How MCP tool calls actually work, drawn.
Every figure on this site, in one place: where an in-path gate sits, what crosses the trust boundary, what a silent contract change looks like, and how a call’s blast radius is graded. Each one is inline SVG with a text version, so it works in a browser, in a screen reader, and in an answer engine that cannot see pictures.
Take them. They are CC BY 4.0: use them in a post, a deck or a doc, commercially or not, and credit mcpindex.ai. Each page below has the SVG and a copy-paste credit line.
Where the gate sits
The gate is inside the call path, so a hold actually stops the call.
Monday / Tuesday
The change arrives with no version bump, no notification and no email. The pin is the only witness.
Trust boundary
By default, nothing crosses the boundary to mcpindex.
The tier ladder
Only the deterministic rung is on. Tiers 1 to 3 are built and held off by default.
Anatomy of a hold
A hold is a decision with three exits, not an error.
It held. Now what?
Every exit from a hold is reversible.
Posture and ChangeKind
The gate reads a fixed table, not a judgement call - and strict does not hold every drift.
Two jobs, two packages
Installing the directory client does not install the gate.
Two verdict surfaces
The screen verdict and the gate verdict are different axes. Neither overrides the other.
The drift network loop
The crawler catches the drift before you do, so you are warned on call one.
Blast radius
To an agent, a search and an irreversible delete are both just "a tool call" until something labels them.
The provenance chain
The history cannot be quietly rewritten. Here is exactly what that does not prove.
Scanner, gateway, allow-list, gate
Four categories separated by when they act and what they can do about it. Only one is contract-aware and in the call path.
Where the numbers come from
The server count is a defined population, not a scrape. Every stage carries its exclusion rule.
Source liveness census
14.0% of referenced repositories were unreachable, confirmed by two independent vantages with zero disagreements.
The 90-second path
After you install, the correct experience is that nothing visible happens.
MCP needs a lockfile
npm has package-lock. pip has a lock. The MCP protocol has no equivalent row.
An answer engine cannot see an image. A diagram shipped as a picture does not just fail to help a model, it takes the explanation out of the page. So each figure here is inline SVG - its labels are real text - and carries a plain-text rendering of the same content. That is also the accessible version, and the one you can paste into an issue.