Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Feature: Contract verification panel (pin tool contracts, diff on reconnect)

クローズ
  • 何か問題がありますか？
#2,727 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
45/100
issue の種類
機能追加
明瞭さ
おおむね明確
活発さ
活発
技術スタック
typescript
領域
developer-experience, security, testing-qa

調査の方向性

Start by tracing the Inspector’s existing tools, resources, prompts, and reconnect flows, then read the linked PIN-SPEC and reference implementation for hashing and comparison behavior. Identify the UI entry point and existing test locations for connection and inspection features. Done means a connected server can pin canonicalized contract hashes, compare them after reconnect, and display added, removed, and changed tools with the proposed direction grading.

索引モデルが issue の本文から書いたものです。

説明

Feature: Contract verification panel (pin tool contracts, diff on reconnect)

Problem

The Inspector shows a server's current tools, resources, and prompts at a point in time. But there is no way to know if the tool contracts changed between sessions. MCP servers can silently add, remove, or modify tool definitions between connections (deploy, version bump, feature flag), and the Inspector has no mechanism to surface this.

We ran a drift watch over 24 popular MCP servers for two months and found 336 silent contract changes, including silent tool removals (Shopify dropped two validators, HubSpot removed a tool with no release notes channel). Full corpus: rugsnare drift-watch.

Proposal

Add a "Contract" tab or panel that:

  1. Pins the surface on first connect: hash each tool's {name, description, inputSchema} by canonicalized sha-256
  2. Compares on reconnect: after a server restart/reconnect, diff the current tools/list against the pinned snapshot
  3. Surfaces changes: show added / removed / changed tools with direction grading (breaking, loosened, expanded, cosmetic)

This would complement the Inspector's existing inspection capabilities with a temporal dimension: not just "what does this server expose" but "has what it exposes changed since I last looked."

Reference implementation

We ship a standalone CLI that does exactly this (rugsnare, Apache-2.0, zero dependencies). The Inspector could either integrate the hashing/comparison logic directly or shell out to rugsnare as an optional dependency. The pin format is an open spec (PIN-SPEC) with a POLICY class for verifier upgrades and an IDENTITY class for deployment changes.

Use cases
  • Developer: connect to a dev server, pin, upgrade the server, reconnect, see what changed before your agent does
  • Security reviewer: pin a production server, monitor for contract drift as part of an audit
  • CI gate: the same pins can be used in CI to fail builds on breaking contract changes

The OWASP MCP Security Cheat Sheet now recommends pinning tool contracts (PR #2764, merged; cheat sheet), so this aligns with where the ecosystem is heading.

主要言語
TypeScript
スター
11.1k
フォーク
1.6k
平均マージ
5時間 38分
マージ済み PR（30日）
152

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

modelcontextprotocol/inspector のほかの issue

modelcontextprotocol/inspector の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。