Sources, rules and limits
The source baseline and exact review rules behind MCP Change Review, with explicit boundaries for evidence, redaction and freshness.
Source baseline
Sources reviewed on 31 October 2026. Protocol reference: MCP 2026-07-28. Ruleset and report format: mcp-change-review/1. This date records editorial review, not a continuous monitoring guarantee.
- MCP tools specification, 2026-07-28: tool definitions, pagination, list changes and the trust boundary around annotations.
- MCP security best practices, 2026-07-28: local-server execution, consent, restricted access and authorization risks that static JSON alone cannot validate.
- OWASP MCP Security Cheat Sheet: complementary guidance for reviewing tool definitions and limiting permissions. This is a living document rather than the pinned protocol reference.
Rule catalog
Every rule emits an observation and a review question. There is no weighted score, severity ranking, pass badge or certification. Rules apply to the proposed snapshot; the field diff separately records changes.
| Rule | Trigger | Boundary |
|---|---|---|
| SERVER-ADDED | New server key in proposed config. | A name change can resemble a new server. |
| LOCAL-EXECUTION | A command field is configured. | Does not prove a process ran or a client enables it. |
| SHELL-WRAPPER | Recognized sh, bash, zsh, fish, cmd, PowerShell or pwsh basename. | No shell parsing. Custom wrappers may be missed. |
| PACKAGE-RUNNER | Recognized npx, npm, pnpm, bunx, uvx, uv or pipx basename. | No package resolution or version validation. Subcommands are not interpreted. |
| REMOTE-ENDPOINT | An HTTP(S) URL is configured. | Origin only; no DNS lookup or request. |
| PLAINTEXT-REMOTE | HTTP outside exact localhost, 127.0.0.1 and ::1. | Conservative URL test. Other loopback forms can be flagged. |
| URL-COMPONENTS-HIDDEN | Userinfo, query or fragment present. | Presence only; does not claim the value is a credential. |
| ENVIRONMENT | One or more environment keys configured. | Values hidden; inherited environment unknown. |
| UNINTERPRETED-FIELDS / ROOT | Config fields outside the interpreted subset. | Changes retained; client-specific behavior unknown. |
| INCOMPLETE-CAPTURE | nextCursor exists or resultType is not complete. | Tool removals may be capture artifacts. |
| CAPTURE-SCOPE | Every tools/list comparison. | Same server, scopes and collection completeness need external evidence. |
| UNTRUSTED-ANNOTATIONS | Proposed tool has annotations. | Server claims are not runtime guarantees. |
| UNINTERPRETED-ENVELOPE | Unknown tools/list result metadata. | Only tool definitions are compared. |
Where existing scanners fit
Snyk Agent Scan covers agents, MCP servers and agent skills. Its current documentation describes discovery and scanning, with explicit controls around contacting servers and starting local processes. Read its current operating and data-handling documentation before use.
Cisco MCP Scanner includes a static command for pre-generated JSON, with selectable analysis engines. Offline evidence analysis already exists; this site does not claim that capability is novel.
This product's narrower purpose is an install-free, browser-local before/after worksheet with value-suppressed exports. It does not establish superiority over either project. No scanner was executed or benchmarked for this comparison. No search-volume, customer-demand or market-share claim has been measured.
Maintenance and change control
Source changes require editorial review before changing rules. New rules should include a reproducible fixture and a redaction check. A refreshed research note is not evidence that a hosted build has updated. Consult the visible review date and the current sources when your decision depends on newer protocol behavior.
The bundled rules do not expire silently or fetch new behavior in the browser. No imported URLs, schema references, icons or server endpoints are resolved. Read supported formats and redaction for exact parsing and output limits.