Tool contract drift between v1.x and v2.x: 22 changes found (receipts inside) #476

Tool contract drift between v1.x and v2.x: 22 changes found (receipts inside)

We pin MCP tool contracts (name + description + inputSchema, sha-256 per tool) at approval and diff on update. Running this between v1.4.1 and v2.2.1: 22 findings. The release notes for v2.0.0 mention "major overhaul" but don't detail the contract surface.

What changed

17 description rewrites (COSMETIC) across the testing suite: accessibilityExpert, createTestCase, updateTestCase, listTestCases, createTestRun, listTestRuns, updateTestRun, addTestResult, listTestPlans, getTestPlan, listSubTestPlans, getSubTestPlan, createLCASteps, listFolders, createProjectOrFolder, uploadProductRequirementFile, listTestCases. All these tools' descriptions were rewritten between v1.x and v2.x.

1 BREAKING schema change on askBrowserStackAI:

• 3 new optional parameters: run_id, perm_id, decision
• New data channels on the AI assistant tool

5 new tools added:

• listProducts, describeEntity, searchCapability, describeCapability, invokeCapability

A new capability-discovery API layer, arriving alongside 46 existing tools. No mention of these in the v2.0.0 release notes that I can find.

Why this matters

40 releases in the last 30 days (73 stable versions total) means the contract surface moves constantly. Teams that pin tool definitions for injection review were forced into a full re-review by v2.0.0. Teams that don't pin absorbed 17 rewritten descriptions into running agents. Most teams don't know which group they're in.

Grading suggestion

Of the 22 findings, the 17 description rewrites and 1 schema change would all be flagged identically by a naive hash comparison. We grade: BREAKING (parameters changed), COSMETIC (descriptions rewritten), NEW (tools added). All still exit non-zero, but the label tells the reviewer what they're looking at. Happy to share the per-tool comparison table if useful.

Full audit across the npm MCP top (218 silent changes, including this server): https://github.com/Paraphern/rugsnare/blob/main/audits/npm-top-mcp-drift-2026-10.md

(Disclosure: I maintain an open-source pinning/diff tool - zero npm dependencies, no telemetry. The field data above is its output.)