Your coding agent calls MCP servers, and those servers keep shipping new versions. I launched 107 updates of popular servers and 49 changed the tools your agent sees: new tools, removed tools, rewritten descriptions.

mcpgawk keeps a record of each server's tools at the moment you approved them. Before a call runs, it checks the tool against that record. A tool that changed waits until you look at the old and new side by side and decide. The agent can't approve its own way past the hold.

It runs on your machine and uploads nothing. Scanning, the guard, the decide page and the panel are free. A paid tier watches what servers actually do.