MCP Drift Watch

Why a separate feed — every MCP scanner answers one question: is this package safe today? A rug pull is the other question: the package was clean when it was reviewed, collected installs for weeks, and only then shipped a patch that runs code on npm i. Existing defences against that are local — a CLI diff you have to run yourself, a runtime proxy inside your own perimeter, or a changelog the vendor writes voluntarily. All of them mean the first victim is never protected.

What this is — the whole MCP package population re-audited daily from the outside, with every transition recorded. An event exists here because there is a snapshot from before it.

Check your own list (free, no key — put it in CI):

curl -s "https://pulsefeed.dev/mcp/drift.json?packages=pkg-a,pkg-b&days=7"

Put it in your CI — one step, no key, fails the build when a dependency you already trust changes dangerously:

- uses: Nikolife2016/mcp-drift-action@v1

github.com/Nikolife2016/mcp-drift-action

Subscribe to your own list (RSS, no signup — drop it in Slack, a reader, or a CI step):

https://pulsefeed.dev/mcp/drift.rss?packages=pkg-a,pkg-b

Full feed: /mcp/drift.json · /mcp/drift.rss · single package: GET /mcp/verify?package=<name>