MCP.Market

driftwatch MCP server

by dhughes6071·io.github.dhughes6071/driftwatch·v0.1.2
No reviews yet

What broke between two dependency versions, with a citation for every claim. No API key needed.

B80/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B80/100

full report

Adoption
Growing

0 stars50 downloads/wk

Reviews

Write one

Nobody has reviewed driftwatch yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

driftwatch tools (2)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • check_package

    Check whether a package actually exists and is safe to install. Returns existence, latest version, deprecation status, security advisory count, and a `suspicious` flag when the name resembles a popular package but behaves like a typosquat (no repository, placeholder version, one release).

  • get_migration_delta

    Given a package and two versions, return the breaking changes between them: removed and renamed symbols, concrete before/after code fragments, and security advisories the upgrade resolves. Every claim links to a primary source.

Public scan report

scanner v0.1.10 · 2026-11-01 · same rubric, same numbers if you re-run it

no findings
  • Code scan17 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 13 days ago15/15
  • Maintainer identityregistry namespace matches repository owner6/10
Overall 80/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How driftwatch compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
80/100
higher than 60% of 48,255 servers
Tools
2
the typical server has 7
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
50
more than 42% of 12,191 servers with a package

What its tools let an agent do: 2 read

Install driftwatch in Claude Code, Cursor or VS Code

Runs npx -y driftwatch-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add driftwatch -- npx -y driftwatch-mcp
Add to Cursor

What the publisher says

From the driftwatch repository's README, as published. We do not edit it. Read it on GitHub

driftwatch

Dependency migration intelligence for AI coding agents.

Answers one question, precisely and with citations:

*This library moved from version A to version B. What broke, and what edits

does my code need?*

New here? Start with the Beginner's Guide.

Install (30 seconds)

Add it to Claude Desktop, Claude Code, Cursor, or any MCP client:

{
  "mcpServers": {
    "driftwatch": {
      "command": "npx",
      "args": ["-y", "driftwatch-mcp"]
    }
  }
}

That is the whole setup. No API key, no account, no payment, no config. The engine runs locally on your machine and reads only public data — npm, PyPI, GitHub Releases, and OSV.dev.

Two tools appear in your agent:

Optionally set ANTHROPICAPIKEY to add LLM-synthesized migration steps on top of the deterministic results. It works fully without one.

Why this exists

Every LLM is frozen at a training cutoff. Libraries are not. When an agent writes code against a version newer than its cutoff, it confidently emits an API that no longer exists — and then burns roughly six failed build-fix iterations converging on the truth.

The SDKProof benchmark (July 2026) measured this: models score 80/100 on Prisma v7 (the v6 PrismaClient pattern was removed) and 90/100 on Vercel AI SDK v5+ (parameters renamed, maxSteps deleted).

Without driftwatch:  ~6 failed iterations x ~15k tokens  ->  $0.30-$1.50 + 10-20 min
With driftwatch:     1 call                              ->  $0.05

A 6–30x return the buyer computes for themselves. No trust required.

Quick start

npm install
cp .env.example .env
npm start
# The product
curl "localhost:4021/v1/delta?ecosystem=npm&name=react&from=18.2.0&to=19.0.0"

# Free safety check -- catches hallucinated and typosquatted packages
curl "localhost:4021/v1/check?ecosystem=npm&name=recat"

Runs with payments off and paid AI features off. Costs nothing.

What you get

{
  "package": "react",
  "from": "18.2.0", "to": "19.0.0",
  "jump": { "kind": "major", "majorsCrossed": 1, "releasesInRange": 583 },
  "tier": "evidence",
  "breakingChanges": [
    {
      "summary": "Removed: `ReactDOM.render`, `ReactDOM.hydrate` ...",
      "version": "19.0.0",
      "confidence": "medium",
      "symbols": ["ReactDOM", "render", "hydrate"],
      "citations": [{ "kind": "release-note", "url": "https://github.com/..." }]
    }
  ],
  "advisories": [],
  "citations": [ /* every source we relied on */ ]
}

Every claim links to a primary source. We publish facts and short citations — never wholesale documentation.

Architecture

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

driftwatch: common questions

Is driftwatch MCP server safe?
Mostly: it is graded B (80/100). Read the driftwatch safety report
How do I install driftwatch?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does driftwatch need an API key?
Yes. The registry entry asks for ANTHROPIC_API_KEY.
Is driftwatch maintained?
The last commit was 16 days ago (2026-10-19). The latest release is v0.1.2.
How does driftwatch compare with other MCP servers?
safety score 80/100 (higher than 60% of 48,255 servers); tools 2 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.