Skip to main content

Tool change notifications

See when a remote MCP connector adds, removes, or modifies tools, get alerted in Slack, and review the change before your users pick up the new tool surface.

Remote MCP connectors can change their tool surface at any time, and the next manifest refresh carries those changes into every Virtual MCP (VMCP) that includes the connector. Review new, removed, renamed, or rewritten tools before production callers pick them up, because tool descriptions feed directly into an agent's reasoning: a connector that behaves well at install time and changes later (a rug pull), or one whose descriptions carry hidden instructions (tool poisoning), can steer agents without any code changing on your side. For the threat model, see prompt security and tool governance.

What triggers a notification​

MintMCP compares each refreshed manifest against the previously stored version for the same connector. A notification fires when any of the following change:

  • Tool added: a tool name that wasn't in the previous manifest.
  • Tool removed: a tool name that was present and is now gone.
  • Tool modified: the tool's title or description changed, or its signature changed.

Connector-level metadata changes (name, title, version) are recorded and surfaced in the change history, but the Slack alert focuses on the tool list. If a refresh produces an identical manifest, nothing is stored and nothing is sent.

Where to review changes​

Tool change review lives in the Tools tab of a VMCP's configuration, alongside tool customization. For VMCPs with a bound remote connector, admins see:

  • Tool update policy: whether new tools are enabled by default or require manual approval.
  • Slack alerts: an inline control, on the same row as the default-enable toggle, for configuring which Slack channels get notified.
  • Tool change history: a paginated list of manifest versions, each with a short summary (+2 added, 1 modified, Metadata-only change, Initial manifest). Expanding a version shows an inline diff of which tools were added, removed, or modified, with character-level description diffs.

Acknowledge changes​

Each VMCP tracks the manifest version an admin has acknowledged. When the stored manifest moves ahead of the acknowledged one, the VMCP surfaces an "unacknowledged changes" state. Acknowledging a manifest means the admin has reviewed the diff and is opting into the current tool surface for this VMCP.

How acknowledgement interacts with the update policy:

  • Enable new tools by default. When a new tool arrives, it is enabled for callers immediately and a Slack alert fires. Acknowledgement is a review step that records the admin looked at the change, not a gate on the tool becoming available.
  • Require manual approval. A new tool arrives disabled. The Slack alert fires, but users cannot call the tool until an admin explicitly enables it in the tool customization UI.

Require manual approval for any VMCP whose callers run in production or whose connector is operated by a third party, because it closes the window where a new upstream tool could be called before a human has reviewed it. Enterprise organizations can enforce this everywhere with the org-wide Force-disable new tools policy, which makes new tools arrive disabled on every VMCP regardless of the per-VMCP setting (see Tool customization).

The first manifest for a newly added connector is implicitly acknowledged during setup: the admin sees the tool list at connector-add time and acknowledges it by choosing to use the VMCP.

Slack alerts​

Notifications are delivered to Slack. Each alert includes the connector title, a breakdown by change type (added, removed, modified) with tool names, and a "View tools" deep link back to the VMCP's Tools tab.

A single connector can fan out to multiple Slack channels, and each channel subscription can be toggled on or off independently without removing it.

Set up Slack alerts​

Slack alerts require a Slack workspace connection. The first-time flow is:

  1. Connect Slack once at the organization level, from the integrations settings. This authorizes MintMCP to post into chosen channels.
  2. Open the VMCP's Tools tab.
  3. Expand Slack alerts in the Tool update policy row.
  4. Pick a channel from the selector and click Add alert. Add more channels as needed.
  5. Use the per-row switch to temporarily disable a channel without removing it, or the trash icon to remove it entirely.

If Slack is not yet connected, the panel shows a connect button that points to the organization integrations page.

Alerts are only sent for channels that are both present in the subscription list and flagged enabled. A connector with no subscriptions still produces manifest history entries, but no Slack traffic.

Alert deduplication​

Repeated detections of the same change deduplicate automatically: concurrent refreshes and flapping connectors produce one alert per distinct change per channel, not a flood.

Next steps​

  • Tool customization: configure the update policy, per-tool enable/disable, and name/description overrides for each VMCP
  • Tool governance: how MintMCP governs dynamic tool changes and capability creep
  • Prompt security: why tool descriptions are an attack surface for injection