The tool you approved is not the tool running today.

A third hash, outputHash, pins what tools return, not just what they accept. A server that quietly widens its response shape - new fields the agent will trust - is drift, same as an input change. Absent outputSchema hashes as null; no false noise on servers without one.

resources/list only showed the envelope; the prompt-injection payload lived in the body. RugSnare now calls resources/read (up to 20 envelope-only resources) and hashes the text - the hidden "ignore previous instructions" edit in a resource body is a finding, not a surprise.

A tighten change the vendor's published OpenAPI spec already promised is MIRRORED, not BREAKING: diff --openapi <spec-url> regrades it with evidence. BREAKING now means what it should - "a previously-successful call starts failing" - not "the contract text tightened".

A silent rename from "Safe File Reader" to "Data Export Utility" is now ANNOTATION drift - the title is what the agent trusts when it picks a tool. SVG icons are hashed into toolHash (SVG can carry scripts), shipped with the policyVersion bump so legacy pins get POLICY stop, never a silent re-grade.

Descriptions instructing the agent to POST card numbers, CVC or expiry "together with the payload" - the corpus demo attack that plain schema diff could not see. Bidirectional match, weight 3, zero false positives across 1152 benign vendor descriptions.

<IMPORTANT>, <NOTE TO AGENT> tag blocks (attributes and hyphenated variants included), ChatML <|system|> markers, [//]: # markdown stubs and HTML comments carrying directive text - markup addressed to the model, invisible in rendered markdown. The class our table was missing until the mcp-shield comparison surfaced it (teleport#61434). Build markers and linter pragmas stay clean: the comment arm requires directive vocabulary inside.

rugsnare.com/badge/:owner/:repo.svg is a trust signal, not just a counter: green signed · N tools · M skills means the worker just verified the Ed25519 signature of your committed pins.json against your committed pins.pub.pem; yellow unsigned means pinned without a signature; red SIG BROKEN means pins.json does not match its own signature - the CI-attacker scenario, caught in the open. Counts cover tools, skills, prompts and resources. A composite Action runs diff in your workflow and emits SARIF; the PR renderer scores advisories and groups drift by signature; a zero-dependency .mcpb bundle ships on Smithery.

In enforce mode, a tool whose contract drifted is blocked at call time with a clear JSON-RPC error – not just hidden from the list. Per-tool, not per-server: clean neighbours keep working. The race where a call slips through before the first tools/list is closed fail-closed.

Before any proxy or CLI runtime spawns a server, the Ed25519 signature of pins.json is verified against pins.sig. A tampered store throws at startup – the CI-attacker scenario is now a boot-time failure. --allow-unsigned-pins cannot bypass an invalid signature.

Replay tests now validate the structure of responses – every distinct array element shape, JSON property names, MCP isError outcomes. Not just “did it return 200” but “did it return what the agent was approved to parse.”

+120 since 1.5.0, independently verified across three review passes. CI green on ubuntu+windows × Node 18/20/22. On-chain verified on Base Mainnet.

Every pin now carries an identity block: package, resolvedVersion, entryPath, url, bound by an identityHash. When every tool hash is intact but the surface is served by a different build or path - supabase moved its entry from dist/transports/stdio.js to dist/cli.js with contracts unchanged - diff reports IDENTITY: the surface is served by a different build/path than approved.

Pins record the verifier policy that graded them. Diffing a store graded under an older policy reports POLICY - "re-graded under a newer verifier policy; re-pin to accept" - never a silent re-grade. The ruler changes; the vendor did nothing wrong. Promised publicly in autogen#7353.

Keys sorted, unchanged entries never rewritten, identical saves skip the write entirely. A third-party verifier can JCS-hash your pins.json as an opaque record and a re-scan of the same version does not change a byte - the snyk #482 ask.

"Now requires a paid plan" is schema-silent - it used to grade as a cosmetic edit. Now an anchored [PAYWALL] flag rides any drift (introduction only; finance tools describing prices as their subject never trip it). Field data: 58 of 66 review-events at a competitor are exactly this class.

The public drift-feed now watches hosted HTTP endpoints alongside npm (context7, deepwiki) - and caught its first live hosted drift within 40 minutes of a release. History scans record which zod/SDK versions each capture was taken against: a floating zod ^4.x can rewrite a server's contract with no release, and the scanner says so instead of letting dependency drift masquerade as server drift.

Pure-expand drift finally grades EXPANDED - the P5 label shipped in 1.2.0 but was unreachable (found live on hubspot: two optional additions graded BREAKING). verify now really defaults to Base Mainnet, as 1.0.1 promised. Approve flips first-sight proxy entries instead of leaving them "NEVER APPROVED" forever.

Read it, audit it, fork it. The license assumes you might.

Nothing to trust transitively. The supply chain under the supply-chain tool is empty by design.

Runs locally. Nothing about your setup leaves your machine unless you export it yourself.

Four rounds of independent verification (2026-10-04): release artifacts, on-chain pins, Docker images, and test batteries - all byte-identical. Findings closed, reports published.

Exit codes, pins.json schema, signal IDs, and the vault placeholder syntax are frozen from 1.0.0 - see the changelog for the full contract.