The tool your agent trusted on Monday can change on Tuesday — silently.
mcpindex holds the call before your agent acts on the change.
It pins every MCP tool contract on first sight and HOLDs the callthe instant that contract drifts—before your agent acts. Zero credentials. One-click gate install in Claude Desktop, Claude Code, Cursor, Gemini CLI, Cline, and Zed.
Inspect first: curl -fsSL https://mcpindex.ai/install.sh | less — then run the command. Restarts your host after wiring.
curl -fsSL https://mcpindex.ai/install.sh | shFree · no account · runs locally. This is the gate (in-path HOLD) — PyPI mcpindex-gate, not the directory MCP client. Discovery one-liners ↓ · auditable uv path
Pin a tool, apply a change, see the verdict.
The same deterministic gate that runs in your agent: a contract-diff, not a safety verdict. Breaking changes are HELD; benign added-optional proceeds silently.
make_report(
title: string,
count: integer[0..1000],
mode: enum[fast, full],
) // read-onlyPersona walkthrough & embed: Videos & embed →
How does the gate catch a silent contract change?
Agents trust tool descriptions like system prompts. MCP tools can change remotely with no version bump. The gate catches that change in-path before the call goes through.
Install once, rides your agent
How this step works
One config-wire in Claude Desktop, Claude Code, Cursor, Gemini CLI, Cline, or Zed. The gate sits in your agent’s MCP session. No credentials; the contract-diff runs locally and the default build egresses nothing.
The optional cloud tier-1 lookup, held off by default, sends only a contract hash—never tokens or call data.
stdio interceptor + TS / Python SDKPins each tool on first sight
How this step works
On first sight, the gate records the tool’s contract—name, params, constraints, annotations, schemas—and persists it across restarts. TOFU: the baseline is what you saw.
TOFU pin · cross-restart persistenceHOLDs the call when the contract changes
How this step works
On every later call, the gate diffs the live contract against your pin. Silent required-param adds, narrowed constraints, or destructive flips HOLD the call and name the ChangeKind.
deterministic diff · Monitor / Guard / StrictYou review, re-pin, or validate
How this step works
A held call is a decision: read the diff, re-pin the new contract, or send it back. Benign added-optional proceeds silently. The verdict is “this changed,” never “this is unsafe.”
review · re-pin · validate
Gate first. Directory client only if you want discovery in-chat.
Job 1 — gate (hero above): pins contracts and HOLDs drift in-path for Claude Desktop, Claude Code, Cursor, Gemini CLI, Cline, and Zed. Ships as mcpindex-gate via uv; audit before you pipe: curl -fsSL https://mcpindex.ai/install.sh | less.
Pinned, in-path, zero custody. Full wiring — including the auditable uv tool install path — is in the docs.
Adds mcp-server-mcpindex to Claude Code (user scope). Restart/reload MCP after.
claude mcp add --scope user mcpindex -- npx -y mcp-server-mcpindex@latestAdds mcp-server-mcpindex to Gemini CLI (user scope). Restart gemini after.
gemini mcp add -s user mcpindex npx -y mcp-server-mcpindex@latestnpm global / JSON config (Cursor, Claude Desktop, Cline, Zed)
Separate from the in-path gate. Tools: recommend_mcp_for_task, search_mcp_servers, compare_servers, check_tool_trust, assess_server, get_install_command. Per-client JSON: /docs#wire-it-to-your-client
npm install -g mcp-server-mcpindexDoes the gate hold your credentials?
No. It diffs a tool’s live contract against what you pinned, fails closed to a HOLD on doubt, and never holds your keys.
Blast radius — grade the move, not just the tool
A read and an irreversible delete look identical to your agent—both are “a tool call.” The gate labels each call’s blast radius in the path before it runs: action (read, write, delete, send, execute), what it touches, whether it can be undone, and whether it leaves your org.
Deterministic and advisory. On by default in @mcp-index/sdk and mcpindex-gate. It never overrides the gate’s HOLD/PROCEED decision.
Honest edges — what the gate claims and doesn’t
A trust product earns trust by stating its edges. The gate says “this contract changed,” never “this is safe.” Read the methodology.
The gate reports that a tool’s contract changed versus what you pinned. It does not judge whether the change is malicious or whether the tool is "safe". It tells you what changed and lets you decide.
The verdict is advice. But the gate runs inside the call path, so a HOLD actually stops your agent before it acts on the changed contract. It is not a notification after the fact.
When the gate can’t verify a changed contract (an unparsed tool, a tier held off, a degraded check), it HOLDs the call rather than waving it through. Doubt resolves to REVIEW or a hold, never to a silent proceed.
The ChangeKind taxonomy (added-required-param, constraint-narrowed, annotation-flip-to-destructive, output-schema-changed, removed / type / enum drift) is computed structurally. Same pin, same contract, same verdict, every time.
The gate never holds your API keys or tokens. It reads tool contracts in the session you already opened; nothing is sent to a server to make the call.
What runs on Cursor today: the in-path stdio interceptor, the TOFU pin with cross-restart persistence, the deterministic ChangeKind diff, Monitor / Guard / Strict postures, and the marker scan for input and output schemas. Above tier-0 the ladder is built as in-path seams (a cloud tier-1 corpus lookup, a tier-2 LLM consult, a tier-3 behavioral verifier), but each is held off by default and requires explicit opt-in. The default build egresses nothing and stays fail-closed.
When enabled, the tier-3 verifier exercises a changed tool to clear the change or refute it; it is not a proof of safety, and it is unavailable by default. Confidence is reported but not yet calibrated against a held-out corpus (calibrated=false at v1). We say "caught / held / cleared", never "guaranteed safe".
Directory corpus — screen verdicts and the drift ledger
Before you wire a tool, the directory screens it (REVIEW or UNVERIFIED at v1). In the call path, the gate says HELD or PROCEED. Screen verdicts are semantic-only and advisory — never an ALLOW or DENY clearance (those unlock with the behavioral corpus).
mcpindex also crawls the public MCP registry daily. Opt-in and crawler-corroborated drift never moves the decision. Every catch is public in the live drift ledger.
Semantic screen found no manipulation pattern in the description. Conformance probe not yet run.
Overview films: Concept & persona videos → · Whitepaper →