# Draugr (dev.draugr/draugr@0.123.0) > Source: > Published: 2026-09-15 00:11:19+00:00 [← Index](https://mcpindex.ai/leaderboard) # Draugr Security scanning for AI agents: SAST, SCA, secrets, IaC, DAST, ranked by real risk. The current version, v0.123.0, was published to the official MCP registry on 2026-09-15. It is distributed through a declared package, filed under Security by this index. Removals and unreachable sources are measured across every server this index tracks, contract drift across the servers that answer in consecutive snapshots; [the index's current counts](https://mcpindex.ai/stats) put this record in context. ## Using Draugr in Claude, Cursor, Gemini CLI, Cline, or Zed? MCP tool contracts can change remotely with no version bump. The mcpindex gate pins each contract and **HOLDs the call** when it drifts-before your agent acts. Zero credentials. This is not the package install for this server itself (use **Install this server** for that). Rewrites your MCP host config so each server launches behind the gate. Inspect first: curl -fsSL https://mcpindex.ai/install.sh | less ``` uv tool install mcpindex-gate && mcpindex-config-wire ``` [method](https://mcpindex.ai/methodology) Semantic screen found no manipulation pattern in the description. Conformance probe not yet run. `mcpindex.integrity.description` passINFO evidence“Describes security scanning”via static_description - - Semantic screen only - the deterministic conformance probe has not run on this server - - Confidence is reported but not yet calibrated (v1) - - Screen reads the tool description, not the live behavior - - advisory - - registry description only no input schema - - Still current: the description we screened is unchanged, re-checked against the registry - - The registry listing (version, packages, links) changed after this screen ran - the description we assessed did not Semantic screen: an LLM judge reads the tool description for hidden instructions (status PARTIAL). A pass means the description is not lying, not that the tool is safe: a high-capability tool with an honest description still warrants caution. The deterministic conformance probe has not been run on this server yet, so the screen here is semantic-only. Posture: advisory. Confidences are reported but not yet calibrated (calibrated=false at v1). Full verdict history is not shown on this page. Own this server? [Screen its description →](https://mcpindex.ai/screen) ## That verdict was true at screening time (snapshot 2026-09-15). Contracts can change after screening, with no version bump. The gate pins Draugr’s tool contracts on first sight and holds any silent change before your agent acts - the check that keeps being true on Tuesday. [See your first HOLD in 2 minutes →](https://mcpindex.ai/guides/install-the-gate-first-hold) Related: [how to trust an MCP server](https://mcpindex.ai/guides/how-to-trust-an-mcp-server) · [screen before install](https://mcpindex.ai/guides/screen-mcp-server-before-install) · [silent contract drift](https://mcpindex.ai/guides/mcp-silent-contract-drift) People vet a server before wiring it in. One line on your project site or docs answers that with an independent record: screening verdict, registry provenance, contract drift history. It stays current as new screens and drift events land. ``` [Independent trust record for Draugr](https://mcpindex.ai/server/dev-draugr-draugr) - screening verdict, registry provenance, and contract drift monitoring. Independent trust record for Draugr - screening verdict, registry provenance, and contract drift monitoring. ``` A live verdict badge for your README or listing. It reflects the current screen, links back here, and updates when the verdict does. ``` [![mcpindex](https://mcpindex.ai/api/v1/badge/dev-draugr-draugr)](https://mcpindex.ai/server/dev-draugr-draugr) mcpindex verdict ``` [methodology](https://mcpindex.ai/methodology) [SOC 2 Complianceio.github.CSOAI-ORG/soc2-compliance-ai-mcp](https://mcpindex.ai/server/io-github-csoai-org-soc2-compliance-ai-mcp) SOC 2 Type II compliance for trust services criteria (security, availability, processing [HubVibe Site Auditsio.github.Its-fortunatefolly/hubvibe](https://mcpindex.ai/server/io-github-its-fortunatefolly-hubvibe) Rule-based site audits: accessibility, SEO, security headers, performance. Metered per call. [dev.fentz.envcp/envcpdev.fentz.envcp/envcp](https://mcpindex.ai/server/dev-fentz-envcp-envcp) Encrypted environment variable vault with AI access policies, keeping secrets safe from AI agents.