Lockdrift

io.github.CloudCorpRecordsPublished by GitHub account CloudCorpRecordsv0.1.0Updated Nov 6, 2026

Lockfile versus package.json drift auditor for a repo or monorepo.

VerifiedSTDIODesktop onlyDeveloper Tools

Overview

AI-generated overview

Lockdrift checks a package.json against its package-lock.json and reports dependency drift, so an assistant can audit lockfile consistency in a repo or…

What you can do
  • Compare a package.json document with its package-lock.json and return an IN-SYNC or DRIFT verdict with a per-dependency list.
  • Report dependencies declared but missing from the lockfile, locked versions that do not satisfy the declared range, and packages locked but no longer declared.
  • Flag a missing or unparsable lockfile and support both lockfile v2/v3 and v1 formats.
When to use it
Useful when reviewing a JavaScript or TypeScript repo for stale lockfiles, for example after someone edited package.json without reinstalling, or when checking monorepo packages before a build or release.
Requirements
Runs as a local process over stdio, either via npx with the npm package or via the Docker image. No accounts, API keys, environment variables or network access are needed; the comparison is pure local computation.
Before you install
It only compares recorded ranges and does not resolve semver or contact a registry, so its verdict reflects textual range drift rather than installable versions. The tool takes the full contents of both files as input strings, so those documents are passed to the assistant.

Installation

In SourceWeft

  1. Open Lockdrift in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

lockdrift

Has the lockfile drifted from the manifest? lockdrift compares the dependency ranges a package.json declares against the ranges recorded in package-lock.json and reports every difference, sorted by name:

  • missing_from_lockfile — declared in the manifest, absent from the lockfile (someone edited package.json and never reinstalled)
  • version_mismatch — present in both, but the recorded ranges disagree
  • extra_in_lockfile — recorded in the lockfile but no longer declared

Lockfile v2/v3 (the root packages[""] entry) and v1 (the top-level dependencies map) are both supported. The comparison is of the recorded ranges — lockdrift reports recorded drift; it does not resolve semver or talk to a registry. Pure local computation: no network, no configuration.

CLI

bash
npx @reneturcios/lockdrift check package.json package-lock.jsonnpx @reneturcios/lockdrift --version

Output is the report as JSON, e.g. {"in_sync": false, "drift_count": 1, "drift": [{"name": "zod", "kind": "version_mismatch", "declared_in": "dependencies", "package_json_range": "^3", "lockfile_range": "^2"}]}.

Exit codes: 0 on success (drift is a result, not an error), 1 on a runtime error (unreadable or invalid file), 2 on a usage error.

MCP server

bash
npx -y @reneturcios/lockdrift mcp

MCP client config:

json
{  "mcpServers": {    "lockdrift": {      "command": "npx",      "args": ["-y", "@reneturcios/lockdrift", "mcp"]    }  }}

Tools

  • check_lockfile_drift — Compare a package.json against its package-lock.json and report drift.
    • package_json (string, required) — the package.json document, as a JSON string
    • lockfile_json (string, required) — the package-lock.json document, as a JSON string

Docker

bash
docker run -i ghcr.io/cloudcorprecords/lockdriftdocker run --rm -v "$PWD:/w" ghcr.io/cloudcorprecords/lockdrift check /w/package.json /w/package-lock.json

Development

bash
npm installnpm run build   # tsc -> dist/npm test        # tsx --test test/*.test.ts (pure local, no network)npm run dev     # run the CLI from source

License

MIT — Copyright (c) 2026 Rene Turcios

Source: README.md at commit f18fa1e

Tools

1

check_lockfile

Check a package.json against its package-lock.json: dependencies with no lock entry, locked versions that do not satisfy the declared range (exact, caret, tilde, and >= ranges), packages locked but not declared, and a missing or unparsable lockfile. Verdict IN-SYNC or DRIFT with per-dependency evidence.

Parameterspathrequired

Version history

1
  1. v0.1.0LatestOct 30, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts
  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts