CxBOM: A Context Bill of Materials and Signed Tool-Definition Pinning for LLM Agents

An LLM agent's context window is assembled from parts with different origins: operator instructions, tool definitions published by third parties through the Model Context Protocol (MCP), retrieved documents, tool outputs and user turns. Scaled dot-product attention takes no provenance input, so inside a standard transformer a trust distinction between them is at most a learned tendency, not an enforced boundary. We design and implement two mechanisms outside the model: a record that evidences provenance where the context is assembled, and a proxy that enforces approval at the MCP boundary. The Context Bill of Materials (CxBOM) records, in a format based on CycloneDX, every component assembled into a window: its trust ring, provenance, content digest and the controls applied to it. A preview pinning proxy for MCP refuses server launches that differ from a signed operator approval and, in enforce mode, withholds tool definitions and server instructions that differ from it, including a definition changed on a re-listing mid-session. Of the 23 in-scope attacks in our threat model, this version refuses 14, each shown by a passing test, refuses 1 in part, and leaves 8 open. The emitter and proxy pass 1,691 of 1,692 cases in their own test suite (1 skipped), including randomized and fault-injection tests. On a 46,205-token reference session, the emitter gives every component the ring, token count and digest of an earlier emitter's published record, and assembles, tokenizes and emits it in a median of 75 ms on one machine. We also give a trust-ring model of context assembly that grounds the record's fields, and the Dual-Failure Multiplier, a hypothesis that accumulating untrusted demonstrations degrade task quality and safety together, with a design that tests part of its attack half. Effectiveness in deployment, forensic utility, cost and the hypothesis are not yet measured. Reference implementation: https://github.com/CXBOM/cxbom-reference (tag v0.3.0).