MCP Tool Trust, Permission & Schema Drift Monitor

Compare MCP tool snapshots for permission expansion, schema drift and poisoning signals, then emit trust scores and ALLOW, REVIEW or BLOCK actions. Returns structured, machine-readable results for repeatable research, monitoring, automation, Apify Tasks, API workflows, and AI agents..

Quick start

Start with this working example and replace the target values with your own:

{
  "currentItems": [
    {
      "server": "crm-mcp",
      "tool": "search_contacts",
      "changeType": "permission expansion",
      "scope": "contacts:write",
      "destructive": true,
      "riskScore": 82,
      "observedAt": "2026-09-19"
    },
    {
      "server": "docs-mcp",
      "tool": "search_docs",
      "changeType": "schema drift",
      "scope": "docs:read",
      "destructive": false,
      "riskScore": 35,
      "observedAt": "2026-09-19"
    }
  ],
  "previousItems": [
    {
      "server": "crm-mcp",
      "tool": "search_contacts",
      "changeType": "stable",
      "scope": "contacts:read",
      "destructive": false,
      "riskScore": 20,
      "observedAt": "2026-09-12"
    }
  ],
  "maxItems": 20000
}

The Actor writes structured results to the default Apify Dataset and can be used from the Store, API, schedules, Tasks, automations and MCP-compatible AI workflows.

Input

• currentItems — Current records: Current source or normalized rows to analyze.
• currentDatasetId — Current Apify Dataset ID: Optional Apify Dataset ID used when currentItems is not supplied.
• previousDatasetId — Previous Apify Dataset ID: Optional previous Apify Dataset ID used instead of previousItems.
• maxItems — Maximum records: Maximum records loaded from a Dataset input.

All integration and advanced analysis fields are optional. The default example is intentionally runnable without configuring MCP or a previous-run baseline.

Output

The Dataset exposes predictable machine-readable output. Representative fields include results.

Pricing

This Actor uses Pay Per Event. The current factory base price is $0.016000 per result event. The Apify Store remains the source of truth for the price and plan/tier details shown to the buyer.

Use cases

• Run the buyer-ready workflows exposed as Apify Tasks without preparing a custom integration first.
• Use the Actor from API or schedules for recurring collection, comparison or monitoring.
• Feed the structured Dataset output into spreadsheets, databases, automations or AI agents.
• Compare repeat runs when the product supports snapshots or previous-run inputs.

Automation and AI

Use the same Actor through Apify API, schedules, public Tasks and the Apify MCP server. Outputs are structured for downstream workflows and AI agents rather than requiring manual copy/paste.

Limitations

• Public websites and upstream APIs can change markup, access rules, rate limits or field availability without notice.
• Fields that are not publicly available are returned as unavailable or omitted rather than fabricated.
• Analytical outputs depend on the quality and coverage of the supplied or collected source data.
• Treat marketplace, reputation, workforce, safety or commercial signals as decision support and validate material decisions against the underlying source evidence.

Buyer use case and data coverage

This Actor helps teams compare supplied structured records and produce decision-ready output. Provide current source records or a compatible Apify Dataset; provide a previous snapshot to measure real changes. The first run is a baseline, not proof of newly appeared items or growth.

Results depend on upstream source coverage and may require independent verification. This analytical Actor does not promise to scrape arbitrary marketplaces directly. Use a small sample, verify the default dataset output and actual Store pay-per-event pricing before scheduling recurring runs. This reform preserves the original actor, schema, task definitions and billing.

Detailed documentation

Detailed documentation

Compare MCP tool snapshots for permission expansion, schema drift and poisoning signals, then emit trust scores and ALLOW, REVIEW or BLOCK actions.

Why use this Actor

Agent teams need continuous evidence when an MCP tool silently changes permissions, arguments, descriptions or destructive behavior after initial approval. This Actor sits above raw extraction: supply a current dataset, optionally add a previous snapshot, and receive an aggregated report built for recurring monitoring and AI-agent workflows.

Key features

• Combines permission drift, schema drift and tool-description poisoning signals in one baseline model.

• Focuses on before-versus-after trust changes rather than one-time vulnerability scanning.

• Emits deterministic ALLOW, REVIEW and BLOCK decisions for agent workflows.

• Reads inline JSON rows or Apify Dataset IDs with limited READ permission.

• Writes one auditable report to the default Dataset and INTELLIGENCE_REPORT.

Input

Provide currentItems directly or select an Apify Dataset with currentDatasetId. For change intelligence, add the prior period with previousItems or previousDatasetId. maxItems caps dataset loading. Optional Gen2 fields can provide a previous analysis and user-supplied economic assumptions.

Output

The Actor writes one decision-ready report to the default Dataset and to INTELLIGENCE_REPORT in the key-value store. The report includes counts, ranked signals, baseline evidence, confidence, regression state, an executive decision, recommended action, and the domain-specific portfolio score.

Example

Use the prefilled example or replace currentItems with rows from an upstream Actor. On recurring runs, provide the prior period in previousItems or previousDatasetId. The Actor normalizes common aliases, compares snapshots, ranks the strongest entity changes and emits agentAction.

Use cases

• MCP governance.
• AI agent security.
• tool allowlist monitoring.
• enterprise agent platforms.

Pricing

One primary pay-per-event outcome: one decision-ready intelligence report. Base price USD 0.016 before Apify tier discounts. The 256 MB data-first architecture is designed for strong unit economics.

Limitations

• Analyzes supplied public or appropriately licensed data and does not bypass restricted sources.
• Scores are decision-support signals, not predictions or guarantees.
• Keep stable identifiers across snapshots for best change detection.
• Competitor evidence is refreshed before publication because the Store changes continuously.

Workflow

upstream dataset -> current snapshot -> optional previous snapshot -> normalization -> entity aggregation -> change scoring -> ranked signals -> agentAction.

Agent execution and AI discovery (October 2026)

Use this Actor when: Compare MCP tool snapshots for permission expansion, schema drift and poisoning signals, then emit trust scores and ALLOW, REVIEW or BLOCK actions. Returns structured, machine-readable results for repeatable research, monitoring,...

For AI agents and automations:

• Find this Actor in Apify Store by its use case and verify its actual input and pricing through Apify MCP (search-actors and fetch-actor-details). Availability and ranking in Apify AI are controlled by Apify; discovery is not guaranteed.
• Read the Input tab or input schema. Recognized fields include currentItems, currentDatasetId, previousItems, previousDatasetId, maxItems, previousAnalysis, valuePerImpactUnitUsd, monthlyRuns. Required fields: See the Input tab for valid example values. Do not invent records or credentials.
• Supply a small representative input first. Use Apify API, Tasks, or MCP to run and retrieve the structured dataset; inspect the output schema rather than assuming all inputs produce the same rows.
• For programmatic calls, set timeouts and maxTotalChargeUsd in run options to limit exposure. Check the Apify Pricing tab for billable events and discounts.
• Payment compatibility: this Actor is published with limited permissions and pay-per-event pricing. Apify AGI prepaid x402 tokens can execute limited-permission Actors. Direct per-request payment is a separate, conditional feature that may require additional eligibility checks and creator verification. Do not interpret this paragraph as proof of approved KYC or guaranteed payment acceptance.
• This Actor does not independently guarantee real-time access to a third-party source. Verify input provenance and important conclusions, and do not supply confidential personal data unnecessarily.