You pin your npm dependencies. You have a lockfile. You review the diff when it changes.
Now consider the MCP servers your agent depends on. What pins those?
tools/list hands back names, descriptions, and JSON schemas, and your agent trusts all of it. The description isn't documentation — it's the instruction the model reads to decide what a tool does and when to call it. There's no version pin, no integrity check, no diff to review. The server changes, and your agent's behaviour changes with it.
Four ways an MCP dependency breaks you quietly
1. A description is rewritten. Same tool name, same schema, different text. The model now behaves differently and nothing registers a change. This is the one that matters most, because it requires no schema change at all — which is exactly why schema-only diffing misses it.
2. A required parameter appears. Your existing calls start failing with invalid params, and you find out from production traffic.
3. readOnlyHint flips from true to false. A tool you allow-listed as safe to call freely can now mutate state.
4. A tool disappears. Best case, a clean error. Worst case, your agent improvises with something else.
Prior art, up front
has detected description changes via tool hashing since April 2025. If you want to audit the MCP servers installed on your own machine, that's the tool — it scans Claude, Cursor, and Windsurf configs, detects cross-origin escalation (tool shadowing), and offers a proxy mode with live guardrails. None of which I do.
I needed something adjacent: a CI gate. Not "is my laptop safe," but "did this dependency's contract change since my last release." And it had to run against internal servers without sending tool descriptions to anyone's API.
So I built
If you've been bitten by description drift in practice — or if you think I've drawn the breaking/non-breaking line in the wrong place — I'd like to hear it.
SOCIAL SHARE CARD GENERATOR