Pin your MCP server contracts the way you pin your dependencies

Short summary

MCP servers that AI agents depend on have no version pinning or contract enforcement, meaning silent description changes or schema modifications can alter agent behavior without detection. The author built mcpward, a CLI tool that snapshots MCP server contracts into a lockfile and fails CI builds on breaking drift, classifying changes as breaking, rug-pull, annotation change, or non-breaking. It also checks protocol compliance, the two-layer MCP error contract, and tool-poisoning heuristics with SARIF output for GitHub Security integration.

• •MCP server contracts are unpinned — description or schema changes silently alter agent behavior
• •mcpward snapshots tool contracts and fails CI on breaking drift, rug-pulls, and annotation changes
• •Also validates protocol compliance, error contract correctness, and tool-poisoning heuristics

Generated with AI, which can make mistakes.