Methodology

methodology_version 2026.09.0. Probe allowlisted public MCP endpoints; store raw + hash; emit change events.

Fingerprint fields

• content_hash — full tool list + scopes + probe status
• tools_hash · schema_hash · description_hash · scopes_hash
• status — ok or fetch_failed

Change kinds

first_seen · tools_changed · schema_changed · description_drift · scope_widened · fetch_failed · recovered

CI fixtures under fixtures/probes/ cover the full set via a multi-probe timeline.

Extract

Structured extract attaches tool names, schema/description digests, and scope set to each event. Extract never blocks raw archive ingest.

Index (v1)

fleet.drift.scope_widening_count_7d — count of scope_widened events in a rolling 7-day window, computed from durable events.