RugSnare 与 mcpward：MCP 工具描述漂移检测
Understand the story
事件围绕 MCP 工具描述漂移与投毒检测展开。2026-10-04，Hacker News 上出现 RugSnare，这是一个针对 MCP 工具描述的运行时完整性 CLI 工具：对每个已批准工具的 { name, description, inputSchema } 做规范化哈希固定，之后任何静默变更都会触发告警并让 CI 失败（exit 1）。2026-10-05，同一板块又出现 mcpward，思路相近但范围不同——它对 MCP server 做黑盒契约与安全测试，把 server 的契约快照进 lockfile，契约变化时让构建失败。2026-10-06，mcpward 更新到 1.1 并上架 GitHub Actions Marketplace，具体做法是把 MCP 服务器 tools/list 返回的工具定义存进 lockfile，工具描述、必填参数或 readOnlyHint 发生变化时让 CI 失败。两者都把“批准后的静默变更”当作风险点，用快照加构建失败来拦截，区别在于 RugSnare 固定的是工具描述与 inputSchema，mcpward 固定的是 server 契约并附带安全测试。
Generated by AI from reports · Updated 8 hours ago
Developments
- Oct 5, 21:00 · 2 reportsmcpward MCP服务器契约与安全测试工具发布Hacker News · MCP：mcpward：给 MCP server 做黑盒契约与安全测试
- Oct 4, 01:10 · 1 reportRugSnare发布用于检测MCP服务器描述漂移和工具投毒的CLI工具Hacker News · MCP：RugSnare: hash-pinning MCP tool descriptions to catch silent changes after approval
Report timeline
Follow the reports to explore different perspectives.
- DEV Community · MCPmcpward 1.1 上架 GitHub Actions Marketplace，用 lockfile 锁定 MCP 工具契约
mcpward 更新到 1.1 并上架 GitHub Actions Marketplace，它把 MCP 服务器 tools/list 返回的工具定义存进 lockfile，工具描述、必填参数或 readOnlyHint 发生变化时让 CI 失败。
- Hacker News · MCPmcpward：给 MCP server 做黑盒契约与安全测试
mcpward 是一个对 MCP server 做黑盒契约与安全测试的工具，把 server 的契约快照进 lockfile，契约变化时让构建失败。
- Hacker News · MCPSelectedRugSnare: hash-pinning MCP tool descriptions to catch silent changes after approval
RugSnare is a runtime integrity tool for MCP tool descriptions. It computes a normalized hash pin over each approved tool's { name, description, inputSchema }, and any silent change afterward triggers an alert and fails CI (exit 1).
Interest in this story
Current interest 13·Peak within comparable coverage 13（Oct 6, 16:00）·Change over 24 hours within comparable coverage +303%
The trend compares the same participants under continuous, complete observation, so its coverage may be narrower than the current score. Hover or tap to view hourly interest; use the left and right arrow keys to navigate.