Show HN: Mcpward – black-box contract and security testing for MCP servers

Category: devtools

Tags: mcp, contract-testing, ci, security, schema-drift, typescript

Score: 7.0/10 (Innovation: 7, Technical: 7, Documentation: 8, Utility: 6)

mcpward is a black-box contract testing and security scanner for MCP servers, designed to run in CI. It snapshots a server's tool contract into a lockfile and fails builds on drift (schema changes, description rewrites, annotation flips, tool removal) and flags tool-poisoning patterns. It fills a real gap in MCP ecosystem tooling, where no dedicated drift-detection-in-CI tool existed.

Target audience: backend devs, devops, security engineers, AI platform teams

Repository: https://github.com/TsvetanG2/mcpward · TypeScript · Apache-2.0 · 8 stars

View on Hacker News