MCP Index

Install the mcpindex gate (one command)

No pipe-to-shell: installs the PyPI package, then runs the wiring wizard. Script alternative: curl -fsSL https://mcpindex.ai/install.sh | sh (read it first with | less). Restarts your host after wiring.

uv tool install mcpindex-gate && mcpindex-config-wire

Free · no account · runs locally. This is the gate (in-path HOLD) - PyPI mcpindex-gate, not the directory MCP client. New here? Walk through it → · Discovery one-liners ↓ · auditable uv path · all install options →

Live

Snapshot 9h ago Tracking 31,034 MCP servers 7-day delta +5670

/changelog /api/registry-count

Pin a tool, apply a change, see the verdict.

The same deterministic gate that runs in your agent: a contract-diff, not a safety verdict. Breaking changes are HELD; benign added-optional proceeds silently.

in-path drift gatedeterministic · client-side · contract-diff

make_report(
  title:    string,
  count:    integer[0..1000],
  mode:     enum[fast, full],
)  // read-only

apply a silent change to the tool

contract-diff, not a safety verdictthis is the same deterministic gate that runs in your agent

Or watch it explained

[

Can an MCP tool change after your agent trusts it?

1:52 · 7 key moments · full transcript

](https://mcpindex.ai/watch/mcp-tool-contract-drift)[

How to install the mcpindex gate in Claude Desktop, Cursor or VS Code

1:19 · 4 key moments · full transcript

](https://mcpindex.ai/watch/install-the-mcpindex-gate)

Embed or share these: Videos & embed →

How the gate works

How does the gate catch a silent contract change?

Agents trust tool descriptions like system prompts. MCP tools can change remotely with no version bump. The gate catches that change in-path before the call goes through.

Where the gate sits Without mcpindex an agent calls an MCP server directly with nothing in between. With mcpindex the gate sits in the call path: it pins the contract, diffs it, and either proceeds to the server when the live contract matches the pin, or holds the call and returns it to the agent when the contract has changed. The gate runs on your host, holds no credentials, and the default build egresses nothing.TODAY your agent NOTHING BETWEEN THEM MCP server WITH THE GATE your agent TOOLS/CALL mcpindex gate PIN · DIFF · DECIDE PROCEED live contract matches your pin MCP server HELD the contract changed since you pinned it.the call never leaves your machine. RUNS ON YOUR HOST · ZERO CREDENTIAL CUSTODY · DEFAULT BUILD EGRESSES NOTHING

Fig. 01 · The gate is inside the call path, so a hold actually stops the call.

Read Fig. 01 as text

TODAY          [ your agent ] - - - - - - - - - - - - - -> [ MCP server ]
                                nothing between them

WITH THE GATE  [ your agent ] --> [ mcpindex gate ] --> [ MCP server ]
                                   pin - diff - decide      PROCEED
                                          |                 live contract matches your pin
                                          +--| HELD
                                             the contract changed since you pinned it.
                                             the call never leaves your machine.

               runs on your host - zero credential custody - default build egresses nothing

Permalink, SVG & reuse · CC BY 4.0

1. Install once, rides your agent

   How this step works One config-wire in Claude Desktop, Claude Code, Cursor, Gemini CLI, Cline, or Zed. The gate sits in your agent’s MCP session. No credentials; the contract-diff runs locally and the default build egresses nothing. The optional cloud tier-1 lookup, held off by default, sends only a contract hash-never tokens or call data. stdio interceptor + TS / Python SDK

2. Pins each tool on first sight

   How this step works On first sight, the gate records the tool’s contract-name, params, constraints, annotations, schemas-and persists it across restarts. TOFU: the baseline is what you saw. TOFU pin · cross-restart persistence

3. HOLDs the call when the contract changes

   How this step works On every later call, the gate diffs the live contract against your pin. Silent required-param adds, narrowed constraints, or destructive flips HOLD the call and name the ChangeKind. deterministic diff · Monitor / Guard / Strict

4. You review, re-pin, or validate

   How this step works A held call is a decision: read the diff, re-pin the new contract, or send it back. Benign added-optional proceeds silently. The verdict is “this changed,” never “this is unsafe.” review · re-pin · validate

Two install jobs

Gate first. Directory client only if you want discovery in-chat.

Job 1 - gate (hero above): pins contracts and HOLDs drift in-path for Claude Desktop, Claude Code, Cursor, Gemini CLI, Cline, and Zed. Ships as mcpindex-gate via uv from PyPI - no pipe-to-shell. Script alternative: curl -fsSL https://mcpindex.ai/install.sh | sh (audit it first with | less).

Pinned, in-path, zero custody. Full wiring - including the auditable uv tool install path - is in the docs.

Job 2 - directory MCP client (advisory; does not install the gate)

Adds mcp-server-mcpindex to Claude Code (user scope). Restart/reload MCP after.

claude mcp add --scope user mcpindex -- npx -y mcp-server-mcpindex@latest

Adds mcp-server-mcpindex to Gemini CLI (user scope). Restart gemini after.

gemini mcp add -s user mcpindex npx -y mcp-server-mcpindex@latest

npm global / JSON config (Cursor, Claude Desktop, Cline, Zed)

npm global (or pick your host on /install)

Separate from the in-path gate. Tools: recommend_mcp_for_task, search_mcp_servers, compare_servers, check_tool_trust, assess_server, get_install_command. Per-host command or config: /install

npm install -g mcp-server-mcpindex

Trust, stated plainly

Does the gate hold your credentials?

No. It diffs a tool’s live contract against what you pinned, fails closed to a HOLD on doubt, and never holds your keys.

Dig deeper

Blast radius - grade the move, not just the tool

A read and an irreversible delete look identical to your agent-both are “a tool call.” The gate labels each call’s blast radius in the path before it runs: action (read, write, delete, send, execute), what it touches, whether it can be undone, and whether it leaves your org.

Deterministic and advisory. On by default in @mcp-index/sdk and mcpindex-gate. It never overrides the gate’s HOLD/PROCEED decision.

Honest edges - what the gate claims and doesn’t

A trust product earns trust by stating its edges. The gate says “this contract changed,” never “this is safe.” Read the methodology.

A contract-diff, not a safety verdict

The gate reports that a tool’s contract changed versus what you pinned. It does not judge whether the change is malicious or whether the tool is "safe". It tells you what changed and lets you decide.

Advisory in judgment, in-path so it can HOLD

The verdict is advice. But the gate runs inside the call path, so a HOLD actually stops your agent before it acts on the changed contract. It is not a notification after the fact.

Fails closed, never open

When the gate can’t verify a changed contract (an unparsed tool, a tier held off, a degraded check), it HOLDs the call rather than waving it through. Doubt resolves to REVIEW or a hold, never to a silent proceed.

Deterministic diff, not an LLM guess

The ChangeKind taxonomy (added-required-param, constraint-narrowed, annotation-flip-to-destructive, output-schema-changed, removed / type / enum drift) is computed structurally. Same pin, same contract, same verdict, every time.

Zero credential custody

The gate never holds your API keys or tokens. It reads tool contracts in the session you already opened; nothing is sent to a server to make the call.

Tier-0 is live; tiers 1-3 are built but held off by default

What runs on Cursor today: the in-path stdio interceptor, the TOFU pin with cross-restart persistence, the deterministic ChangeKind diff, Monitor / Guard / Strict postures, and the marker scan for input and output schemas. Above tier-0 the ladder is built as in-path seams (a cloud tier-1 corpus lookup, a tier-2 LLM consult, a tier-3 behavioral verifier), but each is held off by default and requires explicit opt-in. The default build egresses nothing and stays fail-closed.

The behavioral tier clears or refutes - it never proves safe

When enabled, the tier-3 verifier exercises a changed tool to clear the change or refute it; it is not a proof of safety, and it is unavailable by default. Confidence is reported but not yet calibrated against a held-out corpus (calibrated=false at v1). We say "caught / held / cleared", never "guaranteed safe".

Directory corpus - screen verdicts and the drift ledger

Before you wire a tool, the directory screens it (REVIEW or UNVERIFIED at v1). In the call path, the gate says HELD or PROCEED. Screen verdicts are semantic-only and advisory - never an ALLOW or DENY clearance (those unlock with the behavioral corpus).

mcpindex also crawls the public MCP registry daily. Opt-in and crawler-corroborated drift never moves the decision. Every catch is public in the live drift ledger, analyzed in The MCP Drift Report.

screening

inference.sh

REVIEW

Semantic screen found no manipulation pattern in the description. Conformance probe not yet run.

integrity · pass

real verdicts · pause or hover

Maturity Rankings → Screen → Search → 30484 servers screened · advisory, semantic-only

Overview films: Concept & persona videos → · Whitepaper →