---
title: X
description: If you run a Model Context Protocol server, a green HTTP check says nothing about whether agents can still use it, or whether its tools quietly changed. The…
canonical: https://watchfor.io/changelog/2026-07-30-mcp-server-monitoring
---

[All updates](/changelog/page/7#2026-07-30-mcp-server-monitoring) ✨ New AI Jul 30, 2026 · v 4.9.5

# MCP server monitoring — handshake, tool inventory & drift detection

If you run a Model Context Protocol server, a green HTTP check says nothing about whether agents can still use it, or whether its tools quietly changed. The new MCP monitor performs the real protocol handshake on every check, negotiates the version and walks the full tool inventory. Drift detection alerts you with the exact diff when any tool is added, removed or has its description changed — the rug-pull attack agents cannot see coming. Phase-level latency, bearer auth and default alert rules are included.

Handshake, capabilities, phase timings and every tool from the latest check.

Drift detection is on by default; pin a protocol version if you depend on one.

## What each check does

Each check connects the way an AI agent does the first time:

- Runs the initialize handshake and records the protocol version the server agrees to.

- Lists every tool, following pagination, and counts resources and prompts when the server offers them.

- Times DNS, TCP, TLS, the handshake and the tool listing separately, so a cold start looks different from a slow network.

- Closes the session cleanly. It never calls a tool, so monitoring can't cause side effects.

## Drift detection

On every check, the tool names, descriptions and input schemas are fingerprinted. When anything changes, Tool Inventory Changed (on by default) opens an incident with the diff: which tools were added, removed or changed. Descriptions matter because an agent reads them as instructions, so a description that changes after you connected is exactly what a rug-pull looks like.

## Example

Your MCP server has 12 tools. A Friday deploy renames search_orders to find_orders and edits the description of refund_order . The endpoint still answers 200 , so an HTTP check stays green. The next MCP check opens an incident that lists one tool removed, one added and one changed, and you fix the agents' prompts before Monday.

## Also included

- No Tools Exposed (on): the server starts a session but lists no tools.

- Slow Handshake and Protocol Version Mismatch : off by default, switch them on per monitor.

- A bearer token for protected servers, under Settings → Advanced Options .

Start with New monitor → MCP Server . The [MCP monitoring guide](/docs/monitors/mcp) has the details, and the free [MCP Server Checker](/mcp-server-checker) runs the same check once.

Share this update

---

Canonical page: https://watchfor.io/changelog/2026-07-30-mcp-server-monitoring · Site guide: https://watchfor.io/llms.txt