My requirements.txt Is Pinned. My MCP Server's Actual Contract Isn't, and Nothing Would Catch It Changing.

Short summary

Pinning your MCP server's Python dependencies doesn't pin the actual contract agents see—tool names, parameter shapes, and descriptions are generated fresh from function signatures and docstrings on every boot. Renaming a parameter, changing a type, or editing a docstring silently rewrites the schema with no test or CI check catching it. The author argues for snapshot-testing generated schemas the same way you'd test any API contract, since git diff alone can't distinguish a cosmetic docstring edit from a breaking schema change.

• •MCP server tool schemas are derived from code at runtime—nothing pins or diffs them
• •Renaming parameters, changing types, or editing docstrings silently breaks agent callers
• •No standard test or CI step checks generated schema stability across commits

Generated with AI, which can make mistakes.