GrantTapGovernance · 2026-09-24 · 6 min read
Configured, available, used: three different facts
A practical way to read MCP and skill status without confusing a catalog entry with working execution.
A tool can appear in a catalog and still be unusable on the computer selected for a Task. It may be requested, approved, installed with a different configuration, missing a credential, or simply not initialized. A trustworthy control screen names these states separately.
GrantTap tracks capability identities, observed host state, and project decisions. The full bundle transfer and per-host durable apply receipts remain work in progress, so the UI must not label a requested MCP or skill as ready just because it was listed or approved.
Follow the capability through its lifecycle
First comes discovery: a host reports a native MCP configuration or skill bundle. A request brings that exact version or digest into a Project review. Approval allows that identity under the Project policy. Then each target host has to apply the configuration or bundle and independently report initialized state. Finally, real invocation evidence can show that a Task actually used it.
The same human-friendly MCP name can hide two different server configurations. For a skill, scripts and references matter as much as SKILL.md. An edit to the bundle changes the digest and requires a new readiness decision rather than inheriting an old approval by name.
Policy and environment are separate
Governance answers whether a capability may be used. Environment controls which approved process receives a value or reference. A masked field in Settings prevents casual viewing; it does not stop an agent with shell access to the same process from reading its environment. Use-only credentials require a trusted broker that performs a narrow operation without exposing the key to the model.
Likewise, observing token use is not a spending cap. A strict budget needs an atomic reservation before a controlled external action, accounting for work already in flight and unknown outcomes. These budget and use-only flows are still being built and should not be treated as active protection.
What to check today
Check the exact capability identity, the target computer, its observed configured and initialized states, the Project's allow/ask/deny decision, and the result of a small real invocation. If any state is unknown, keep it unknown. A green catalog card must not stand in for successful use.
For a local MCP connection, also verify the machine helper, transport, provider plugin, and app hooks independently. A relay connection does not prove that an stdio server launched in Cursor or that a Codex session loaded newly trusted hooks.