ACLE-MCP binds each MCP tool call to the workload that was actually attested.

The paper names a post-authorization execution trust gap in remote MCP: OAuth proves the endpoint was authorized, not that a later tool call runs on the workload the relying party meant to trust. ACLE-MCP issues a short-lived sender-constrained capability lease binding expected workload, freshness, operation, object and parameter bounds, downstream constraints and receipt obligations, consumed by a provider-side Execution Gate immediately before the protected tool logic runs. The runnable prototype uses Keycloak/OIDC, the MCP Python SDK server and an optional vTPM quote-verification backend. Weaker authorization and connect-time-only attestation left distinct attack families open; full ACLE-MCP blocked all evaluated families with benign tasks preserved.