Skip to main content
Glama

detect_drift

Compare current workflow fingerprints to prior runs to identify added, removed, expanded, contracted, or silently rewritten functions, distinguishing first observation from no drift.

Instructions

Compares current workflow fingerprints against those from prior runs in .veris/state.db. A fingerprint is the SHA-256 of the workflow's sorted member ids, its internal edge signatures, and each member's normalized body hash — so a rewritten function body is detected even when its name and call targets are unchanged. Member ids are repository-relative, so renaming a directory does not register as drift. Surfaces added, removed, expanded, contracted and silently-rewritten workflows, and distinguishes a first observation from an absence of drift. Persists the current fingerprints for future comparisons.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description thoroughly discloses behavior, including side effects: it reads from .veris/state.db, computes fingerprints, and persists current fingerprints for future comparisons. It also details edge cases like ignoring directory renames and distinguishing first observations from drift absence. With no annotations, this description fully carries the transparency burden.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well-structured, covering fingerprint definition, detection capabilities, and persistence in a logical flow. It is slightly lengthy due to technical detail, but every sentence adds value and none are redundant. Could be trimmed slightly, but overall concise for the complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description explains the tool's behavior and side effects but does not specify the return format (e.g., a list of drift types). It mentions what is 'surfaced' but not the structure. Given the absence of an output schema, the description is largely complete, though a note on return shape would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the schema contains no parameter descriptions. Since all (zero) parameters are covered, the baseline of 3 applies. The description does not need to add param semantics, and it does not, which is acceptable.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: comparing current workflow fingerprints against prior runs. It specifies the exact computation (SHA-256 of member ids, edge signatures, and body hashes) and what outcomes it surfaces (added, removed, expanded, contracted, silently rewritten). This makes the purpose precise and distinguishes it from generic analysis tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains what the tool does but does not explicitly state when to use it over alternatives. It implies usage for detecting drift, but does not compare with sibling tools like analyze_repository or analyze_pr_behavior, nor mention conditions that would favor this tool. Guidance is present implicitly but not explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.