MCP.Market

drift — mandate enforcement for AI agents MCP server

online · 96% uptime
by mrpkk·io.github.mrpkk/drift·v0.1.0
No reviews yet

Block an action a signed mandate does not permit: amount, payee, audience, currency, window, intent.

A87/100grade A
Write a reviewRun it
What users say
No reviews yet
Be the first
Safety scan
A87/100

full report

Adoption
Growing

0 stars

Reviews

Write one

Nobody has reviewed drift — mandate enforcement for AI agents yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

drift — mandate enforcement for AI agents tools (3)

write = sends, deletes, buys or posts
  • drift_checkFree

    Check ONE proposed action against a signed agent mandate BEFORE it happens. Returns {"verdict": "ALLOW"|"DENY", "rule": <name>} plus a report with a ledger fingerprint. Six rules run in a fixed order, so a refusal names the most important reason rather than an incidental one: amount, payee, audience, currency, window, intent. Anything unclassified is DENY. Use immediately before any action that spends money, moves a credential or changes state on someone else's behalf. Do NOT use to: verify mandate signatures (AP2 does that, and this server runs after signature verification), execute the action (it only decides), or certify that an intent is truthful — "intent" arrives from the agent and is untrusted input. An agent that lies within its limits still leaves a ledger entry; proving what really happened is attest's job, not this one's. Amounts are integer minor units (cents), never floats. Window bounds are inclusive. Fully idempotent: the same inputs always give the same verdict and the mandate is never mutated.

  • drift_explainFree

    Return the six enforcement rules in the exact order they are applied, each with a plain-language reason it exists. Takes no mandate and no action. Use when a refusal did not make sense, or before explaining a denial to someone whose mandate was rejected. A refusal you cannot explain is one nobody will trust. Do NOT use it to check an action — it performs no check, and cannot predict which rule will fire, only the order they are tried in. Constant output, fully idempotent, opens no files, contacts no host.

  • drift_sessionFree

    Check a SEQUENCE of proposed actions against one mandate. Returns {submitted, allowed, denied, breach_by_rule, fingerprint}. Use for a whole plan or batch, not a single action — use drift_check for that. The fingerprint is the point: rewriting or reordering any earlier decision changes the hash, so tampering with history becomes visible instead of silent. Do NOT use it to execute the actions, or as evidence of what actually happened. It reports what was PROPOSED against a mandate you supply. Read-only. Idempotent for a fixed action list. Amounts in integer minor units, as in drift_check.

Public scan report

scanner v0.1.10 · 2026-10-15 · same rubric, same numbers if you re-run it

no findings
  • –Code scanremote-only server, no package to scann/a
  • Live reliabilityremote reachable in 2059ms17/20
  • Tool poisoning3 tool descriptions checked15/15
  • Auth qualityopen endpoint, read-only tools10/15
  • Maintenancelast push 0 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 87/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How drift — mandate enforcement for AI agents compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
87/100
higher than 73% of 48,255 servers
Tools
3
the typical server has 7
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
Uptime
96%
of our recent checks; the typical remote server answers 100%
Response time
1,224 ms
faster than 8% of 30,031 servers

What its tools let an agent do: 3 read

Install drift — mandate enforcement for AI agents in Claude Code, Cursor or VS Code

claude mcp add --transport http drift https://drift.rta.lat/mcp
Add to Cursor

What the publisher says

From the drift — mandate enforcement for AI agents repository's README, as published. We do not edit it. Read it on GitHub

drift

Continuous mandate enforcement for AI agents. Every action is checked against the signed mandate before it happens, not once at signing.

pip install drift          # or: pip install -e .
python3 -m drift.http_server --http 8080

The gap

An agent is granted a mandate: who to pay, how much, in which currency, until when. AP2 verifies that mandate once, at signature time. After that the agent acts alone, and nothing holds it inside its authority.

Measured proof that this matters, from the AP2 Python SDK itself:

verify_chain documents:
  "enforcing expected_aud / expected_nonce on the terminal hop when provided"

but kb_sd_jwt.verify calls verify_expected_claims only when typ in TYP_TERMINAL,
and a kb+sd-jwt+kb token — which the SDK itself produces whenever the payload
carries a cnf — falls into TYP_INTERMEDIATE:

  hop type      : kb+sd-jwt+kb
  aud in token  : https://attacker.example/ap2
  expected_aud  : https://honest-merchant.example/ap2
  ACCEPTED a token with the wrong audience.

The protocol an agent trusts with its spending authority does not check that the authority was not substituted. drift checks it.

What it checks

Default is DENY. Rules run in fixed order, so a refusal names the most important reason rather than an incidental one.

MCP tools

No SSE, no stateful sessions, no HTTP framework. Standard library only.

Example

from drift import Mandate, Drift, Action

m = Mandate(
    payee_id="shop", audience="https://merchant.example/ap2",
    max_amount_minor=10_000, currency="USD",
    valid_from=1_700_000_000, valid_until=1_700_086_400,
    allowed_intents=("buy",),
)
d = Drift(m)
verdict, rule = d.submit(Action(
    intent="buy", payee_id="shop", audience="https://merchant.example/ap2",
    amount_minor=99_999, currency="USD", at=1_700_000_060,
))
print(verdict, rule)   # DENY amount

Limits, stated plainly

  • Does not verify mandate signatures. That is AP2's job. drift runs after signature verification, at the level of decisions.
  • Does not execute. It decides; the caller acts.
  • Does not keep state. A session is an argument. No state means no attack surface and no divergence under replication.
  • Does not tell truth from intent. intent arrives from the agent and is untrusted input. drift bounds the damage; it does not certify the intent.

If an agent controls both intent and amount, it can lie in both. Closing that gap is attest's job: attest proves afterwards, drift bounds beforehand. They are complements.

Licence

Apache-2.0.

Nothing above is checked by us. What we check is on the safety report.

drift — mandate enforcement for AI agents: common questions

Is drift — mandate enforcement for AI agents MCP server safe?
Yes, by our scan: it is graded A (87/100). Read the drift — mandate enforcement for AI agents safety report
How do I install drift — mandate enforcement for AI agents?
It runs remotely at drift.rta.lat. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
Does drift — mandate enforcement for AI agents need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is drift — mandate enforcement for AI agents maintained?
The last commit was 20 days ago (2026-10-15). The latest release is v0.1.0.
Is drift — mandate enforcement for AI agents up?
96% of our last 28 checks got an answer. We check remote servers about four times a day.
How does drift — mandate enforcement for AI agents compare with other MCP servers?
safety score 87/100 (higher than 73% of 48,255 servers); tools 3 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.