[paolocostanzo]

Closes #1201. Applies Otto's revised wording to 10.4.8 and restores Level 2.

Current text (L3):

Verify that MCP clients maintain a snapshot of tool definitions and that any change to a tool definition triggers re-approval before the modified tool can be invoked.

• 10.4.8: revised text, Level 3 → 2.
• Appendix A: new "Tool Definition" entry, Otto's wording from the same comment.
• Appendix B: C10.4.8 row aligned.

Why: as Otto noted in #1201, L3 came from an editing mistake in #946, where the snapshot row (then 10.4.5, L2) was rewritten at L3 and its list_changed/between-sessions scope was dropped. The revision restores that scope, makes reconnection and restart explicit, covers tools with no approved definition, and checks the definition the client is about to use rather than requiring a check on every tools/list response, which may legitimately be served from cache (ttlMs).

References: client measurements and level discussion in #1201; prior art: Trail of Bits mcp-context-protector; MCP spec, Tools (2026-07-28).

Suggested release note: 10.4.8 returns to Level 2; L3 came from an editing error in #946, and the text was revised for clarity.

[ottosulin]

Thanks for submitting this!

Two small wording things before merge.

Line 68, "current definition" is a bit looser than we meant. The point is that the client compares the definition it is about to use, so a cached tools/list cannot slip past it. Could we say "where the definition the client is about to use differs from it"?

Appendix A line 297 leaves out title, which is the name people actually see when they approve a tool. I would add it and leave icons out.

Suggested 10.4.8:

Verify that MCP clients retain, per server, the tool definition the user approved, and do not invoke a tool where the definition the client is about to use differs from it, or for which no approved definition is retained, until the user approves that definition, including after a tool list change, a reconnection, or a restart.

[paolocostanzo]

Thanks Otto, both applied in fa3ecd8: 10.4.8 now uses your suggested wording, and the Tool Definition entry lists title (no icons). Ready for another look whenever you have time.

[ottosulin]

Looks good, thanks!