Your AI agent is likely executing instructions you never read, let alone approved. A new audit by the Paraphern team, using a CLI tool called rugsnare, pinned the tool contracts of 24 popular Model Context Protocol (MCP) servers and diffed every release over two months. The result is a stark reality check for the AI agent ecosystem: 336 contract changes occurred across servers with a combined install base of 3.6 million weekly installs. These changes ranged from subtle schema loosening to breaking removals, all happening without explicit user consent or visible announcement.

The Silent Drift of Tool Contracts

MCP servers expose tools to AI agents via specific contracts: a name, a description the model reads to decide how to call it, and an input schema defining valid arguments. When you install an MCP server, you approve that specific snapshot. However, when vendors publish new versions, the tool names often stay the same while the underlying descriptions and schemas mutate. rugsnare grades these changes by direction, identifying BREAKING changes where constraints tighten, LOOSENED changes where constraints drop, and EXPANDED changes where new optional parameters widen the attack surface. The tool exits with an error code on any drift, serving as a CI gate for production environments.

Case Studies in Chaos

The audit highlights specific vendors where this drift is most pronounced. MongoDB 3.0.0 regenerated all 20 tool schemas at once, hiding five real constraint tightenings inside fifteen notation-level changes, all with empty GitHub release notes. Currents changed 45 input schemas between versions 2.3.3 and 2.7.0, with 32 being constraint tightenings. When contacted, the maintainer argued the backend already enforced these rules, but the schema change still rejects calls that previously succeeded, a gap unmentioned in release notes. Shopify removed two specific validators, replacing them with a generic one, causing agents calling the old tool names to hit protocol errors. HubSpot removed create-association and added new workflow tools, with no announcement channel since their linked GitHub repository is dead.

Structural Failures in the Ecosystem

Three patterns repeat across the ecosystem. First, the 'notation wave,' where SDK migrations change schema bytes without semantic changes, creating noise that masks real drift. Second, the 'consolidation break,' where vendors remove specific tools for generic ones, breaking agents that rely on exact tool names. Third, the 'silent loosening,' where constraints are dropped, widening the attack surface without breaking visible functionality. Bybit’s remote manifest gate even forces version enforcement, skipping integrity checks if the service is unreachable, while GitHub’s official MCP server changed 124 of 131 tool definitions in v2.0.0, described by maintainers as 'broadly a noop' despite the massive contract churn.

Key Takeaways

  • rugsnare identified 336 contract changes across 24 MCP servers in a two-month window.
  • Major vendors like MongoDB, Shopify, and HubSpot made breaking or silent changes without release notes.
  • The OWASP MCP Security Cheat Sheet now recommends pinning tool contracts to detect this drift.
  • Currents maintainer acknowledged schema tightenings but argued backend enforcement existed, highlighting the gap between schema and runtime behavior.
  • rugsnare is Apache-2.0 licensed, has zero npm dependencies, and includes an open PIN-SPEC for interchange.

The Bottom Line

If your agent’s behavior changes overnight, it’s not magicβ€”it’s drift. Pin your contracts, diff your upgrades, and stop trusting vendors to announce the silent rewiring of your agent’s brain.