Where should proof-bound execution fit in MCP servers?

[rossbuckley1990-hash]

Actenon’s MCP position is that the model, client, and SDK are not the trust boundary.

The protected endpoint or tool handler should verify proof before consequential side effects happen.

The core rule is:

No valid proof, no execution.

Question

For MCP server maintainers and agent-framework developers:

Where should proof-bound execution live in practice?

Possible options:

• inside each tool handler
• in a shared protected-executor wrapper
• in MCP server middleware
• at an API gateway in front of the tool backend
• inside a framework-level convention
• somewhere else entirely

Why this matters

MCP tools can expose consequential capabilities such as:

• file writes/deletes
• database mutations
• browser submits
• email sends
• data exports
• deployment actions
• IAM or permission changes
• payment or refund actions

If a model can reach those tools, the execution boundary matters.

Actenon’s current view is:

The MCP client can request. The protected endpoint decides.

Would appreciate views from MCP server builders, agent-framework developers, and security engineers.