The MCP change review manual
A practical sequence for reviewing MCP configuration and captured tool definitions before an approval decision.
Start with the evidence you have. A client configuration describes a proposed launch or connection. A captured tool list describes what a server advertised in a particular context. Neither shows everything the server can do at runtime.
New to AI tool reviews? The first-review walkthrough explains the terms, the starting questions and when to hand off to a senior analyst or system owner.
Prepare two comparable snapshots
Supported JSON shapes, strict input limits, duplicate-key rejection and the fields that remain visible after redaction.
Review a configuration change
A complete worked example with version, path, environment and remote endpoint changes.
Review a tool contract change
Schema paths, descriptions, annotations, pagination and the evidence behind a new approval.
Write a scoped approval handoff
Carry the diff into a real decision with ownership, private inspection and explicit unresolved questions.
Use a different tool when you need a different answer
Runtime inspection, dependency vulnerability scanning and prompt-injection testing require evidence this workbench does not collect. The alternatives section links to existing tools and explains the boundary.