Agree that the digest has to be checked on every tools/list refresh and not only at install. One thing I would add: a pin only helps if the fail-closed path is actually tested, so I would make the host log the old and new digest side by side when it refuses a call. Whoever gets paged then sees what changed without digging. Did Pillar say if Deadbugz changed only the descriptions, or the input schemas as well?
X1Y1
AI features that work in production. RAG, agents, MCP, cloud and security for startups.
Agree that the digest has to be checked on every tools/list refresh and not only at install. One thing I would add: a pin only helps if the fail-closed path is actually tested, so I would make the host log the old and new digest side by side when it refuses a call. Whoever gets paged then sees what changed without digging. Did Pillar say if Deadbugz changed only the descriptions, or the input schemas as well?