The DriftSeal trust ledger

Inspect once. Approve deliberately. Keep checking the component you actually use.

Start with a component

Paste an npm coordinate, a PyPI name, a public GitHub repository URL, a supported MCP HTTP endpoint or a JSON tool manifest into the free scanner. ZIP, wheel and tar uploads are supported within strict resource limits. YAML is not parsed in this release.

An unversioned registry coordinate follows the current release. An explicit version watches that version's artifact. A GitHub repository watch resolves its current default-branch HEAD each time.

Read the report before approving

Review fingerprints, discovered tool definitions, capability indicators, install-script presence and coverage limitations. Static indicators do not prove that a code path executes. Missing tools may be computed dynamically and therefore outside coverage.

Keep watch

Click Watch this component on a completed public-target report. Sign in, select a plan and complete checkout. Payment confirmation grants server-side entitlements and starts the approved pending watch. Daily or six-hour checks compare current evidence with the locked baseline.

Pasted manifests and uploads cannot be fetched again automatically. Use CLI baseline/diff for these inputs. Private source upload is not required.

Respond to drift

Acknowledge, mark expected, suppress a specific event with a reason, or restore it. This changes triage state without deleting evidence. Suppressing one event does not hide different future changes. Approving a new baseline is a separate explicit action.

Interpret clean results

DriftSeal provides automated technical analysis and monitoring. It does not guarantee that software is secure. A clean DriftSeal result means only that no material issue or drift was detected by the active ruleset and coverage available during that scan.