Abstract
When an AI model emits a tool_use block, a function call or an MCP tools/call request, the host usually executes whatever name and arguments the model produced. Alignment training, system prompts, schema validation, allow-lists and OAuth surround that moment but do not control it: injected content can turn a search into an email send, valid arguments can pay the wrong vendor, a substituted MCP server can answer under a trusted name, and a retry can execute twice. This disclosure binds execution finality to the tool-call interfaces of Anthropic, OpenAI and the MCP ecosystem without changing models, schemas or servers. Each tool call is held as a non-effective candidate act; a host-side enforcement function canonicalises and hashes the arguments, records provenance and consequence class, and blocks invocation until scoped, single-use, workload-bound authority is verified against the live arguments and consumed at the dispatch point. High-consequence actions fail closed, every decision produces a hash-chained receipt, and denials return to the model as tool errors. The disclosure includes interface mappings, SDK hook points, streaming and parallel-call rules, conformance tests, a reference implementation, and variations from host wrappers to TEE- and HSM-backed enforcement. Industry-alignment material is AI-generated; readers must cross-check it against the original patent filings before drawing conclusions. This disclosure is based on PCT/IB2026/055615 (the "Mothership" application), filed 4 June 2026 and publicly disclosed 16 July 2026, which claims priority from PCT/IB2026/053385, filed 7 April 2026 and disclosed 4 June 2026. The author is open to acquihire or strategic collaboration.
KEYWORDS :tool call authorization, function call gating, pre-invocation verification, argument digest binding, canonical JSON hashing, single-use authorization token, replay protection, atomic consume-before-execute, prompt injection mitigation, instruction provenance, MCP tools/call, policy enforcement point, sender-constrained capability, fail-closed execution, hash-chained audit receipt
Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial 4.0 License
Recommended Citation
Das, Sangam Kumar, "The Model Printed It. The Host Ran It.: Binding Execution Finality to AI Tool Calls, Function Calling and MCP Before Any Side Effect Occurs", Technical Disclosure Commons, (November 05, 2026)
https://www.tdcommons.org/dpubs_series/12803