Whose Stranger Is It? Model-Side Trust Evaluation and Just-in-Time Consent for Dynamically-Discovered MCP Servers

Version 2 (technical paper). Substantial expansion of the v1 vision paper: (1) reframed as a technical paper; (2) adds origin-binding — a deterministic admission gate binding the connect decision to the user-named origin (Rule 0); (3) adds a composed-system safety theorem proving the model+guardrail composition never executes an unsafe action for an arbitrary, even adversarially-controlled model; (4) the proof-of-concept harness now enforces the revoked/scope/consent boundaries (G1–G3) deterministically outside the model; (5) the live benchmark is reported as a range over 10 runs (EXACT 91.7–93.8%) with a critical false-connect rate of 0/48 in every run. The v1 record (DOI 10.5281/zenodo.20787541) is retained unchanged and holds priority for the layer definition, decision procedure, and dominance properties.