lock and drift

lock records the MCP tools you approved, and drift tells you when they silently change.

vulkro-live lock ./tools.json       # after you approve the server
git add .vulkro/mcp.lock

# later: save the server's current tools/list output again, then
vulkro-live drift ./tools.json

$ vulkro-live drift ./tools.json

drift: 2 change(s) since the lock (./.vulkro/mcp.lock):
HIGH    send_report  description-changed   description changed and now contains a high-risk signal (injection / hidden text / exfil)
LOW     read_file    annotation-changed    annotations changed (no privilege escalation, shown for review)

A server can behave during review and change later: drop a readOnlyHint, add a tool, or rewrite a description to carry instructions. lock writes a fingerprint of every tool to .vulkro/mcp.lock; drift compares the current manifest against it. Both work offline. drift never starts the server (that would run untrusted code), so capture the current manifest first and pass the same paths you gave lock.

Severity	Change
HIGH	A description that now carries injection, hidden text or an exfiltration sign; dropping `readOnlyHint` or gaining `destructiveHint`
MEDIUM	A tool added or removed; an input schema changed
LOW	A harmless rewording or annotation change, shown for review

Flags

Flag	Command	Effect
`[MANIFEST]...`	both	Manifest file(s): a `tools/list` result, an array, or one tool
`--lock <file>`	both	Lock file (default `.vulkro/mcp.lock`)
`--format <FORMAT>`	`drift`	`text` (default), `json` or `sarif`

Exit codes: lock exits 0 or 2. drift exits 0 when nothing changed, 1 when something did, and 2 on an error, including when there is no lock yet.

Run inspect before lock: verdict first, then pin what you approved.

Flags​

Flags