githubMCP-security
RugSnare: pin MCP tool contracts and catch silent drift
Show HN (Oct 17): RugSnare pins each MCP tool's {name, description, inputSchema} by canonicalized SHA-256 at install, then diffs upgrades across 24 popular servers (~3.6M weekly installs)—336 contract changes found; grades BREAKING/LOOSENED/EXPANDED/NOTATION/COSMETIC and exits 1 for CI. Apache-2.0, zero npm deps; OWASP MCP Security Cheat Sheet now recommends contract pinning.
RugSnareMCPClaude Code+2