Who Approved That MCP Server? Governing the Tool Layer