Several projects now keep a public record of what MCP servers tell models about their tools:
HISTOR (ours), heldfast, rugsnare, and signed per-tool grades from AgentAvow. Each hashes a tool
definition its own way. If two of them read the same server, do they see the same thing, and can
one answer in the other's format?
On 26 October HISTOR published its weekly signed snapshot at 13:49:50Z. heldfast checkpointed its
feed at 13:48:36Z the same day. Both are public, so the comparison below can be rerun from the
pinned inputs.
The formats
All five use SHA-256 over sorted-key JSON, and four over RFC 8785. They differ in which fields
count and in how "missing" is written:
| name | title | description | inputSchema | outputSchema | annotations | icons | |
|---|---|---|---|---|---|---|---|
| HISTOR tool-set digest | yes | beside it | yes | yes | yes | beside it | beside it |
| heldfast fingerprint | yes | yes | yes | yes | yes (not if {}) |
yes | yes |
| AgentAvow v1 | yes | yes | yes | yes | yes | yes | no |
rugsnare hash
|
yes | no | yes | yes | own hash | compared, not hashed | yes |
Vercel AI SDK fingerprintTools
|
map key | yes | yes | yes¹ | no | title only | no |
¹ @ai-sdk/mcp sets additionalProperties: false on every input schema before the fingerprint
is taken, so a change to that member does not move it.
We implemented the heldfast, AgentAvow and Vercel rules from their published descriptions and
checked them against the projects' own test material: heldfast's 14 golden tools, AgentAvow's 3
signed digests and 13 key encodings, and fingerprintTools from ai@7.0.159 on 6,882 tools.
All agree. Any of these digests can be computed from a record that keeps the full definition.
Same servers, same day
23,190 servers appear in both records with a tool list. Another 3,324 were read by both, but on
26 October HISTOR had no digest for their tool sets: most declare fractional numbers in their
schemas, which its digest rule refused until 31 October. They are outside this comparison.
For 21,215 of the 23,190 HISTOR holds every field heldfast hashes (it keeps title and annotations
since 22 October). On those:
- 20,771 servers (97.9%) are identical tool by tool;
- of 318,389 tools, 315,605 (99.1%) have the same heldfast fingerprint.
Two crawlers built separately agree on 99.1% of the definitions byte for byte. The remaining
servers are where the interesting part is.
Why the other 444 differ
| servers | first reason that applies |
|---|---|
| 218 | different npm versions were run |
| 65 | same definitions, read at different moments |
| 50 | heldfast's later reads failed, so its copy is older |
| 33 | the hosted server was edited between the two reads |
| 24 | the definition contains the reader's own environment |
| 24 | same npm version, run with network by one reader and without by the other |
| 15 | the server sent no outputSchema/title to one reader's request |
| 10 | only the first page of tools/list was read |
| 5 | same npm version, offline on both sides |
Every one of the 33 edited servers was checked live on 31 October. Where today's definitions match
one of the two copies (15 servers), they match the copy of whichever reader came later.
78 servers differ only in how they were read, not because the servers changed.
The definition contains the reader. Some packages put their environment into tool text.
@sunkimkk/pinterest-mcp@1.2.0 describes its download folder as /tmp/churn-…/Downloads/… to
heldfast and /home/histor/Downloads/… to us. airweave-mcp-search@0.9.62 names its tool after an
environment value, so the tool is search-heldfast-churn-placeholder for one reader and
search-histor-envkey-… for the other. Others default a date parameter to today or a field to a
fresh UUID. Every reader gets its own digest for these servers, and every user does too.
The network. Some packages build part of their tool list from a remote service. heldfast ran
npm packages with network until 29 September and without it since; HISTOR runs them without. For
24 packages at the same version, the September copy at heldfast differs from ours: richer
annotations, other prices in the descriptions, more tools.
Pagination. tools/list can be paged. ecomdly.com serves 15 tools per page and 55 in all;
framezone.app 50 per page and 62 in all; one server serves 762 over 16 pages. A reader that stops at
the first page records a shorter list. HISTOR read more than one page on 11 servers, and heldfast's
copy of 10 of them is exactly the size of today's first page: 976 tools missing.
Protocol version. Servers may gate newer members on the version a client speaks.
mcp.apollographql.com returns outputSchema on 0 of 48 tools when asked with 2024-11-05, and on
48 of 48 with 2025-06-18. Subtler: a client that is answered with a newer version must send it in
the MCP-Protocol-Version header on every later request. Without the header a server assumes
2025-03-26. isitabizday.com then returns outputSchema on 0 of 8 tools instead of 8 of 8. Fifteen
servers differ between the two records only in these members.
rugsnare's published pins tell the same story on a smaller scale. 18 package versions are in both
records, and 16 are identical. mongodb-mcp-server@3.1.0 was started with a connection string
and read-only mode on one side and with neither on the other. server-everything@2.0.1 lists four
more tools to a client that declares more capabilities.
A signed grade, checked from outside
AgentAvow signed per-tool digests for DeepWiki's MCP server on 1 October and published the
served definitions as test vectors. The runs so far checked implementations against that pinned
file. HISTOR read the server itself, on 26 October, on its own schedule. Recomputed from our copy, all three digests match what AgentAvow signed.
What a missed change looks like
From 24 September to 26 October HISTOR recorded 188,947 modified tool definitions. 11,724 changed
only outputSchema and 1,270 changed only the top-level additionalProperties. Neither moves the
Vercel fingerprint, so 6.9% of recorded changes would pass detectToolDrift. Annotation-only
changes, such as readOnlyHint flipping, move the heldfast and AgentAvow digests but not
Vercel's or rugsnare's hash.
What follows for a shared digest
The rules can converge: a field set and a convention for missing and empty values are decisions.
The capture conditions cannot be decided by a rule. The same package version serves different
definitions under a different protocol version, page handling, network, environment or
configuration. Two digests are comparable only together with those conditions. A shared record
therefore needs a small capture block next to each digest: negotiated protocol version, whether
every page was read, and how the server was launched.
Data, scripts and pinned inputs: https://histor.modelmarket.dev/datasets/interop-digests-2026-10-31/. HISTOR's snapshot is CC BY 4.0, and so is
heldfast's feed data.
Disclosure: we build HISTOR. AI assistance was used for the analysis, the code and the writing.
Top comments (2)
Curious how this holds up once it hits real workloads.
It already is real workloads: both records are live crawls of 23,190 public MCP servers, read the same day by two independent crawlers, and 99.1% of 318,389 tool definitions matched byte for byte. The differences came from how servers were read (pagination, protocol version, launch environment), not from the hashing. The data and scripts are public if you want to rerun it: histor.modelmarket.dev/datasets/in...