Tools
Small, free and open source. None of them change the systems they check. Everything lives in the sudodrift GitHub org.
sudodrift
Takes a snapshot of who can log in to a Linux server and who can become root, then tells you in plain English what changed: new SSH keys, NOPASSWD sudo rules, new SUID files and more. One static Go binary, no daemon, no network access.
New in v0.4.0: sudodrift sudors-check reads your sudoers files and lists every line that sudo-rs, the default sudo on Ubuntu 25.10 and 26.04, rejects, ignores or handles differently, with a suggested fix for each. Run it before you upgrade so a rule does not quietly stop working.
breach-checks
Quick “am I affected?” scripts for real leaks and supply chain incidents. Each folder checks for one incident and goes with an article on this site that explains what happened. The scripts are plain POSIX sh, read only, and short enough to read before you run them.
agent-preflight
Check what your AI coding agent will read and run before you start it. It lists every instruction and config file that Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI or VS Code would load from the current folder, then flags MCP servers you have not approved, hooks that run on their own, files downloaded from the internet and agent files sitting in places like Downloads.
New in v0.2.0: every MCP server it finds is also checked against a small, dated list of MCP servers with published vulnerabilities, starting with the nine VulnCheck CVEs from October 27, 2026 and the AWS API MCP Server bug CVE-2026-115413. A match is flagged even after you approve the server, because approving a server does not patch it. It also flags Gemini CLI hooks, Cursor mcp.json, VS Code folder-open tasks and devcontainer lifecycle commands.
releasedrift
Find GitHub release downloads, check SHA-256 pins, and catch swapped release assets. It reads Dockerfiles, shell scripts, Makefiles, GitHub Actions workflows and Ansible, finds every file they download from GitHub releases, and tells you which ones are not pinned to a SHA-256. It also asks GitHub whether each release is immutable and remembers each file’s digest, so the next run tells you if a file was replaced. It was written after the OVHcloud CLI release files were swapped for a stealer in October 2026.
keydrift
Find the API keys on your machine and see which ones an incident exposed. It reads the places keys end up on a developer machine (AI agent logs, shell histories, env files, tool configs and CI files), lists every key it finds without showing the value, and gives you a rotation list with the most urgent key first and a link to where you revoke it. keydrift match checks for signs of known incidents such as the LiteLLM 1.107.0 release and the OVHcloud CLI swap. It only reads files and sends nothing over the network.
keyburn
Catch a stolen OpenAI or Anthropic key from its usage and spend. It reads the providers’ own Admin APIs, works out how much each key used per day, and alerts you when a key suddenly does far more than its normal day, when a key you marked as dormant gets used, or when today’s spend passes your limit. Run it from cron and get alerts on stdout, ntfy, a webhook or email. It never creates, changes or revokes keys.
Found a bug or a false positive? Open an issue on the repo for that tool.