AGENT CONFIG DIFF / DRIFT CHECKER
What changed in your agent config?
Paste two versions of an agent config — .mcp.json, .claude/settings.json, or any MCP config — and see what drifted: new or removed servers, version pin changes, permission changes, and env additions. Runs entirely in your browser.
DRIFT REPORT
4 changes detected (3 high, 1 medium, 0 info).
Version pin was removed (was 1.2.3); the server will now fetch whatever is current at run time.
Fix — Restore an exact version pin. Unpinned npx/uvx installs are a supply-chain risk (OWASP ASI04).
Permission keys (autoApprove/alwaysAllow/dangerouslySkipPermissions) were added to "fs".
Fix — Auto-approval removes the human gate for tool calls. Scope it to specific low-risk tools instead of a blanket flag.
Server "memory" was added (version 2.0.0) running npx.
Fix — A new MCP server is a new trust boundary. Confirm who added it, pin its version, and scope its permissions before approving.
Environment keys changed: -API_KEY.
Fix — New env entries may carry secrets or new capabilities. Confirm the server needs them.
// About this tool
Agent Config Diff
This tool diffs two agent config texts — old vs new — and reports what changed in a drift-review format. It detects added or removed MCP servers, command changes, version pin additions/removals/bumps, permission key changes (autoApprove, alwaysAllow), and environment key additions or removals.
Config drift is how supply-chain risk creeps in: a teammate adds a server, someone removes a version pin, a merge drops a permission scoping. The diff surfaces those changes with a severity rating and a concrete fix, so a code review or an incident post-mortem can focus on what actually moved.
Inputs are compared in your browser — nothing is uploaded. If either side isn't valid JSON, the tool falls back to a line-level comparison. This is a structural review tool: run the result through the AI Agent Config Checker for a static security triage of the final config.
// When to use it
Review a config change before merging
Paste the old config and the PR's new config to see exactly which servers, versions, and permissions moved — before you approve the merge.
Investigate why an agent started behaving differently
Diff the config from last week against today's. A removed version pin or an added autoApprove is often the answer.
Audit a shared team config
Compare the committed baseline against what's running locally to catch unapproved servers or scoped-permission drift.
// Questions
Is this free?
Yes. Free, runs locally in your browser, no account required.
What counts as high-severity drift?
Adding or removing a server, changing the command runner, removing a version pin, and adding permission flags like autoApprove or alwaysAllow are all high — they change the trust boundary of the config.
Does this work on non-JSON configs?
Partially. JSON configs (the standard for .mcp.json and Claude settings) get a structured diff. If either side isn't valid JSON, the tool falls back to a line-level comparison with the changed lines listed.
Is a clean diff the same as a safe config?
No. A clean diff means nothing changed between the two versions — the config itself may still contain secrets, over-broad permissions, or injection-prone content. Run it through the AI Agent Config Checker for that.
Does this send my configs anywhere?
No. Both configs are compared entirely in your browser. Nothing is uploaded, stored, or logged.