Changelog
What changed, and when
The rule set is dated. A saved manifest can be re-checked against a later version, and the difference is the record.
| Date | Version | Change |
|---|---|---|
| 2026-10-21 | 1.0 | Rule set 1.0, first release: 15 checks, four input formats, the four verdicts, the report and the approval note, the four market sections. Built from the 20 October episode, the Snyk ToxicSkills audit, the OWASP MCP Security Cheat Sheet and the MCP security best practices page. |
How a rule change will be recorded
Each change will name the rule id, the date and what moved: a new pattern, a new source, a severity change or a fixed false positive. The rule version is printed in the report, so a saved record says which reading produced it.
What is not a change
A market section that already says a scheme does not state a requirement does not become a new rule when the scheme is updated. The page will name the update and keep the gap visible until the official text is read.