MCP wrappers can miscount reservations, effects, price and audit entries

Definition & limits

A wrapper may reserve a request budget before dispatch and reserve it again in a nested tool handler, resulting in a denial even though only one side effect is attempted. Another entry point such as keyword tool search can skip the common reservation, billing or audit path entirely. Request acceptance, executed operation, completed operation, pricing and recorded evidence must therefore be reconciled by one stable operation identity and consistent accounting lifecycle, rather than inferring effects from API request counts. LiteLLM's separate keyword-search and virtual-call reports illustrate opposite failures, not one shared exploit.

A wrapper is not necessarily an additional billable action. In the reported LiteLLM mcp_tool_call path, one logical tool invocation traversed two pre-call limit checks but did not inherit the direct tool's configured price or spend log. This can cause both false refusals and understated spend without bypassing the final tool authorization. The corresponding keyword search path had the inverse problem: accepted requests lacked quota and audit accounting. Qualification must reconcile one requested effect, one actual execution, reservation release, one charge and an attributable audit record across both routes.

Examples

• [Unmetered keyword search](db:CASE-2026-LITELLM-MCP-SEARCH-QUOTA).
• [Double reservation and missing spend](db:CASE-2026-LITELLM-MCP-VIRTUAL-ACCOUNTING).

Explicit mappings

Research using this topic (1)