Menu

1 / 2

Same MCP version, different tools: what two independent captures revealed

DEV Community: security·Alex·about 17 hours ago
#hqLGu9Kp
#devtosecurity#devto#dev#version#launch
Reading 0:00
15s threshold

Nine write tools appeared in our capture of mongodb-mcp-server that were absent from another observer's capture of the same version.

The launch commands explained it: our sandbox started the server bare; the other capture used --readOnly and a connection string.

We run HISTOR , a public log of MCP tool definitions. Paraphern maintains RugSnare , which records and compares tool contracts across releases. On 26 October, we compared the overlapping parts of our records. Some differences described the servers' launch conditions. Others exposed mistakes in the measurement process, including gaps in ours.

What we actually compared

The overlap contained 26 packages. HISTOR held tool lists for 21 of them. RugSnare's pins supplied 34 version captures that could be compared against our record.

We compared the fields both records retained in full: name , description and inputSchema . We excluded outputSchema , which the peer snapshots retained only as a hash.…

Continue reading — create a free account

Join HashtagPLUS to read full articles, follow hashtags, vote, and join the conversation.