SERVER
能力提供方Capability provider
服务器声明工具、资源与提示，不把实现细节塞进模型。A server declares tools, resources, and prompts without exposing implementation details.
01 ·
插上两个扩展坞，权限会自动永久生效吗01 · Plug in two docks—does access last forever?
文件服务器与客户服务器都能报出自己会做什么；如果管理员撤销客户权限，昨天打开的会话还能偷偷继续调用吗？A file server and a customer server can both advertise what they do. If customer access is revoked, can yesterday's session keep calling it?
02连接两个模拟服务器，让能力自动出现，再撤销权限并重试旧会话Connect Two Simulated Servers, Discover Capabilities, Then Revoke and Retry an Old Session
发现 ≠ 授权discovery ≠ authorization
状态 AMetric A
—
—
状态 BMetric B
—
—
状态 CMetric C
—
—
所有概率、成本、成功率与输出均为固定种子的教学模拟，不代表真实模型输出。把主变量拖回即可复核结论。All probabilities, costs, success rates, and outputs are fixed-seed teaching simulations, not real model output. Move the main variable back to verify the conclusion.
03把刚才的变化拆成 4 个零件Break the Change into Four Parts
Model Context ProtocolDISCOVER
能力清单Capability list
连接成功后按协议自动出现名称与输入结构。Names and input shapes appear automatically after a protocol connection.
AUTHZ
逐次授权Per-call authorization
清单可见只说明能力存在，调用仍检查主体、范围与当前授权。Visibility proves a capability exists; each call still checks identity, scope, and current access.
SESSION
会话失效Session invalidation
撤销必须作用到旧会话，不能只限制新连接。Revocation must invalidate old sessions, not only block new connections.
04最小机制：主交互能逐项验证Minimal Mechanism: Verify Each Link in the Interaction
MECHANISM
call_allowed = discovered ∧ authorizednow ∧
session_valid
连接服务器只让 discovered 变为真；撤销后
authorized_now 与 session_valid
立即为假，所以旧会话也不能续用。Connecting only makes discovered true. Revocation immediately
makes authorized_now and session_valid false, so an old session
cannot continue.
连接Connect服务器握手server handshake
发现Discover能力清单自动出现capability list appears
每次校验Authorize撤销即时锁定revocation locks immediately
05撤销 CRM 权限后，用旧会话再次调用Revoke CRM Access, Then Call Again from the Old Session
主动制造失败Create a failure边界实验Boundary experiment
若旧会话仍持有可用授权缓存，撤销就只是界面变化。实验必须显示工具锁定与调用拒绝同时发生。If an old session retains a usable authorization cache, revocation is merely cosmetic. The experiment must lock the tool and reject the call together.
尚未执行。先在主交互中观察正常机制。Not run yet. Observe the normal mechanism in the main interaction
first.
✗ 能力出现在清单里，就已获准调用。A listed capability is authorized.→ ✓ 清单用于发现；每次调用仍做当前权限检查。The list supports discovery; every call still checks current
access.
✗ MCP 会替业务定义工具含义。MCP defines business semantics.→ ✓ 协议统一连接面，业务约束仍由应用负责。The protocol unifies connections; the application owns business
constraints.
✗ 撤销只需影响新会话。Revocation only needs to affect new
sessions.→ ✓ 旧会话与缓存授权也必须即时失效。Old sessions and cached grants must be invalidated
immediately.
06 · 一句话带走06 · One line to keep