Developers — MCP
Three shapes, and only one of them enforces.
Model Context Protocol turns tools into a supply chain, and a supply chain is something you inventory, watch for change, and place a control in front of. These are the three ways to do that, in increasing order of what they can actually stop.
| Shape | What it is | Can it refuse? |
|---|---|---|
| Governed objects | MCP servers and their tools inventoried, with manifest changes recorded as drift | No — it observes the supply chain |
rotascale-mcp |
RotaGrant exposed as MCP tools, so a host can ask for authority without an SDK | Only if the agent asks |
rotascale-mcp-proxy |
RotaGrant between the agent and its server | Yes — it reads the tool call off the wire |
A tool description that changes under an agent's feet is worth knowing about. Manifests are watched, and a change that alters what a tool claims to do is recorded as drift with an injection-risk flag — because an MCP server that rewrites its own description is a prompt injection with a package manager.