ToolSeal is a lockfile for MCP server capabilities. It fingerprints declared tools and schemas, stores them in toolseal.lock, and fails with a readable diff when capabilities drift. Use it locally or in CI before accepting a changed MCP declaration.