# Agent Config Drift Detector MCP for AI Agents AI Agent Connect

> Agent Config Drift Detector monitors your AI agent's settings to ensure they haven't been tampered with or changed accidentally. It uses SHA-256 hashing to compare current system prompts and permissions against a verified baseline, flagging any unauthorized deviations immediately.

## Overview
- **Category:** security
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_nCSg5c2fIbvLAVJJFLRFF3DWB4M0DjzgJpK3LTAA/ai-agent-connect
- **Tags:** security, integrity, drift-detection, sha256, llm-ops

## Description

Keeping AI agents behaving predictably is hard when their core instructions or access levels change without anyone noticing. This MCP acts as a continuous integrity check for your agent's configuration. It looks for 'drift'—those subtle, unintended modifications to system prompts or permission sets that can turn a reliable tool into a security risk or a broken process. By generating unique digital fingerprints for your authorized settings, it can instantly spot when a configuration has moved away from its intended state. You can use it to audit specific changes, get a clear breakdown of exactly what was modified, and determine if a change is a minor tweak or a critical security threat. Instead of manually auditing logs or guessing why an agent is acting differently, you get a clear, mathematical confirmation of whether your setup is still what you intended it to be. It's a simple way to bring much-needed stability to LLM operations, and you can find it alongside thousands of other specialized tools in the Vinkius catalog.

## Tools

### check_config_integrity
Checks if the current agent settings have moved away from the authorized baseline. It uses hashing to find any unauthorized changes.

### evaluate_risk_level
Calculates how dangerous a detected change is. It helps you decide if a drift is a minor error or a critical security threat.

### get_drift_report
Produces a detailed list of the specific differences between two configuration versions. It shows exactly what changed and where.

## Prompt Examples

**Prompt:** 
```
Has the configuration for the customer-support-bot drifted from its baseline?
```

**Response:** 
```
No, the configuration for **customer-support-bot** is currently intact. 

| Status | Details |
| :--- | :--- |
| **Integrity** | Verified |
| **Hash Match** | Yes |
| **Last Check** | 2 minutes ago |
```

**Prompt:** 
```
Show me the differences between the current agent setup and the version from yesterday.
```

**Response:** 
```
I found **2 deviations** in the agent configuration:

*   **Field:** `system_prompt` 
    *   *Change:* Added instruction regarding refund limits.
    *   *Impact:* Low
*   **Field:** `allowed_tools` 
    *   *Change:* Added `database_delete` to the list of available tools.
    *   *Impact:* **CRITICAL**
```

**Prompt:** 
```
How serious is the change in the 'finance-agent' permissions?
```

**Response:** 
```
The change to the **finance-agent** is classified as **CRITICAL**.

**Risk Assessment:**
*   **Risk Score:** 92/100
*   **Reasoning:** The agent has gained `write_access` to the `ledger_db`, which was not in the original authorized baseline. This poses a significant risk to data integrity.
```

## Capabilities

### Spot unauthorized setting changes
Identify exactly when an agent's system prompt or permissions deviate from the approved baseline.

### Quantify configuration risk
Assign a severity score to detected changes to help you prioritize which drifts need immediate attention.

### Audit specific parameter differences
Get a granular breakdown of the exact differences between two versions of an agent's setup.

### Verify configuration integrity
Use cryptographic hashing to confirm that your agent's instructions haven't been tampered with.

## Use Cases

### Detecting prompt injection
An agent's system prompt is subtly altered by an external input. You use check_config_integrity to catch the deviation immediately.

### Managing production updates
You deploy a new version of an agent and use get_drift_report to confirm only the intended changes were applied.

### Auditing permission changes
A developer accidentally grants an agent extra tool access. evaluate_risk_level flags this as a high-severity security event.

### Verifying agent stability
An agent starts acting erratically. You run a check to see if its core instructions have drifted from the baseline.

## Benefits

- [object Object]
- [object Object]
- [object Object]
- [object Object]
- [object Object]

## How It Works

The bottom line is you get an instant, mathematical alert whenever your agent's instructions or permissions change.

1. Connect your agent's current configuration settings to the MCP.
2. The tool generates SHA-256 hashes to compare the live state against your saved baseline.
3. You receive a report detailing any deviations and their associated risk levels.

## Frequently Asked Questions

**How can I use Agent Config Drift Detector to secure my AI agents?**
You can use it to continuously monitor your agent's system prompts and tool permissions. It flags any unauthorized changes, ensuring your agents don't deviate from their intended behavior or security constraints.

**Does Agent Config Drift Detector work with any AI client?**
Yes, as long as your client is MCP-compatible, like Claude, Cursor, or Windsurf, you can use this to monitor your agent configurations.

**Can Agent Config Drift Detector help me find prompt injection attempts?**
It can help detect the aftermath of a prompt injection. If an injection successfully alters the agent's system instructions, the tool will identify that the configuration has drifted from the authorized baseline.

**How does Agent Config Drift Detector identify changes?**
It uses SHA-256 hashing to create a unique fingerprint of your authorized settings. It then compares this fingerprint against the current settings to see if they match perfectly.

**What kind of reports does Agent Config Drift Detector provide?**
You can get detailed reports that show exactly which fields changed, what the old and new values were, and a risk assessment of how much those changes matter.

**How does the drift detection work?**
The server computes a deterministic SHA-256 hash of critical configuration sections and compares it against a stored baseline. If the hashes differ, it performs a deep inspection to find the exact changed fields.

**What is considered a high-severity drift?**
Changes to 'permissions' are considered the highest risk, followed by modifications to the 'system_prompt'.

**Can I use this with Cursor or Claude Desktop?**
Yes, this MCP server can be connected to Cursor, Claude Desktop, VS Code, Windsurf, and any other MCP-compatible client via Vinkius Edge.