Show HN: Driftcop – Open-source CLI SAST for "MCP rug pull attacks in AI Agents"

Hi HN! We just open-sourced Driftcop, a security tool for people building AI agents with external tools via MCP. Driftcop continuously checks that the tools your AI agent relies on haven’t changed or drifted in unsafe ways. The motivation came from recent findings that AI agents can be quietly compromised via their tools – e.g. a tool that was useful and benign yesterday could auto-update into something malicious today (this is known as a rug pull attack in the MCP context) Anthropic’s MCP (Model Context Protocol) makes it easy to plug tools into LLMs, but it lacks built-in security checks – in fact, MCP servers can suffer from issues like command injection, permission reuse, and version drift as highlighted by some early research. What Driftcop does: It’s essentially an AI-aware security scanner and approval workflow: When you connect your agent to an MCP server (tool provider), Driftcop first saves the approved tool descriptions and metadata. If anything later changes (the tool’s des