This seems like a fundamental misunderstanding / over estimation of the guarantees OAI and MCP can offer. If 'confirmation' is a separate tool call ... it's a separate tool call. There's no scoping, there's no 'binding', nothing. When you hand control back to the model you hand control back to the model.

MCP has no binding, correct, and the model does not route. But the host routes. Every call goes through one connector and one (OAuth) client, and the host knows which. It picked another client/connector silently, with the one-time code from connector A's widget, and told the user nothing. That is a host decision and not a protocol limitation.

[flagged]