Diagrams · Fig. 01

Where the gate sits

The gate is inside the call path, so a hold actually stops the call.

Where the gate sitsWithout mcpindex an agent calls an MCP server directly with nothing in between. With mcpindex the gate sits in the call path: it pins the contract, diffs it, and either proceeds to the server when the live contract matches the pin, or holds the call and returns it to the agent when the contract has changed. The gate runs on your host and stores no credentials: the host hands each server its environment through the gate process, which never logs or sends it. The wired proxy sends mcpindex nothing; the Python SDK wrapper posts a credential-blind receipt per call by default.TODAYyour agentNOTHING BETWEEN THEMMCP serverWITH THE GATEyour agentTOOLS/CALLmcpindex gatePIN · DIFF · DECIDEPROCEEDlive contract matches your pinMCP serverHELDthe contract changed since you pinned it.the call never leaves your machine.RUNS ON YOUR HOST · STORES NO CREDENTIALS · THE WIRE INSTALL SENDS NOTHING
Fig. 01 · The gate is inside the call path, so a hold actually stops the call.
Read Fig. 01 as text
TODAY          [ your agent ] - - - - - - - - - - - - - -> [ MCP server ]
                                nothing between them

WITH THE GATE  [ your agent ] --> [ mcpindex gate ] --> [ MCP server ]
                                   pin - diff - decide      PROCEED
                                          |                 live contract matches your pin
                                          +--| HELD
                                             the contract changed since you pinned it.
                                             the call never leaves your machine.

               runs on your host - stores no credentials - the wire install sends nothing
What the figure says

Without mcpindex an agent calls an MCP server directly with nothing in between. With mcpindex the gate sits in the call path: it pins the contract, diffs it, and either proceeds to the server when the live contract matches the pin, or holds the call and returns it to the agent when the contract has changed. The gate runs on your host and stores no credentials: the host hands each server its environment through the gate process, which never logs or sends it. The wired proxy sends mcpindex nothing; the Python SDK wrapper posts a credential-blind receipt per call by default.

Where this is explained
//install/docs
Use this diagram

Licensed CC BY 4.0. Use it anywhere, including commercially. Keep the credit.

Credit line (HTML)

Paste under the figure. That is the whole licence obligation.

<a href="https://mcpindex.ai/diagrams/where-the-gate-sits">Where the gate sits - mcpindex.ai</a> (CC BY 4.0)
Direct SVG

Standalone image/svg+xml. Vector, editable, no stylesheet needed.

https://mcpindex.ai/diagrams/where-the-gate-sits/svg

Last reviewed 2026-07-27

Questions this answers

mcp architecture diagram &middot; how does mcp work diagram &middot; mcp interceptor &middot; in-path mcp gate