Lockdrift MCP Server

lockdrift

Has the lockfile drifted from the manifest? lockdrift compares the dependency ranges a package.json declares against the ranges recorded in package-lock.json and reports every difference, sorted by name:

• missing_from_lockfile — declared in the manifest, absent from the lockfile (someone edited package.json and never reinstalled)
• version_mismatch — present in both, but the recorded ranges disagree
• extra_in_lockfile — recorded in the lockfile but no longer declared

Lockfile v2/v3 (the root packages[""] entry) and v1 (the top-level dependencies map) are both supported. The comparison is of the recorded ranges — lockdrift reports recorded drift; it does not resolve semver or talk to a registry. Pure local computation: no network, no configuration.

CLI

npx @reneturcios/lockdrift check package.json package-lock.json
npx @reneturcios/lockdrift --version

Output is the report as JSON, e.g. {"in_sync": false, "drift_count": 1, "drift": [{"name": "zod", "kind": "version_mismatch", "declared_in": "dependencies", "package_json_range": "^3", "lockfile_range": "^2"}]}.

Exit codes: 0 on success (drift is a result, not an error), 1 on a runtime error (unreadable or invalid file), 2 on a usage error.

MCP server

npx -y @reneturcios/lockdrift mcp

MCP client config:

{
  "mcpServers": {
    "lockdrift": {
      "command": "npx",
      "args": ["-y", "@reneturcios/lockdrift", "mcp"]
    }
  }
}

Tools

• check_lockfile_drift — Compare a package.json against its package-lock.json and report drift.
  • package_json (string, required) — the package.json document, as a JSON string
  • lockfile_json (string, required) — the package-lock.json document, as a JSON string

Docker

docker run -i ghcr.io/cloudcorprecords/lockdrift
docker run --rm -v "$PWD:/w" ghcr.io/cloudcorprecords/lockdrift check /w/package.json /w/package-lock.json

Development

npm install
npm run build   # tsc -> dist/
npm test        # tsx --test test/*.test.ts (pure local, no network)
npm run dev     # run the CLI from source

License

MIT — Copyright (c) 2026 Rene Turcios