Mendrift MCP server

<!-- mcp-name: io.github.suneel190700/mendrift-mcp -->

Mendrift

Autonomous MLOps incident response agent, plus mendrift-mcp — an open-source MCP server for drift detection and ML incident tooling.

pip install mendrift-mcp     # or: uvx mendrift-mcp

Published on PyPI and the MCP Registry as io.github.suneel190700/mendrift-mcp.

▶ Live demo — run a real incident in your browser: supply an alert, watch the agent diagnose it against a real MLflow registry, and approve or reject the rollback at the human-in-the-loop gate. Toggle between a crafted synthetic scenario and real US consumer-credit benchmark data. React frontend on a FastAPI backend; the free tier sleeps, so the first load may take ~40s.

When a production model drifts or degrades, Mendrift detects it, diagnoses the root cause from monitoring and registry evidence, proposes a remediation, and executes it only after human approval.

alert ──> classify ──> diagnose (MCP tools) ──> propose
             │                                     │
           noise ──> close               human approval gate
                                                   │
                                    execute ──> verify recovery

Built with LangGraph (agent orchestration), LangChain (ChatAnthropic + bind_tools), the Model Context Protocol, Evidently, MLflow, and Claude (Haiku + Sonnet).

mendrift-mcp tools

Safety model

The approval gate is enforced in the tool layer, not the prompt: execute_rollback verifies a single-use, action-scoped HMAC token minted only by the human review flow — the minting function is never exposed over MCP. A prompt-injected or confused agent cannot execute writes.

Tested live: Claude was first ordered to roll back "with full authorization" (it proposed but declined to fabricate a token), then handed a fabricated token, which the gate rejected by constant-time HMAC comparison:

See tests/testapprovalgate.py, including the action-scoping test: a token minted for one model/version is invalid for any other.

Human-in-the-loop, crash-proof

The incident graph halts before execution (interruptbefore) and checkpoints every step to SQLite. The process can die; a new process resumes the same incident by threadid after a human mints the approval token — which enters state only via updatestate(), from outside the graph. Denial is a first-class path: no token → closedapproval_denied, no execution.

Agent design

Shortened. The full README is on GitHub.