Skip to main content
Glama

drift — mandate enforcement for AI agents

drift_session

Read-onlyIdempotent

Check a SEQUENCE of proposed actions against one mandate. Returns {submitted, allowed, denied, breach_by_rule, fingerprint}.

Use for a whole plan or batch, not a single action — use drift_check for that. The fingerprint is the point: rewriting or reordering any earlier decision changes the hash, so tampering with history becomes visible instead of silent.

Do NOT use it to execute the actions, or as evidence of what actually happened. It reports what was PROPOSED against a mandate you supply.

Read-only. Idempotent for a fixed action list. Amounts in integer minor units, as in drift_check.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
actionsYesProposed actions in order. Order affects the fingerprint.
mandateYesSame shape as in drift_check.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/destructive=false, but the description adds genuinely new behavioral context: the fingerprint's purpose (rewriting or reordering any earlier decision changes the hash, so tampering becomes visible) and the epistemic limit that it reports what was PROPOSED, not what happened. That is substantive disclosure beyond the structured hints, and it does not contradict them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose and return shape, then routing, then exclusions, then behavioral notes. Every sentence carries distinct information; nothing is padding or restatement of the name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description supplies the return keys ({submitted, allowed, denied, breach_by_rule, fingerprint}), and both nested-object parameters are anchored to drift_check's shape given the rich schema coverage. An agent has everything needed to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so both parameters are already documented and the baseline is 3. The description adds a unit convention not present in the schema ('Amounts in integer minor units, as in drift_check') and reinforces that ordering affects the fingerprint, giving useful extra meaning above the structured fields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and scope ('Check a SEQUENCE of proposed actions against one mandate'), states the return shape, and explicitly distinguishes itself from the sibling drift_check ('for a whole plan or batch, not a single action'). An agent can select between drift_session and drift_check without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Both directions are covered: use for a whole plan or batch, and the explicit routing rule 'use drift_check for that' for single actions. It also states what NOT to use it for ('Do NOT use it to execute the actions, or as evidence of what actually happened'), which prevents the most likely misuse.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.