Can an MCP tool change after your agent trusts it?
A measured answer. 205 tools declared themselves read-only and then flipped that hint toward write, delete or send, with the same name and the same key in your config. This film shows what a tool contract is, why access control and version pinning both miss a contract change, and how an in-path gate pins each contract, diffs it on every call, and stops the call when it changes. It is a contract-diff, not a safety verdict, and the film says where it stops. Figures are stated as of the date shown; the live record is at mcpindex.ai/ledger.
What happens, and when
- THE HOOK0:00
- WHAT A CONTRACT IS0:12
- WHY NOTHING YOU ALREADY HAVE CATCHES IT0:21
- PIN, DIFF, THREE OUTCOMES0:42
- TWO LIMITS, STATED PLAINLY1:04
- WHAT IT IS, AND IS NOT1:25
- CLOSE1:40
Full transcript
Timestamps match the key moments above. Figures spoken in the film are stated as of the date shown on screen - they are measurements, not live numbers. The live record is in the public ledger.
Two hundred and five tools told your agent they were read-only. Then that hint flipped to write, delete, or send. Same name in your config. Same key. No version bump.
On screen: 205 tools declared read-only · as of 2026-08-05 · Then the hint flipped: write · delete · send. · Same config. Same key. MCP tools can change with no version bump.
A contract is what a tool tells your agent it does. Its name, its parameters, what it promises to touch.
On screen: contract = what a tool tells your agent it does · 23,617 tools drifted · 6,882 changed a contract field we surface · 1,170 of 4,869 servers ever reachable · 3,892 safety-relevant, not confirmed vulnerabilities · as of 2026-08-05
Access control answers who may call a tool, not whether it still does what it declared. And a server launched at latest re-resolves every time, so there is nothing pinned to begin with. Where there is, across the remote servers we crawl, nearly three quarters of the drifting tools we could check had only ever changed with the server's version unchanged.
On screen: Auth answers WHO may call. · Not WHETHER it still does what it declared. · /scan: "4,982 of 6,882 drifting tools have only ever changed with their declared version unchanged, where version evidence exists" · check your mcp.json: does it say @latest? · mcpindex.ai/ledger · as of 2026-08-05 · pinning a package freezes the code, not a remote server's contract · mcpindex.ai/scan · as of 2026-08-05
The gate pins each tool's contract on first sight, then diffs it on every call. An added optional parameter proceeds without interrupting you. A change that would surprise your agent stops the call on your machine. When only behaviour could settle the question, the gate refuses to guess. It returns inconclusive, and the call still stops.
On screen: Pin on first sight. · added-optional-param → proceeds · baseline re-pinned automatically · Review · Re-pin · Reject · mcpindex.ai/install
Two limits. If a tool was already lying when you pinned it, the gate pins the lie: your baseline is what you first saw. And a read-only hint is self-declared, so behind some of those two hundred and five was a maintainer fixing a wrong label. The gate cannot tell which, so it stops the call instead of judging it.
On screen: The baseline is what you first saw. · readOnlyHint is self-declared. A maintainer fixing a wrong label flips the same bit. · three outcomes, not two: PROCEED · HOLD · INCONCLUSIVE · annotation flip → INCONCLUSIVE · fail-closed · the call still stops
It is a contract diff, not a safety verdict. It tells you what changed, never that the change is safe. What makes that worth having is where it sits: in the call path, so an advisory judgment still stops the call.
On screen: Contract-diff, not a safety verdict. · Advisory judgment. In-path HOLD. · Deterministic diff. No model in the default path. · Your host. Zero credential custody. · MIT licensed · readable Python, no compiled blob
Free, no account, runs on your machine. Two commands to install it, one command to take it back out. Start at mcpindex.ai/install.
On screen: uv tool install mcpindex-gate · mcpindex-config-wire · default build egresses nothing · free · no account · reversible · mcpindex.ai/install · whichever way you build, there is a version for you →