140 silent contract changes across 66 version pairs of the reference servers (measured data) #5414

We pin MCP tool contracts (sha-256 over name/description/inputSchema/outputSchema) and diff published releases - open-source, zero dependencies: https://github.com/Paraphern/rugsnare. Scanning the reference servers in this repo produced findings we think maintainers here would want to know about:

• 140 silent contract changes across 66 version pairs of the @modelcontextprotocol/server-* packages; none announced in the respective changelogs
• server-filesystem 0.2.0 -> 1.0.0: 14 findings (8 BREAKING, 5 NEW, 1 NOTATION) - the most-installed server we scanned
• server-everything 0.1.0 -> 1.0.0: 40 findings (23 NEW tools, 4 GONE, echo LOOSENED, prompts/resources churn)

Full report with verbatim quotes, per-pair tables and one-command repros: https://github.com/Paraphern/rugsnare/blob/main/repro/SILENT-CHANGES-REPORT.md (each finding is reproducible via npx rugsnare history <package>, which starts every published version locally and diffs the captured contracts).

Context: reference servers are the template the ecosystem copies - silent contract changes there propagate as accepted practice. A 10-line CI gate would surface every future change in the PR itself (a deliberately rug-pulled live demo of what reviewers would see: Paraphern/rugsnare#14).

Data is yours regardless; closing this is fine if it belongs in a different channel - glad to move it.