All builds
What does a quiet MCP tool diff not tell you?
What a quiet MCP tool diff does not tell you: 7 of 14 changed versions raised no policy finding.
Design choice
Diff the whole tool object, not just the policy verdict, and put both side by side for every released version.
In practice
No policy finding is not the same as no change. Re-review a tool when its contract moves, whatever the classifier says.
What I built
- Structural diff of saved MCP tool objects, path by path
- Changes shown beside policy findings, so unlabelled edits stand out
- 25 of 25 version captures; 20 of 20 transitions matched the frozen structural paths
- A GitHub Action for review on pull requests
Where it stops
Five packages chosen on purpose from three publisher families, with no human review study and no independent approval labels. The counts are not false-negative rates.