MCP has no binding, correct, and the model does not route. But the host routes. Every call goes through one connector and one (OAuth) client, and the host knows which. It picked another client/connector silently, with the one-time code from connector A's widget, and told the user nothing. That is a host decision and not a protocol limitation.