Skip to content

drift — mandate enforcement for AI agents

by mrpkk · remote · no sign-in to list tools · v0.1.0 · published by GitHub user mrpkk

Block an action a signed mandate does not permit: amount, payee, audience, currency, window, intent.

Changes · 2
CompareRegistry entry

3 tools: 2 change things and 1 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http drift https://drift.rta.lat/mcp

Findings

Matches of fixed checks, with the text they matched.

1 info
  • Infodrift_check

    The description mentions "credential".

    Matched text

    description: "...e any action that spends money, moves a credential or changes state on someone else's beha..."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

3 tools

Changes things 2Claude Code: ask
  • drift_checkCheck ONE proposed action against a signed agent mandate BEFORE it happens.1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...e any action that spends money, moves a credential or changes state on someone else's beha..."

      What this check looks for
    Description, as the server wrote it
    Check ONE proposed action against a signed agent mandate BEFORE it happens. Returns {"verdict": "ALLOW"|"DENY", "rule": <name>} plus a report with a ledger fingerprint. Six rules run in a fixed order, so a refusal names the most important reason rather than an incidental one: amount, payee, audience, currency, window, intent. Anything unclassified is DENY. Use immediately before any action that spends money, moves a credential or changes state on someone else's behalf. Do NOT use to: verify mandate signatures (AP2 does that, and this server runs after signature verification), execute the action (it only decides), or certify that an intent is truthful — "intent" arrives from the agent and is untrusted input. An agent that lies within its limits still leaves a ledger entry; proving what really happened is attest's job, not this one's. Amounts are integer minor units (cents), never floats. Window bounds are inclusive. Fully idempotent: the same inputs always give the same verdict and the mandate is never mutated.

    Annotations the server declares

    • title: Check one action against a mandate
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • drift_sessionCheck a SEQUENCE of proposed actions against one mandate.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Check a SEQUENCE of proposed actions against one mandate. Returns {submitted, allowed, denied, breach_by_rule, fingerprint}. Use for a whole plan or batch, not a single action — use drift_check for that. The fingerprint is the point: rewriting or reordering any earlier decision changes the hash, so tampering with history becomes visible instead of silent. Do NOT use it to execute the actions, or as evidence of what actually happened. It reports what was PROPOSED against a mandate you supply. Read-only. Idempotent for a fixed action list. Amounts in integer minor units, as in drift_check.

    Annotations the server declares

    • title: Check a sequence of actions and fingerprint the ledger
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 1Claude Code: allow
  • drift_explainReturn the six enforcement rules in the exact order they are applied, each with a plain-language reason it exists.No findings

    Why it is in this group

    • The name "drift_explain" says "explain": a word for reading.
    Description, as the server wrote it
    Return the six enforcement rules in the exact order they are applied, each with a plain-language reason it exists. Takes no mandate and no action. Use when a refusal did not make sense, or before explaining a denial to someone whose mandate was rejected. A refusal you cannot explain is one nobody will trust. Do NOT use it to check an action — it performs no check, and cannot predict which rule will fire, only the order they are tried in. Constant output, fully idempotent, opens no files, contacts no host.

    Annotations the server declares

    • title: Show the enforcement rules in the order they apply
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http drift https://drift.rta.lat/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__drift__drift_explain"
    ],
    "ask": [
      "mcp__drift__drift_check",
      "mcp__drift__drift_session"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as drift. Review it before you use it.