Tool shadowing

Two MCP servers both offer send_email. If a pin only remembers the name, the second server's definition can replace the first, and from then on it "verifies".

That is what DriftGuard 1.0.0 did: server_id was stored but never used, so the shadowing defence its own README described did not exist (blind cases shadowing_*). Since 1.1.0 a pin is keyed by your key, the server and the tool. Verify with server_id compares against that server's pin; without it, DriftGuard uses the one server that pinned the tool, and refuses (409, listing the servers) when two or more did.

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.