My requirements.txt Is Pinned. My MCP Server's Actual Contract Isn't, and Nothing Would Catch It Changing.
The author describes a gap in the Model Context Protocol (MCP) ecosystem: although they pin their Python dependencies via requirements.txt, the server's exposed contract—specifically the tool names, descriptions, and JSON Schema for arguments—is not versioned or pinned. This means that when the server code is updated, the contract can change silently, and no existing tooling (linters, type checkers, or MCP clients) will catch the mismatch. The author notes that MCP clients rely on the server's advertised capabilities at runtime, but there is no mechanism to enforce that the contract remains stable across deployments. This creates a scenario where a client built against one version of the server may break when the server's contract changes, without any warning. The author calls for a way to pin or version the MCP server contract itself, similar to how requirements.txt pins package versions.
Unpinned MCP server contracts can silently break clients, undermining reliability in agentic workflows.