ACLE-MCP Binds Each MCP Tool Call to the Workload That Was Actually Attested
The paper names a 'post-authorization execution trust gap' in remote MCP: OAuth proves the endpoint was authorized, but not that a later tool call runs on the provider-side workload the relying party meant to trust, since execution can shift to a substituted workload, lean on stale appraisal state, reuse authority transferred from another sender, or traverse an undeclared downstream component. ACLE-MCP issues a short-lived, sender-constrained capability lease binding expected workload, freshness, operation, object and parameter bounds, downstream constraints and receipt obligations, consumed by a provider-side Execution Gate immediately before the protected tool logic runs. The runnable prototype uses Keycloak/OIDC, the MCP Python SDK server and an optional vTPM quote-verification backend; weaker authorization and connect-time-only attestation left distinct attack families open, while full ACLE-MCP blocked all evaluated families with benign tasks preserved.
↳ Follow the thread