract binding all relevant execution conditions would narrow the proposed review obligation; unacceptable maintenance overhead would require a different operating design.

## Full references and observation register

| ID | Citation / date / source kind | Observed; confidence and limitations | Decision / refresh trigger |
|---|---|---|---|
| K08-1 | Model Context Protocol contributors. *Tools*, protocol revision **2025-11-25**. [Versioned specification](https://modelcontextprotocol.io/specification/2025-11-25/server/tools). Primary standard. Checked 2026-09-21, discovery/call/list-change/types sections. | Defines listed metadata, name-based call example and change notification; treats untrusted-server annotations as untrusted. High confidence for this revision. Does not establish host behavior or exclude application-specific extensions. | Define what needs a separate application contract. Recheck on protocol-revision change. |
| K08-2 | Model Context Protocol contributors. `packages/server/src/server/mcp.ts`, TypeScript SDK commit **60321700871029401a2e3bed8fdf4f02c9ec3331**, committer date **2026-09-16T16:51:56Z**. [Pinned source](https://github.com/modelcontextprotocol/typescript-sdk/blob/60321700871029401a2e3bed8fdf4f02c9ec3331/packages/server/src/server/mcp.ts). Primary implementation. Checked 2026-09-21. | Inspected lines 230–290 (`tools/list` and `tools/call` handlers), 941–998 (`update` closure: separate description/callback branches, executor regeneration, notification after any update, registration-time notification) and 1222–1226 (`sendToolListChanged`, connected only). Anchors re-derived against the pinned blob on 2026-10-22; the earlier 217–289 / 919–998 / 1222–1225 anchors had drifted. High confidence for static paths; no runtime, caller concurrency or host inspection. | Ground the independent-change model. Recheck actual deployed version before implementation advice. SDK commit is not asserted to implement only K08-1. |
| K08-3 | Luca Beurer-Kellner and Marc Fischer. *MCP Security Notification: Tool Poisoning Attacks*. Invariant Labs, **2025-04-01**, visible April 7/11 updates. [Discoverer report](https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks). Primary report with vendor interest. Checked 2026-09-21. | Reports description-poisoning demonstrations; discusses later description replacement. Medium confidence in reported demonstrations; no RA reproduction or complete run audit. The rug-pull discussion is not adopted as a confirmed production incident. | Prior-art attribution; keep historical scope. Recheck before any claim about present clients, affected versions or prevalence. |

All source links were retrieved successfully. The SDK source was inspected through its raw GitHub URL at the exact commit; the full repository was not imported. No third-party source code is copied into the article.

## Claim and assumptions register

| Claim | Status / basis | Limit / next evidence |
|---|---|---|
| A definition digest cannot by itself attest remote execution behavior | RA logical inference: the two are different objects | Actual provider may supply additional verified binding; inspect its contract |
| A changed description could affect choices involving other tools | Historical research plus conditional exposure reasoning | Depends on when/how host exposes content; no current host tested |
| Reconnect requires an enduring review baseline to detect changes across sessions | Conditional design requirement | Applies when change detection is the chosen control; trust-on-each-connect is a different explicit policy |
| Draft-only resource authority can contain some consequences | Proposed architecture for the fictional support task | Must inspect alternate egress, credentials and resource permissions; no efficacy result |
| Manual approval for every cosmetic change may create friction | Hypothesis, not measured human behavior | Measure time, false interruptions and useful maintenance completion |
| Controlled deployment revision can be bound to execution | Proposed cooperating-system contract | Not identified as a standard MCP guarantee or implemented RA feature |

## Important exclusions

This is not a current vulnerability report, client comparison, SDK audit or complete protocol assessment. The inspected server's legitimate dynamic-update functionality is not labeled a defect. No claim is made that a change notification contains a diff, forces rediscovery, invalidates approval, or prevents races. Those are host/protocol integration questions.

No hidden assertion of remote-code immutability is allowed: an unchanged definition can accompany a changed service. A fixed build can also depend on changed configuration or remote systems. Conversely, a changed description does not prove malicious behavior.

## Editorial and future validation gates

Before publication, reread links and verify that the article remains explicitly about the pinned implementation and proposed integration policy. Before a current host guide, record client/server revisions, exposure ordering, persistence of accepted definitions, notification/reconnect behavior and runtime authority. Before numerical security or usability claims, execute a declared authorized test set with all attempts retained.

The companion uses synthetic `prepare_reply` variants and records expected observations only. Blank result fields must remain blank until execution. The evaluator remains paused; this research does not create a software roadmap or demonstrate demand for a gateway product.