Directional Contract Transition Revalidation for Model Context Protocol Tools: An Approval Continuity Framework for Evolving Agent Capabilities

Model Context Protocol (MCP) clients may approve a Tool whose authenticated, client-visible contract later changes. Directional Contract Transition Revalidation (DCTR) retains grant-bound operational and last-human-reviewed baselines, canonicalizes contracts with RFC 8785/JCS, and assigns L0–L4 renewal actions to typed directional changes. Because a maximum of individual path levels can miss jointly introduced behavior, the final proposed DCTR-IA-2.0 decision rule requires a hash-bound whole-contract assessment for multi-path or coupled schema changes in either the local or cumulative delta; unresolved cases remain pending human reapproval. With official MCP Python SDK clients, this gate withheld the original compound counterexample in simultaneous and sequential forms and a four-case SDK outcome matrix (one reusing the paired field pattern and three testing different mutation types); three benign controls also incurred review. On 20 natural N2 Tool transitions (43 changed paths, 14 maintainer clusters), a reproducible structural replay routed 14 contracts to whole assessment, without establishing natural interaction severity or unnecessary review rates. Independent expert agreement was 28/34 paths in the frozen held-out study (weighted κ = 0.720), 18/21 in the separate pilot, and 37/48 (κ = 0.710 on 47 ordinal pairs) across 20 selected N3 transitions in eight repositories; jointly assigned L3 paths occurred in 11 clusters across five repositories, with ten subsequently documented casewise panel agreements and one separately documented DEFERRED case; the author-submitted post-review tally classifies 47/48 (L0 = 3, L1 = 5, L2 = 19, L3 = 20, L4 = 0) without assigning a level to N3K0023 or claiming independently authenticated expert sign-offs or natural L4. A separate selected Study B yielded 10/10 agreement distinguishing six adapted R4/L4 poisoning stimuli from four disclosed R3/L3 controls. These controlled assessments and enforcement tests do not establish autonomous semantic risk detection, reduced production reapproval burden, or prevented harm. ETDI and Microsoft contrasts are comparisons of policy design only.