Can MCP tool approvals hide Unicode TAG payloads from humans while still feeding them to the model? Apparently yes.

Paper on FSTP, a federated transport layer with type-level data confinement and Blocklace logs, because policy was too messy.

So this is where Cardano Leios gets beat up by IO and SPOs before mainnet, right?

Eight security invariants, because MCP tool connections apparently weren’t enough, and the paper benchmarks HCP against baselines.