v1.3.0: advisory signals, rugsnare v1.5.0

What's new

• Advisory signal scoring on every prose-changed tool and prompt and every new tool, rendered as a warning line right under the structural grade, independent of it: hide-from-user instructions, private-key and credential lures, base64 exfiltration, non-standard domains, shadow-tool declarations, invisible Unicode and bidi, ANSI escapes, payment-credential transmission, optional exfiltration-carrier parameters by name. Advisories are alerts, never fail the check, and run on the delta only.
• rugsnare-ref default pinned to v1.5.0: outputSchema pinning, resource content hashes, and the A19 payment-credential signal ship in rugsnare itself.

Verification

Live demo, three deliberately planted attacks (tool poisoning, shadow tool, toxic flow) caught on a real PR with advisory lines: rugsnare#14. Full-diff scenario re-verified on @modelcontextprotocol/server-everything 0.1.0 -> 2026.8.31 under rugsnare 1.5.0: 40 of 40 findings (17 tools, 6 prompts, 17 resources). Clean path (pin equals live) exits 0; policy mismatch exits 1 with a single POLICY block.

v1.2.0: prompts and resources, POLICY stop, direction grading

What's new

• Prompts and resources are compared and rendered (own sections): a pinned prompt whose text changed, a new prompt, a served resource that disappeared. Before v1.2.0 only tool description and inputSchema were compared.
• POLICY stop (PIN-SPEC 3.1): when the pin store was graded by an older rugsnare policy, the action posts a single POLICY block and fails the check instead of silently re-grading old pins as fresh drift.
• Direction grading with icons (BREAKING / LOOSENED / EXPANDED / NOTATION / COSMETIC), schema change details, identical changes grouped into one line, NEW and REMOVED grouped into single sections.
• rugsnare-ref default pinned to v1.4.3 (was v1.3.0).

Verification

End to end on @modelcontextprotocol/server-everything (0.1.0 -> 2026.8.31): 40 of 40 findings shown (17 tools, 6 prompts, 17 resources) where v1.1.0 would have shown 17 of 40. Clean path (pin equals live) exits 0. POLICY mismatch exits 1 with a single POLICY block.

v1.1.0 - rugsnare-ref default to v1.3.0

Bumps the default rugsnare version to v1.3.0, which ships:

• Recursive schema decomposition (path-qualified leaves for nested anyOf/union changes)
• .agents/skills coverage (cross-platform Agent Skills standard location)
• ATR cross-references on every advisory signal and SARIF rule
• Skills advisory parity with pin layer

v1.0.0 - first Marketplace release

First public release. Posts a human-readable diff of MCP tool contracts (tool names, descriptions, input schemas) as a PR comment, so reviewers see the changed words instead of hashes. Fails the check when drift is found (configurable via fail-on-drift). Runs rugsnare v1.1.0, pinned by default.