Developers — MCP
Three shapes, and only one of them enforces.
Model Context Protocol turns tools into a supply chain, and a supply chain is something you inventory, watch for change, and place a control in front of. These are the three ways to do that, in increasing order of what they can actually stop.
This page is the argument. Governing an MCP server is the detail, kept next to the code rather than next to the marketing.
| Shape | What it is | Can it refuse? |
|---|---|---|
| Governed objects | MCP servers and their tools inventoried, with manifest changes recorded as drift | No — it observes the supply chain |
rotascale-mcp |
RotaGrant exposed as MCP tools, so a host can ask for authority without an SDK | Only if the agent asks |
rotascale-mcp-proxy |
RotaGrant between the agent and its server | Yes — it reads the tool call off the wire |
A tool description that changes under an agent's feet is worth knowing about. Manifests are watched, and a change that alters what a tool claims to do is recorded as drift with an injection-risk flag — because an MCP server that rewrites its own description is a prompt injection with a package manager.