Warn on Un-Pinned MCP Server Command Drift at Startup
An MCP server's own launch command (the actual binary/args in settings.json) can drift silently — a dependency update, a cloned repo's own edit — without the server's declared tools changing at all. This checks the configured commands against a pinned snapshot at every session start.
1. Save this as the hook script
#!/usr/bin/env python3
"""SessionStart hook — warns if MCP server launch commands in
.claude/settings.json differ from a pinned baseline file."""
import json, sys
from pathlib import Path
data = json.load(sys.stdin)
cwd = Path(data.get("cwd", "."))
settings_path = cwd / ".claude" / "settings.json"
baseline_path = cwd / ".claude" / "mcp_command_baseline.json"
if not settings_path.exists():
sys.exit(0)
try:
current = json.loads(settings_path.read_text()).get("mcpServers", {})
except Exception:
sys.exit(0)
if not baseline_path.exists():
baseline_path.parent.mkdir(parents=True, exist_ok=True)
baseline_path.write_text(json.dumps(current, indent=2))
sys.exit(0)
baseline = json.loads(baseline_path.read_text())
if current != baseline:
print("WARNING: configured MCP server commands differ from the pinned "
"baseline — review before trusting this session's servers.", file=sys.stderr)
sys.exit(1)
sys.exit(0)
Save to a path inside your project, e.g. .claude/hooks/warn-mcp-command-drift-startup.sh, then chmod +x it.
2. Wire it into .claude/settings.json
{
"hooks": {
"SessionStart": [
{
"hooks": [
{"type": "command", "command": "python3 .claude/hooks/warn-mcp-command-drift-startup.py"}
]
}
]
}
}
Before you use this
A hook runs with your local shell's permissions — review the script above before adding it, the same way you'd review any script you didn't write yourself. See our guide on hook security risks for the specific CVEs this category of feature has already produced.
Related hooks