Drift ledger

Since tracking began, the crawler has observed 48,535 tools across 5,027 servers change their contract outside publisher-wide changes, 37,105 of them in a safety-relevant way. 29,079 of those 48,535 drifting tools have only ever changed with their declared version unchanged, where version evidence exists. 71 publisher-wide tool changes, each one publisher making a change of the same kind on at least 10 of its servers in one day, touched 77,817 tools, 839 of which also changed on their own. Counting every tool, the totals are 125,513 tools across 8,806 servers. Outside publisher-wide changes, 15,006 tools added an optional parameter, which a gate should let through silently; not crying wolf on benign change is the point. Here are the ones that would actually surprise an agent mid-session.

• 3,471 tools flipped a read-only hint toward write, delete, or send (the "read tool quietly became a write tool" case).
• 1,700 tools added a newly-required parameter, which breaks an agent still calling with last week’s arguments.
• 2,851 tools removed a parameter your agent may still be sending.
• 13,086 tools changed their output schema, the shape of what comes back.
• 3,876 tools narrowed a constraint, a tighter enum or range than you pinned.
• 2,869 tools changed a parameter’s type.

Auth is not built to catch this class of change. A server that edits a tool’s contract keeps its API key, its allow-list entry, and its name in your config - access control answers who may call a tool, not whether the tool still does what it declared when you connected it. The failure mode with MCP is rarely “I connected a bad server on day one.” It is “I connected a good server that changed on day 30.”

A contract diff, observed between snapshots. Not a safety verdict, not a claim any change is malicious, and not prevention: the ledger observes, the gate holds. Entries are fingerprints: keyed hashes of public registry names that anyone can recompute, so they identify a server without printing its name. Numbers update daily and are self-verifiable at /api/v1/ledger.