Drift ledger

Since tracking began, the crawler has observed 19,313 tools across 2,958 servers change their contract, 12,589 of them in a safety-relevant way. 13,151 of the 19,313 drifting tools have only ever changed with their declared version unchanged, where version evidence exists.Most drift is harmless: 7,641 just added an optional parameter, and a gate should proceed silently on those. Not crying wolf on benign change is the point. Here are the ones that would actually surprise an agent mid-session.

• 616 tools flipped a read-only hint toward write, delete, or send (the "read tool quietly became a write tool" case).
• 818 tools added a newly-required parameter, which breaks an agent still calling with last week’s arguments.
• 1,158 tools removed a parameter your agent may still be sending.
• 4,671 tools changed their output schema, the shape of what comes back.
• 1,223 tools narrowed a constraint, a tighter enum or range than you pinned.
• 759 tools changed a parameter’s type.

Auth is not built to catch this class of change. A server that edits a tool’s contract keeps its API key, its allow-list entry, and its name in your config - access control answers who may call a tool, not whether the tool still does what it declared when you connected it. The failure mode with MCP is rarely “I connected a bad server on day one.” It is “I connected a good server that changed on day 30.”

A contract diff, observed between snapshots. Not a safety verdict, not a claim any change is malicious, and not prevention: the ledger observes, the gate holds. Every entry is a fingerprint, never a named server. Numbers update daily and are self-verifiable at /api/v1/ledger.