Copied descriptions cannot tell you which binary answered. ProbeID asks the tool instead.
Chen and colleagues posted arXiv:2610.33633 with a protocol that treats MCP tool identity as probe-observable behaviour under registry drift. After a week of shell-injection CVEs in hastily wrapped MCP servers, the quieter failure mode is the rug pull that keeps the schema and the blurb while changing what comes back.
Admission banks probes; selection checks live candidates against that bank
ProbeID is a post-admission behavioural verifier. At admission it builds an attested bank of schema-valid probes with canonicalized trusted responses. At selection it secretly subsamples that bank, sends those probes only to current candidates, and picks the candidate nearest the reference under a bounded behavioural distance, or abstains when no candidate matches or the decision is ambiguous.
Canonicalization drops volatile fields such as timestamps and request ids. The comparison observes responses, status codes, and state deltas; it cannot see side effects that never appear in a response. The authors give concentration arguments for a shared probe budget that scales logarithmically with candidate count under an explicit margin model.
On MCP-IdentityDrift, built from cached real tool behaviour with injected schema-compatible squatters, ProbeID reaches 0.956 strict-choice hit@1 with the gold present, while description routers collapse toward chance when squatters copy the gold description. Exact equality can tie the bounded distance on noiseless cached cases; maximum mean discrepancy tolerates heavy value noise better. A 32B behavioural judge is similarly accurate at higher cost.
Registry drift kept moving under version pins
Over eleven weeks the authors re-probed 16 real published MCP servers. Canonicalization succeeded on every recorded response; most tools were deterministic; 7 of 59 tools departed from recorded responses under unchanged version pins, three of them after a reinstall at unchanged versions when an SDK validation library range shifted error shape. Version pins did not freeze behaviour.
In an MCP-Bench agent setting, adding ProbeID as a gate cut tasks tainted by a rug pull from 15 to 9 of 16 while task success stayed unchanged, a harm channel that green task metrics miss. That pairing is why the paper belongs next to MCP supply-chain coverage this week: shell injection is one failure class; silent behavioural drift is another.
MIT-licensed protocol on StableToolBench-derived caches
Paper: arXiv:2610.33633, "ProbeID: Verifying MCP Tool Identity for LLM Agents under Registry Drift." Authors include Guanxing Chen, Sining Zhang, Haohuai He, Qiujie Lv, Yu-An Huang, and Zhi-An Huang. The paper states ProbeID code is released under MIT, with the benchmark building on StableToolBench and ToolBench (Apache-2.0), and that code, derived data, and the raw response corpus will be released upon acceptance.
ProbeID reads as a usable research verifier with theory-backed budgets and an eleven-week live census. Production operators still need their own admission reference integrity and probe-coverage review. Treat the paper's "upon acceptance" release language as a pin-time check before declaring the corpus locally reproducible.
Use behavioural probes when description routers are the only gate
Reach for ProbeID-style verification when agents select MCP tools from open registries, when squatters can copy descriptions, or when your incident review already shows version-pinned servers changing responses after reinstall. Pair it with admission-time binding: ProbeID complements provenance and definition binding; it does not replace them.
If your tool set is a sealed internal catalogue with cryptographic identity and no third-party registry, description routing risk shrinks and a lighter change-detector against your own baselines may suffice. If exfiltration preserves every probe-visible response, ProbeID will not see it. Plan a different control for silent side channels.
Bad references, thin probes, and invisible side effects break the guarantee
Verification inherits reference integrity: a compromised admission bank blesses the wrong behaviour. Probe coverage must reach the behavioural difference; tools whose drift sits outside the bank always pass. Response noise without canonicalization inflates self-distance and can force abstention or false rejects. Abstention trades coverage for safety; operators must decide what the agent does when ProbeID refuses every candidate.
The 0.956 hit@1 figure is on the authors' cached IdentityDrift cohort with gold present and separable squatters. Live registries with heavier noise, aliased schemas, or adaptive attackers who mirror probe banks need separate measurement. Task-success metrics remain a poor proxy for taint, as the 15→9 result shows.
Paper and figure for the behavioural identity loop
The arXiv HTML figure for ProbeID's admission and selection loop is the visual companion to the protocol. Operator takeaway after the nine-CVE MCP shell batch: pin versions, then probe behaviour.