The MCP Contract plays the same role for AI agent tools that an OpenAPI contract plays for a REST API — a single, machine-readable source of truth. The difference is what that source of truth buys you: assessed the same way every time, so the result holds up as evidence, not a snapshot.
An MCP Contract works for the same reason an OpenAPI contract works — everyone stops arguing over separate versions of the truth and starts working from one. Security teams get a precise, versioned declaration of what a server exposes and permits, instead of a wiki page or a Slack thread. The calling AI agent gets the closest thing it has to ground truth about what a tool is actually for. And because the contract is machine-readable, assessment against it is deterministic: the same server evaluated twice returns the same score, the same findings, and the same verdict — which is what turns a governance decision into audit evidence, not a point-in-time opinion.
Assessment runs against the declared contract, not a human's read of the server on a given day. Score a server twice, get the same answer twice.
A deterministic verdict is something you can hand to a regulator or a customer security review — not a dashboard screenshot with a timestamp.
Because the contract is structured, a Security Quality Gate can block a non-compliant server automatically — no one has to remember to review it.
The same contract model governs ten MCP servers or ten thousand, without governance quality depending on team-by-team discipline.
The contract does not need to be written by hand. Connect to any live MCP server URL and the discovery pass generates the contract automatically — every tool, resource, and prompt the server exposes, plus best-effort inferences for risk level, data classification, and side-effects.
Anything that can't be safely inferred is marked # STUB rather than guessed — so a human closes the gap deliberately instead of publishing a false sense of completeness.
The schema is deliberately structured so that free-text descriptions — the part an AI model actually reads — sit in their own section, separate from the structural declarations security teams review. The structural sections define the schema that the 42Crunch platform audits and scores against.
contentThe full-text description field of every tool and prompt — added in schema version mcpContract: "0.2" alongside the existing truncated title. This is what a calling AI model actually reads, and it's what the 42Crunch platform analyzes automatically for prompt injection, tool poisoning, data exfiltration, and tool shadowing.
server | Name, version, reverse-DNS identity |
initialize | Instructions given to the calling agent |
integrity | Message signing, rug-pull protection |
resolution | Audit invariants |
capabilities | Tools, resources, prompts and their risk levels |
authentication | Schemes, fail-closed defaults |
authorization | Roles, wildcard-allow rejection |
throttling | Rate limits, fail-closed behavior |
This is the same idea that makes an OpenAPI contract valuable — just applied to a new kind of consumer.
A precise, versioned declaration of what your MCP server does and doesn't allow — the basis for governance, automated testing, and a CI/CD gate that doesn't depend on someone remembering to review a pull request.
The contract is the closest thing to ground truth an AI model has about what a tool is actually for. A well-written, hardened content section is what stands between a calling agent and a tool description trying to manipulate it.
Traffic-based detection tells you what happened; a contract tells you what's allowed, so a security team can test and gate a server before it's ever called by an agent, not just log what an agent already did.
Because the burden of proof is different — a regulator or auditor needs a result that doesn't change depending on when you asked. A deterministic, contract-based verdict is reproducible; a live-traffic risk score generally isn't.
No — it's the declaration that runtime enforcement is built from. The contract says what's permitted; a runtime layer (MCP Runtime Protection) is what actually blocks a server that drifts from it.
They're marked # STUB rather than silently guessed, so a human closes the gap deliberately — the contract never claims more completeness than it has.