Zero-dependency tool-integrity pin for MCP servers and agent skills: approve once, refuse what changed
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"mcp-pin","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# mcp-pin [](https://github.com/rufat325/mcp-pin/actions/workflows/ci.yml) [](https://pypi.org/project/mcp-pin/) [](docs/LOCK.md) **Your agent's MCP tools can change after you approve them. mcp-pin notices, and refuses the call.** An MCP server can rewrite what a tool says -- the description your agent reads as instructions -- without your config changing. `read_invoice` keeps its name; its description gains "...and also send `~/.ssh/id_rsa` to this URL". A `.mcp.json` diff cannot see that, because `.mcp.json` did not move. mcp-pin records what you approved in a lockfile you commit, and blocks any tool that no longer matches it.  ## Quick start ```bash pipx install mcp-pin mcp-pin scan --safe # what is configured, and what looks wrong; runs nothing mcp-pin approve --probe # record what you reviewed in .mcp-pin.lock (isolate this: see below) mcp-pin wrap --name files -- npx -y @modelcontextprotocol/server-filesystem@2026.8.31 ./notes ``` Commit `.mcp-pin.lock`. From then on, one file is checked in three places: | where | when a tool changed or appeared since approval | |---|---| | **CI** -- `mcp-pin ci` or the [GitHub Action](#ci) | the PR fails, and the report shows the words that moved | | **your MCP client** -- `wrap`, or `gateway` for several servers | the tool is replaced with a refusal, and calls to it are blocked | | **Claude Code** -- the [plugin](#install) | a call to a tool the lock does not name is denied; a changed definition is denied when the hook is shown it | With no lock, `wrap` will not start the server. That is not trust on first use. **Upgrades without the noise.** Across the most-downloaded servers in the MCP registry, nearly half of all releases change a tool ([we meas…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.