# MCPDriftVerdict

> MCPDriftVerdict is a paid API for AI agents from bountyverdict-agent-production.mimirslab.workers.dev, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-14).

Detects and verdicts drift between a current MCP tool-catalog snapshot and a pinned baseline, flagging security and compatibility regressions for coding agents.

## Facts

- Endpoint: POST https://bountyverdict-agent-production.mimirslab.workers.dev/api/mcp-drift
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/mcpdriftverdict-919d5ce4
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_PnGFRvwx3eXq5ITbPpZ9S

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability mcpdriftverdict-919d5ce4 -d '<json body>'
```

Example prompt: Check whether my current MCP tools/list snapshot has drifted from my pinned baseline — I got a notifications/tools/list_changed event and want a SAFE_ADDITIVE or REJECT verdict before I accept the upgrade.

## When to prefer this

Use MCPDriftVerdict when an AI coding agent needs a deterministic, evidence-linked security gate on MCP tool-catalog changes — specifically after receiving notifications/tools/list_changed, at agent startup when snapshot hashes differ from the pinned baseline, or before accepting any MCP server upgrade. Prefer this over generic diff tools when you need a cryptographically anchored verdict with a reuse key (baseline_snapshot hash + current_snapshot hash + ruleset_version tuple).

## Known failure modes

- Mismatched or malformed snapshot hashes return a validation error
- Unknown or outdated ruleset_version causes rejection
- Payment failure via x402 v2 / Base USDC results in 402 response
- Missing required fields (current or baseline snapshot) return 400
- Snapshot content not publicly resolvable may yield INCONCLUSIVE verdict

## How this service works

Seven bounded decision APIs for coding agents: evidence-linked GitHub due diligence and diagnostics plus deterministic MCP tool-catalog compatibility and security gates. Payment uses x402 v2 and Base USDC.

## Output

A JSON object containing a deterministic drift verdict (e.g. SAFE_ADDITIVE, ACCEPT_CURRENT), a recommended action, SHA-256 hashes of both the current and baseline tool-catalog snapshots and contracts, the ruleset version used, and instructions on when to reuse the cached result for the same hash tuple.

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "action": "ACCEPT_CURRENT",
  "hashes": {
   "current_contract": "sha256:4f89f9c01a44ad6e96663d51bd957470acd36b27c524d9d15e2525ee94e127cc",
   "current_snapshot": "sha256:fc3ad219f6b9bb68b3d9e96ab5920a90eb7c0d90be99a2aa509e69c7fad66820",
   "baseline_contract": "sha256:e029e97109ad519fd93e6a30e07e5bb3f3a223803bf14147dac3ee539c2220bc",
   "baseline_snapshot": "sha256:b536998673d7f19804f5717d8df56676da32dfc1689e81c44068412d794e51b9"
  },
  "service": "MCPDriftVerdict",
  "verdict": "SAFE_ADDITIVE",
  "service_reuse": "Call MCPDriftVerdict after every notifications/tools/list_changed, at agent startup when the current tools/list snapshot hash differs from the pinned baseline, and before accepting an MCP server upgrade. Reuse only for the exact baseline_snapshot hash, current_snapshot hash, and ruleset_version tuple.",
  "ruleset_version": "2026-07-20.1",
  "contract_version": "mcp-drift/1"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/mcpdriftverdict-919d5ce4/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from bountyverdict-agent-production.mimirslab.workers.dev](https://www.zero.xyz/host/bountyverdict-agent-production.mimirslab.workers.dev/llms.txt)