---
title: "MCP Covenant · semver for your MCP server's interface"
description: "semver for your MCP server's interface. Snapshots a server's tools/resources/prompts into a lockfile and fails CI on breaking changes, with direction-aware"
canonical: "https://matthiasmeyer.tech/repos/mcp-covenant"
language: "en"
last_updated: "2026-08-21"
markdown_versions: ["https://matthiasmeyer.tech/repos/mcp-covenant.md", "https://matthiasmeyer.tech/de/repos/mcp-covenant.md", "https://matthiasmeyer.tech/es/repos/mcp-covenant.md"]
image: "https://matthiasmeyer.tech/api/og/repo/mcp-covenant?lang=en"
publisher: "Matthias Meyer, https://matthiasmeyer.tech (llms.txt: https://matthiasmeyer.tech/llms.txt)"
---

security stable Rust

# MCP Covenant

semver for your MCP server's interface

Snapshots a server's tools/resources/prompts into a lockfile and fails CI on breaking changes, with direction-aware JSON-Schema classification (tightening an input schema vs loosening an output schema break different callers) plus a schema-hygiene linter. Single Rust binary, stdio + HTTP, SARIF + GitHub Action. 132 tests, on crates.io, MIT.

[View on GitHub →](https://github.com/studiomeyer-io/mcp-covenant)[crates.io](https://crates.io/crates/mcp-covenant)

## What it solves

When you ship a typed library you have a public API and tooling that screams when you break it. MCP servers have neither. They serve whatever the tool list returns today. Rename a tool, add a required argument, narrow an enum, and every agent built on your server breaks while nothing in your pipeline notices.

## How it works

It snapshots the server interface into a lockfile you commit, then compares the live interface against that baseline on every run and classifies each difference the way a person would: breaking, minor or patch. A removed tool and a new required property are breaking, and it says so with the exact path, so the output reads like a review comment rather than a diff. The exit code fails CI and it tells you which version bump the change actually requires.

## When to use it

Add it the moment anyone other than you calls your server. From then on the lockfile is the contract, and a breaking change becomes a deliberate decision with a version bump rather than something you find out about from a bug report.

## When not to use it

It watches the interface, not the behaviour. A tool that keeps its exact signature and quietly starts returning something different passes every check. It is also only useful once the interface is meant to be stable: during the first weeks of a server, when everything moves, the lockfile is noise.

Stars

★ 0

installs

↓ 18

Clones (14d)

⊟ 36

Language

Rust

Updated

2026-08-21

## Install

```
cargo install mcp-covenant
```

## Related repos

- MCP Herald

    ← Rust spec-gate sibling of

    →

    https://matthiasmeyer.tech/repos/mcp-herald

- MCP Protocol Conformance

    → breaking-change gate for

    →

    https://matthiasmeyer.tech/repos/mcp-protocol-conformance

- MCP Passport

    ← publish gate beside

    →

    https://matthiasmeyer.tech/repos/mcp-passport

## Sitemap

Every page of this site as Markdown: [sitemap](https://matthiasmeyer.tech/sitemap.md). Curated entry point: [llms.txt](https://matthiasmeyer.tech/llms.txt).