MCP spec 2026-07-28 — -12 days left

MCP toolguard

Contracts, drift and security for MCP servers — in CI and in production.

No signup · 30 seconds · or in your terminal: uvx mcp-toolguard scan <target>

mcp-toolguard scan
The problem

A silent rename. All your agents broken.

An MCP server can change its contract on any deploy. It breaks no build and trips no type-checker: it breaks your agents in production, silently.

  1. 1The server ships v2.5.0: query becomes search_query. Nobody announces it.
  2. 2Your agents keep calling with query. Every invocation fails. You find out from your users.
  3. 3With ToolGuard on the PR, the breaking change is visible, discussed and blocked before the merge.
tools/search · inputSchemav2.4.1 → v2.5.0
{ "type": "object", "properties": { - "query": { "type": "string" },+ "search_query": { "type": "string" }, "limit": { "type": "integer" } }, - "required": ["query"]+ "required": ["search_query"]}
agent · production03:12 AM
Search the docs for "streamable http"
McpError: Invalid params — unknown parameter 'query'
pull request #142 · checkstoolguard-io/action@v1
✗ToolGuard — 1 breaking change
tools.search.inputSchema: 'query' removed (breaking)
Merge blocked. Accepting = baseline --update, visible in review.
One engine, three layers

Contracts, drift and security.
One single engine.

connect→snapshot→diff→rules
01 · Contracts

The contract lives in your repo

A canonical snapshot of tools, schemas and capabilities. Validated against the spec matrix: the current version and 2026-07-28.

02 · Drift

Every change, classified

Breaking, compatible or suspicious. In CI through the Action; in production through scheduled checks and alerts.

03 · Security

Tool poisoning, watched

15 rules against injection and exfiltration. The baseline is the accepted state: only new findings block.

.toolguard/baseline.jsoncommitted in your repo
{"content_hash": "sha256:a3f29c1…", "server": "acme-mcp 2.4.1", "protocol_version": "2025-11-25", "tools": [ 8 tools ]}
spec matrix → ✓ 2025-11-25 · ▲ 2026-07-28: logging deprecated (SEP-2577)
mcp-toolguard diffbaseline → now
breakingtools.search.inputSchema: 'query' removed
suspicioustools.fetch.description: text changed
compatibletools: + 'get_status'
in CI: policy breaking → fails · in production: Slack alert within minutes
mcp-toolguard scan · TG1xx–TG3xx15 rules
highTG201 · credential-shaped parameter in inputSchema
mediumTG103 · cross-tool coercion: "Always use this tool…"
lowTG107 · invisible characters in description (U+200B)
the baseline is the accepted state → only new findings block
Features

Everything it watches, explained.

The same engine, layer by layer: what it captures, what it compares and what it blocks.

Snapshot & baseline

Your server's contract, committed

A canonical snapshot of tools, schemas, capabilities and instructions, with a deterministic hash. It lives in .toolguard/baseline.json, versioned with your code: the contract gets reviewed where everything else does — in the PR.

.toolguard/baseline.jsongit
{"content_hash": "sha256:a3f29c1…", "server": "acme-mcp 2.4.1", "tools": [ 8 tools ]}
✓ deterministic — same server, same hash
protocol 2025-11-25 · 8 tools
Classified diff

Every change gets a surname

Not a text diff — a semantic diff of the contract. Removals and type changes are breaking; additions are compatible; and text that reaches the model's context — descriptions, instructions — is flagged suspicious: that is the prompt-injection surface.

mcp-toolguard diffbaseline → now
breakinginputSchema: 'query' removed
suspiciousdescription: text changed
compatibletools: + 'get_status'
optional→required = breaking
in CI: audit · breaking · strict
Security

15 rules against tool poisoning

Imperative instructions to the model, hidden tags, cross-tool coercion, credential-shaped parameters, invisible characters. Every finding ships its evidence — and the baseline is the accepted state: only new findings block your CI.

TG1xx–TG3xx15 rules
highTG201 · credential-shaped parameter
mediumTG103 · "Always use this tool…"
lowTG107 · invisible characters (U+200B)
evidence included, zero empty claims
✓ calibrated against real servers
Spec matrix

Ready for 2026-07-28 before July 28

Every snapshot is validated against two MCP spec versions at once: the current one and the next. One independent report per version — you know today exactly what breaks tomorrow.

spec matrix2 versions
✓ 2025-11-25 no errors▲ 2026-07-28 1 error — logging capability deprecated (SEP-2577)
-12 days left
SEP-986 · SEP-2106 · SEP-2577
Drift in production

Once deployed, we keep watching

Scheduled checks against your servers — and the third-party ones you depend on. If the contract shifts under your feet, the alert reaches you in minutes, not when your agents start failing.

#mcp-alertsSlack · webhook
09:41▲ toolguard — acme-mcp: 1 breaking — 'query' removed · view diff →
09:41baseline a3f29c1 → snapshot 9d04e7b · 2 min ago
every 5–15 min by plan
your servers and third-party ones
In your CI in 2 minutes

Two snippets. Zero infrastructure.

  • Pass/fail check + a single self-updating PR comment.
  • The baseline lives in your repo: the free tier works 100 % offline.
  • Accepting a breaking change is a visible commit in review.
  • Open source, MIT — pip install mcp-toolguard
# .github/workflows/toolguard.ymlname: ToolGuard on: [pull_request] jobs:contract:runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: toolguard-io/action@v1 with:target: "python -m my_mcp_server" # or an http(s) URLpolicy: breaking # audit | breaking | strict
exit 0 ok · exit 1 policy · exit 2 operational — fits any CI
Pricing

Transparent. Self-service.
No “book a demo”.

The unit of value is the monitored server. Unlimited seats on every paid plan: alerts must reach the whole on-call rotation.

Free during the campaign: we watch your 2026-07-28 readiness — up to 3 servers, weekly re-checks, and the verdict against the final spec on July 28 itself. Until August 31.
Free
$0

To try it out, and for any repo's CI. 100 % offline.

  • 1 monitored server
  • Daily check
  • 7-day history
  • Email alerts
  • Basic findings on scan
  • README badge
PopularDev
$19/mo

For anyone publishing or seriously depending on MCP servers.

  • 5 monitored servers
  • Check every 15 min
  • 90-day history
  • + Slack and webhooks
  • Continuous security rules
  • CI ↔ production correlation
Team
$79/mo

For teams with server fleets and on-call rotations.

  • 25 monitored servers
  • Check every 5 min
  • 1-year history
  • + severity-based alert routing
  • + OWASP report with trends
  • Per-environment baselines
Enterprise
~$500/mo

Custom: large fleets, compliance, on-prem.

  • Custom servers and frequency
  • + PagerDuty, SIEM
  • + custom rules, evidence export
  • Multi-org
  • SSO/SAML

Annual: 2 months free · USD, automatic tax · cancel anytime