Drift ledger

Since tracking began, the crawler has observed 5,056 tools across 1,043 servers change their contract, 2,668 of them in a safety-relevant way.Most drift is harmless: 2,374 just added an optional parameter, and a gate should proceed silently on those. Not crying wolf on benign change is the point. Here are the ones that would actually surprise an agent mid-session.

• 118 tools flipped a read-only hint toward write, delete, or send (the "read tool quietly became a write tool" case).
• 98 tools added a newly-required parameter, which breaks an agent still calling with last week’s arguments.
• 212 tools removed a parameter your agent may still be sending.
• 984 tools changed their output schema, the shape of what comes back.
• 146 tools narrowed a constraint, a tighter enum or range than you pinned.
• 77 tools changed a parameter’s type.

Auth is not built to catch this class of change. A server that edits a tool’s contract keeps its API key, its allow-list entry, and its name in your config - access control answers who may call a tool, not whether the tool still does what it declared when you connected it. The failure mode with MCP is rarely “I connected a bad server on day one.” It is “I connected a good server that changed on day 30.”

A contract diff, observed between snapshots. Not a safety verdict, not a claim any change is malicious, and not prevention: the ledger observes, the gate holds. Every entry is a fingerprint, never a named server. Numbers update daily and are self-verifiable at /api/v1/ledger.