MCP Dependency Drift Audit

MCP Dependency Drift Audit identifies package references that may resolve to different code after configuration review. Its workflow reads MCP configuration as text or JSON, classifies selectors, and recommends reproducibility changes. Dependency mutability is a review-boundary signal, not evidence that a package is malicious, compromised, or vulnerable.

Discovery stays inside the requested workspace by default. Known paths include project MCP files and editor configurations, together with files explicitly supplied by the user. Machine-wide or user-level configuration is included only when that scope is requested. Commands and arguments found in a configuration are never executed to validate a static finding.

When MCP Drift Check is already installed, use its workspace-scoped scan:

mcp-drift-check scan-workspace --markdown

The scanner can also emit SARIF for CI evidence and GitHub Code Scanning. If it is unavailable, the optional uvx route downloads the open-source scanner from its declared GitHub source and requires approval before running. A user who declines network access or installation can still receive the manual static audit.

Manual classification treats an exact package version as SAFE for version reproducibility. Bare package names, scoped names without versions, and latest selectors are HIGH because a later resolution can change the selected code. Caret, tilde, comparison ranges, and wildcards are MEDIUM because resolution can move within their permitted range. Local paths, scripts, binaries, and unknown executables receive REVIEW because npm selector rules do not establish their update behavior. The npx yes flag is context, not a vulnerability by itself.

Use it before approving project or editor MCP configuration, adding a pull-request or CI dependency gate, reviewing npm-backed servers, or checking whether a reviewed launch definition can drift silently. It is deliberately limited to dependency mutability. Prompt injection, tool poisoning, OAuth, authorization, server implementation, malware, package provenance, and runtime isolation require other assessment. A reproducible configuration may remain unsafe for unrelated reasons.

Inputs are MCP configuration paths and their package or executable references. The bounded report identifies the configuration, MCP server, reference, classification, reason, and recommended next step. It also states that no servers were executed and that dependency drift is a reproducibility signal rather than a breach claim. Sensitive configuration values, credentials, tokens, and private headers stay out of findings and public issues.

For a mutable npm reference, the recommended correction is an exact version that the team actually reviewed, updated deliberately afterward. The workflow does not invent a version or choose today's registry release automatically. A registry query requires a network-access explanation and approval.

MCP Drift Check provides workspace discovery, Markdown reports, a GitHub Action, and SARIF 2.1.0 output. Its action defaults to workspace scope. Machine-wide scan-all is an explicit choice, while local executables and non-npm launch paths remain separate review work.