AOK-MCP: Admissibility-Governed Tool Protocols Over Open Model Interfaces

Modern tool protocols such as the Model Context Protocol (MCP) standardize how AI systems request external actions. They define schemas, routing, and invocation formats, but they do not define under what law a tool call may count as having legitimately occurred. As a result, current systems risk silent double execution, policy drift reinterpretation, logging without cryptographic binding, and ambiguous refusal semantics. AOK–MCP introduces a constitutional layer over open tool protocols. It treats each tool call not as an instruction, but as a proposed semantic mutation evaluated under explicit admissibility law. Execution occurs only through a typed effect membrane, and state advancement is permitted exclusively through the production of a content-addressed receipt. Refusal is first-class and receipted. Absence of a conforming receipt collapses the action to an epistemic non-event. This work formalizes AOK–MCP as a state-transition discipline over: Content-addressed law artifacts Versioned receipt schemas Cryptographically bound execution records Deterministic replay semantics The paper defines an explicit Trusted Computing Base (TCB), parameterizes cryptographic assumptions (collision and second-preimage resistance), and proves uniqueness and replay-determinism properties under stated constraints. A concrete policy-drift adversarial scenario demonstrates how naïve MCP systems permit retroactive reinterpretation, while AOK–MCP structurally prevents it through law-hash binding. Preliminary performance evaluation shows modest overhead (~10%) relative to naïve tool invocation, suggesting practical feasibility. AOK–MCP does not modify protocol wire formats. Instead, it reorders authority: admissibility law precedes execution, and execution must yield verifiable receipt artifacts before state transition. This establishes a governance membrane suitable for financial automation, compliance-bound systems, infrastructure orchestration, and safety-critical AI tool ecosystems.