nulladrift.
Start free

Docs

Start with one command.

MIT collector. No account. Nothing to configure.

npx nulladrift init

Quickstart

Pin once. Check on every run.

  1. 1
    npx nulladrift init

    Find your servers, read what each declares, write mcp.lock.

  2. 2
    git add mcp.lock && git commit -m "pin MCP capabilities"

    Commit the pins with your code.

  3. 3
    npx nulladrift check

    In CI: fail the build when anything has moved.

  4. 4
    npx nulladrift review

    See each change, and accept it into the lock.

In CI

With the control plane, push replaces check. The verdict comes back from it.

.github/workflows/nulladrift.yml
name: nulladrift
on: [push, pull_request]
permissions:
  contents: read
  id-token: write    # sign each reading
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npx nulladrift push
        env:
          NULLADRIFT_API_URL: ${{ vars.NULLADRIFT_API_URL }}
          NULLADRIFT_TOKEN: ${{ secrets.NULLADRIFT_TOKEN }}

Commands

npx nulladrift init

Discover servers, fetch what they declare, write mcp.lock. --force re-pins over an existing lock.

npx nulladrift check

Compare every server with mcp.lock, and the artifact behind each stdio server with its pin. --json, --sarif, --allow-unreachable, --no-provenance.

npx nulladrift review

Show each change and accept it into the lock, one at a time.

nulladrift login <server>

Authorize a server that refuses anonymous clients. Tokens are stored owner-only.

nulladrift logout <server>

Delete the credentials login stored for a server.

npx nulladrift push

Send a reading to the control plane. The verdict and exit code come back from it. With your CI's identity token, it also proves which build sent it.

nulladrift telemetry on | off | status

Anonymous drift statistics. Off by default.

Exit codes

What check tells your CI.

exit 0

Every server matched the lock.

exit 1

At least one server drifted.

exit 2

The audit could not complete: a server was unreachable, or a file could not be read.

Configs it reads

The files your clients already use. Nothing to set up.

  • .mcp.json
  • .vscode/mcp.json
  • .cursor/mcp.json
  • ~/.cursor/mcp.json
  • ~/.claude.json
  • claude_desktop_config.json
  • ~/.codeium/windsurf/mcp_config.json
  • ~/.copilot/mcp-config.json

Next: connect the app

One place for every repo: rule on changes, set policy, keep the record.

Connect the app →
READMEEverything the collector doesLockfile formatWhat lands in mcp.lockChangelogWhat changed, release by releaseSecurity policyHow to report a vulnerability