Approval needs a checksum.

The permission dialog ages badly

An MCP server publishes its tools through tools/list. Each tool can carry a name, description, input schema, output schema, and annotations. The model reads that metadata before it decides how to use the tool.^[1]

A user may approve the server once. The server can return different metadata on a later connection. That creates a narrow integrity problem. The approval describes yesterday's tool, while today's model sees today's definition.

Approve the definition, not the server name.

mcp-pin is a new local proxy for standard-input and standard-output MCP servers. On the first connection, it canonicalizes each complete tool object, hashes each object with SHA-256, and records a hash for the whole tool set. On later connections, it repeats the calculation before forwarding queued client traffic. A mismatch blocks the session and prints a diff.^[2]

The useful part is the refusal

The project does not ask a model whether a metadata change looks safe. It compares deterministic fingerprints. Key order, tool order, and whitespace do not trigger drift. A changed description, schema, annotation, added tool, or removed tool does.

We ran version 0.1.4 from npm in an empty temporary home. Its bundled demo pinned one weather tool. The second connection changed the description and added a context field. The proxy blocked the session before it forwarded queued calls. We also ran the repository's 61 tests. They covered canonicalization, drift blocking, paginated tool lists, corrupt-state refusal, queued-call blocking, log verification, crawler limits, and concurrent pins.

Tool reach is growing

Chrome's September release recap says the Chrome DevTools MCP server added an Agent Plugins 1.0 package, JavaScript execution controls, configurable filesystem roots, heap inspection, and PWA automation. The same release added --no-javascript-evaluation so an agent can inspect pages without evaluating JavaScript.^[3]

More useful tools make definition review more important. They also make definition pinning less sufficient. MCP's security guidance calls for narrow scopes and minimum privileges. A hash can tell you that the advertised tool changed. It cannot bound the process, credential, network, or filesystem behind that tool.^[4]

Put the pin beside the other brakes

Start with the standard-input and standard-output server that holds the most authority. Pin an exact mcp-pin version in the client configuration. Save the server command without secrets. Reconnect once to confirm the same definition. Then alter a disposable fixture and prove the proxy blocks the session.

Keep the definition diff in review. Do not treat approve as a cleanup command. It changes the trust record. Require a source revision, a reason for the metadata change, and one test that would fail if the new field or instruction were abused.

Definition pinning belongs between discovery and execution. Process isolation belongs around execution. Result validation belongs after the call. One checksum cannot do all three jobs.