The Binding Gap: the MCP tool your agent vetted is not always the tool it calls.

An agent's tools get reviewed once, at install. The contract the agent actually calls is served live by someone else's process, and MCP's change notification is optional, so a server can rewrite what a tool claims to do after you approved it. Same tool name, sometimes the same version number, and nothing in the protocol requires the server to tell you. Some people call this a rug pull. I call it drift, and this talk measured how much of it there is.

Download the slides (PDF, 23 pages)

What was measured

35 crawls of the public MCP registry between 2026-06-09 and 2026-08-01. Of 4,909 registry entries attempted, 2,043 servers were reachable and serving tools. Every figure is a share of that crawlable population and says nothing about the rest of the registry listing.

Across every corroboration setting tested the gap stays between 21.6 and 24.7 points. A tool that drifted before the first crawl still counts as bound, so the real gap is wider than this.

What to do about it

Pin the tool contract you approved. When the server serves a different one, auto-accept only the changes you can prove are benign and hold the rest for a person. The appendix of the slides walks through one run of a gate doing this: a pinned contract, a call that runs, the server rewriting the tool, the same call refused, and a harmless change let through. The gate in that demo is mcpindex, which I build. The longer write-up on the threat is MCP rug pulls and silent contract drift.

Where the method stops

A stale declaration can still be accurate. The measurement says the contract changed after the declaration was written, never that the tool is now unsafe, so this works as a change tripwire and makes no safety call on its own. Declared, bound, stale and unobserved are the four states the talk uses; the vocabulary was developed jointly with Mayur Agnihotri, StraightArc Technologies Pvt. Ltd. (ORCID 0009-0007-0137-3780).

Cite this

The figures come from a paper and a dataset, both archived on Zenodo under CC-BY-4.0 and recomputable from the per-tool files.

@misc{bharti2026declared,
  author    = {Bharti, Gautam and Agnihotri, Mayur},
  title     = {Declared vs. Observed: Measuring the Binding Gap in MCP Tool Declarations},
  year      = {2026},
  publisher = {Zenodo},
  doi       = {10.5281/zenodo.22649163},
  url       = {https://doi.org/10.5281/zenodo.22649163},
  note      = {Preprint. Concept DOI; resolves to the latest version. Version 1.0 is 10.5281/zenodo.22649164. CC-BY-4.0}
}

@dataset{bharti2026binding,
  author    = {Bharti, Gautam},
  title     = {MCP Declared-Effect Coverage and Contract Binding v1},
  year      = {2026},
  publisher = {Zenodo},
  doi       = {10.5281/zenodo.21778281},
  url       = {https://doi.org/10.5281/zenodo.21778281},
  note      = {Concept DOI; resolves to the latest version. CC-BY-4.0}
}

Figures in the talk are from dataset version 10.5281/zenodo.21778282. The talk quoted paper version 1.0, 10.5281/zenodo.22649164; the BibTeX above uses the concept DOI, which follows later versions.

The live record of contract changes across the registry: the drift ledger. Corrections: hello@mcpindex.ai.