MCP Index

uv tool install mcpindex-gate && mcpindex-config-wire

Pin a tool, apply a change, see the verdict.

The same deterministic gate that runs in your agent: a contract-diff, not a safety verdict. Breaking changes are HELD; benign added-optional proceeds silently.

in-path drift gatedeterministic · client-side · contract-diff

How to install the mcpindex gate in Claude Desktop, Cursor or VS Code

How does the gate catch a silent contract change?

Agents trust tool descriptions like system prompts. MCP tools can change remotely with no version bump. The gatecatches that change in-pathbefore the call goes through.

Where the gate sits<!-- --> <!-- -->Without mcpindex an agent calls an MCP server directly with nothing in between. With mcpindex the gate sits in the call path: it pins the contract, diffs it, and either proceeds to the server when the live contract matches the pin, or holds the call and returns it to the agent when the contract has changed. The gate runs on your host, holds no credentials, and the default build egresses nothing.<!-- -->TODAY<!-- --> <!-- -->your agent<!-- --> <!-- -->NOTHING BETWEEN THEM<!-- --> <!-- -->MCP server<!-- --> <!-- -->WITH THE GATE<!-- --> <!-- -->your agent<!-- --> <!-- -->TOOLS/CALL<!-- --> <!-- -->mcpindex gate<!-- --> <!-- -->PIN · DIFF · DECIDE<!-- --> <!-- -->PROCEED<!-- --> <!-- -->live contract matches your pin<!-- --> <!-- -->MCP server<!-- --> <!-- -->HELD<!-- --> <!-- -->the contract changed since you pinned it.<!-- -->the call never leaves your machine.<!-- --> <!-- -->RUNS ON YOUR HOST · ZERO CREDENTIAL CUSTODY · DEFAULT BUILD EGRESSES NOTHING

Fig. 01 · The gate is inside the call path, so a hold actually stops the call.

Job 2 - directory MCP client (advisory; does not install the gate)

Adds mcp-server-mcpindex to Claude Code (user scope). Restart/reload MCP after.

claude mcp add --scope user mcpindex -- npx -y mcp-server-mcpindex@latest

Adds mcp-server-mcpindex to Gemini CLI (user scope). Restart gemini after.

gemini mcp add -s user mcpindex npx -y mcp-server-mcpindex@latest

npm global / JSON config (Cursor, Claude Desktop, Cline, Zed)

npm global (or pick your host on /install)

Separate from the in-path gate. Tools: recommend_mcp_for_task, search_mcp_servers, compare_servers, check_tool_trust, assess_server, get_install_command. Per-host command or config: /install

No. It diffs a tool’s live contract against what you pinned, fails closed to a HOLD on doubt, andnever holds your keys.

Blast radius - grade the move, not just the tool

A read and an irreversible delete look identical to your agent-both are “a tool call.” The gate labels each call’sblast radius in the pathbefore it runs: action (read, write, delete, send, execute), what it touches, whether it can be undone, and whether it leaves your org.

Deterministic and advisory. On by default in@mcp-index/sdkandmcpindex-gate. It never overrides the gate’s HOLD/PROCEED decision.

Honest edges - what the gate claims and doesn’t

The gate reports that a tool’s contract changed versus what you pinned. It does not judge whether the change is malicious or whether the tool is "safe". It tells you what changed and lets you decide.

Advisory in judgment, in-path so it can HOLD

The verdict is advice. But the gate runs inside the call path, so a HOLD actually stops your agent before it acts on the changed contract. It is not a notification after the fact.

When the gate can’t verify a changed contract (an unparsed tool, a tier held off, a degraded check), it HOLDs the call rather than waving it through. Doubt resolves to REVIEW or a hold, never to a silent proceed.

The ChangeKind taxonomy (added-required-param, constraint-narrowed, annotation-flip-to-destructive, output-schema-changed, removed / type / enum drift) is computed structurally. Same pin, same contract, same verdict, every time.

The gate never holds your API keys or tokens. It reads tool contracts in the session you already opened; nothing is sent to a server to make the call.

Tier-0 is live; tiers 1-3 are built but held off by default

What runs on Cursor today: the in-path stdio interceptor, the TOFU pin with cross-restart persistence, the deterministic ChangeKind diff, Monitor / Guard / Strict postures, and the marker scan for input and output schemas. Above tier-0 the ladder is built as in-path seams (a cloud tier-1 corpus lookup, a tier-2 LLM consult, a tier-3 behavioral verifier), but each is held off by default and requires explicit opt-in. The default build egresses nothing and stays fail-closed.

The behavioral tier clears or refutes - it never proves safe

When enabled, the tier-3 verifier exercises a changed tool to clear the change or refute it; it is not a proof of safety, and it is unavailable by default. Confidence is reported but not yet calibrated against a held-out corpus (calibrated=false at v1). We say "caught / held / cleared", never "guaranteed safe".

Directory corpus - screen verdicts and the drift ledger

Before you wire a tool, the directory screens it (REVIEW or UNVERIFIED at v1). In the call path, the gate saysHELD or PROCEED. Screen verdicts are semantic-only and advisory - never an ALLOW or DENY clearance (those unlock with the behavioral corpus).

Semantic screen found no manipulation pattern in the description. Conformance probe not yet run.

Search global news using natural language. Webz.io News Search API returns the most relevant articles and content, with filters for source, country, language, date, sentiment, and category.

An MCP server for the Context7 project, providing HTTP streaming and search endpoints for library information without local installation.

Search and access academic paper metadata from Crossref.

Search and chat across your company's apps using the Glean API.

Real-time sports intelligence for AI agents — schedules, live scores, odds, public betting splits, and AI bet analysis across 8 sports (MLB, NFL, NBA, NHL, NCAAF, NCAAB, tennis, soccer).

A meta-server for discovering and provisioning other MCP servers from a large database.

Discover and explore MCP servers and integrations using the PulseMCP API.

This MCP (Model Context Protocol) server provides integration with Wiki.JS for searching and listing pages from Agent Voice Response Wiki.JS instance.

Fetch, convert, and search AWS documentation pages, with recommendations for related content.

Search campgrounds around the world on campertunity, check availability, and provide booking links.