MCP servers need two hashes: what the model reads vs what the package runs
mrpkk · reddit · 2026-10-25
A Reddit post argues most MCP server setups track neither of the two hashes worth pinning: the tools/list payload (names, descriptions, inputSchema) that the model actually reads, and the tarball hash/version of what actually runs. Each is blind to the other's failure mode — a description edited at runtime can change model behavior without touching code, while a swapped dependency can change behavior with byte-identical descriptions. The author asks what practitioners actually do: pin the tarball and re-scan tools/list on connect, or treat descriptions as config reviewed like code.
More from coding & agent
- LearnHarness hits 1k stars: open-source agent harness that teaches from what you already know — burny_tech · 2026-10-25
- Cursor screenshot shows unreleased 'Gemini 4 Argon Medium' model and Claude Code import — weswinder · 2026-10-25
- Coding agent vetoes Effect rewrite: plain TypeScript with 250 lines of helpers wins — gabe_ragland · 2026-10-25
- Testing 8 AI phone agent tools: two-thirds of front desks hang up within 5 seconds — Evening_Hawk_7470 · 2026-10-25
- Leslie Lamport's "Claude, make no mistakes" hailed as predicting LLMs 30 years early — akbirthko · 2026-10-25
- Three Markdown files boost coding agents: 26% smaller diffs, 27% faster runs — lmoroney · 2026-10-25