# What does a quiet MCP tool diff not tell you?

Agent Tool Contract Drift: Assurance and provenance, Python. Repository created Oct 2026.
Code: https://github.com/jlov7/tool-contract-drift
Page: https://jasonlovell.ai/projects/tool-contract-drift

What a quiet MCP tool diff does not tell you: 7 of 14 changed versions raised no policy finding.

## Design choice

Diff the whole tool object, not just the policy verdict, and put both side by side for every released version.

## In practice

No policy finding is not the same as no change. Re-review a tool when its contract moves, whatever the classifier says.

## What I built

- Structural diff of saved MCP tool objects, path by path
- Changes shown beside policy findings, so unlabelled edits stand out
- 25 of 25 version captures; 20 of 20 transitions matched the frozen structural paths
- A GitHub Action for review on pull requests

## Where it stops

Five packages chosen on purpose from three publisher families, with no human review study and no independent approval labels. The counts are not false-negative rates.

---
By Jason Lovell. Independent work, separate from my role at PwC.