Tool change detection

An MCP server may rewrite a tool without changing its name. A new input can make the agent send more data; new wording can steer how the model uses the tool; an old Allowed rule would otherwise keep matching both.

Omniio fingerprints the parts of every definition the model reads and compares them whenever the server catalogue refreshes.

What is compared#

The fingerprint covers the tool name, display title, description and complete input schema. Object keys are sorted before hashing so a server serialising the same schema in a different order does not create noise; array order remains meaningful.

First sight of a tool establishes its baseline. It is not reported as a change because Omniio has no earlier definition to compare it with. Whitespace at the edges of titles and descriptions is ignored when there is no substantive reason to show a reviewer.

Material and minor changes#

Material

A title or description changed, an input was added, or wording changed inside a surviving part of the input schema. These can alter instructions or widen what leaves the account.

Minor

An input was removed, a type or enum tightened, a required list changed, or another schema edit changed the definition without adding an input or rewriting model-facing prose.

Both kinds are recorded in the history. Only an unreviewed material change interrupts an Allowed call: until you acknowledge it, that tool behaves as Ask first for your account.

Reviewing a change#

Open Tool changes. Each entry names the server and tool, states why it was classified that way, and shows the stored definition before and after the refresh. Each side is capped at 16 KB so a hostile or accidental schema cannot make the review page unbounded.

Acknowledge records that you reviewed this particular change. It restores the normal Allowed behaviour for that tool unless a newer material change is also waiting. Minor changes and acknowledged changes remain in the list as history rather than disappearing.

An approval is intentionally different. Approving one held call consumes a single decision for its exact arguments, but the definition remains under review. Acknowledge the change when you are comfortable allowing future calls under the standing policy.

Who has to review it#

A definition change is recorded once as a fact about the upstream, while its acknowledgement belongs to the individual account. Only changes detected after you enabled that server apply to you. Connecting today does not open a queue of edits that happened before you used it.

This also means one person's acknowledgement does not silently make the decision for another account using the same catalogue server.

Next: Activity and audit trail.