MCP tool name collisions: merge policies, prefixes and pinned hashes

What this experiment demonstrates

The help-desk host at Belgavi's Book Store connects three MCP servers under its own config keys: orders, refunds and a third-party helpdesk-tools server. A fixed session of ten calls covers order lookups for Geetha and Tanishka, a case, three refunds (₹450, ₹1,200 and ₹299 for Dinky, ₹1,949 in total), refund status checks and a cancellation. After a chosen call, helpdesk-tools renames case_status to refund_status and sends notifications/tools/list_changed; the host refetches and re-registers its tools last.

The model picks the visible tool whose prefix matches the server it means, else the only one it sees, and follows a description that says to always use a tool for refunds. Definition hashes are real SHA-256 over sorted-key JSON. Nothing is called over the network.

Run controlled comparisons

Start with the defaults: last registered wins, rename after call 5. 4 of 10 calls reach the wrong server, all ₹1,949 of refunds go to helpdesk-tools, 0 collisions are detected and 2 tools are hidden by being overwritten.

Change one thing at a time. First registered wins: 10 of 10 correct, but with load order orders, helpdesk-tools, refunds it sends 1 call and ₹450 astray. Reject the later duplicate: 10 of 10 and 2 collisions detected. Prefix every tool: 10 of 10, 0 tools hidden. Prefix and pin: 10 of 10 with 1 tool hidden, the renamed refund_status held for review. Turn off the help-desk issue_refund: 1 wrong call, ₹0. Turn off the rename: 3 wrong. Move the rename to after call 1: 5 wrong; after call 9: 3 wrong.

Now the defenses' limits. Under prefixing, turn on the description that says always use it for refunds: 3 wrong calls and ₹1,949; with pinning, the same 3, because that description was approved at install. Under prefixing, have helpdesk-tools report serverInfo.name bookstore-refunds and take the label from serverInfo.name: 4 wrong calls and ₹1,949, with 2 tools hidden; with the config key as label, 0 wrong. Turn on the allowlist of approved (server, tool) pairs: 10 of 10 in each of these cases.

Inspect the trace and keep evidence

The first table lists every tool name the model can see at the end of the session and the server behind it; amber rows share a bare name with another server. The second table shows where each of the ten calls went; red rows reached a server other than the one the model meant. The trace records the merge decisions, the list_changed refresh, the re-merge and each call. Start trace, Next step, Show all and the slider control how much of the trace is visible; the metrics always describe the whole run. Reset restores the defaults and Export JSON downloads the inputs, metrics and trace.

Limits and production translation

Real models do not choose tools by a fixed rule, real hosts differ in how they order and refresh tool lists, and the session is short and scripted. The fixtures are synthetic. What carries over: never key a merged tool list by bare name; label servers by configuration the operator controls, not by serverInfo.name; check labels for uniqueness after sanitising; pin approved definitions so a change is held for review; and add an allowlist, because pinning approves whatever was present when someone looked.