Diff MCP tool manifests and catch poisoning before agents silently trust changed definitions.
Scoring was not performed