Install the gate and watch your first HOLD

What you'll have · ~4 min

The gate installed and wired into your MCP hosts, and a live contract change held right in front of you, so you know exactly what a HOLD looks like before it matters.

Skip ahead and watch a contract change get held first

The tool your agent trusted on Monday can change on Tuesday, with no version bump your client notices. The gate installs locally, pins the declared contract of each tool you wire it in front of on first sight, and HOLDs a call when that contract silently changes, before your agent acts. It is a contract-diff, not a safety verdict, and it holds no credentials. Here is the whole path, start to finish.

  1. 01

    Install the gate#

    Run this in your terminal. It installs the gate binary and rewrites each MCP host's config so that host's servers launch behind the gate. Free, no account, runs locally.

    uv tool install mcpindex-gate && mcpindex-config-wire
    Prefer the one-script install?

    The install script does the same install + wiring in one pass - read it before you run it:

    Read the script first

    Pipe to less to read it before you run it. uninstall.sh restores the original config.

    curl -fsSL https://mcpindex.ai/install.sh | less
    Run it
    curl -fsSL https://mcpindex.ai/install.sh | sh
  2. 02

    See what it wired#

    The one-liner only touches the hosts it actually finds on your machine. These are the hosts it knows how to config-wire:

    Detected and wired
    Claude DesktopClaude CodeCursorVS CodeWindsurfClineZedGemini CLI

    The installer rewrites each host's config so its servers launch behind the gate. It only touches hosts it finds; the rest are untouched.

  3. 03

    Restart your host#

    Quit and reopen the host you use (Claude Desktop, Cursor, and so on) so it reloads the gated config. Nothing changes about how you call your tools. The gate sits in the path and stays quiet until a contract drifts.

    Not seeing this?

    If tools stop appearing after the restart, run mcpindex-config-wire status to check the wiring, or uninstall.sh to un-wire every host config and restore the originals.

  4. 04

    Watch a contract change get held#

    Now the part that matters. Pin a tool's contract, apply a change, and watch what the gate does. This runs the real diff logic in your browser (the same mapping the installed gate uses), so there is nothing to fake. Try a breaking change and a benign one:

    in-path drift gate
    posture
    pinned contract TOFU baseline
    make_report(
  title:    string,
  count:    integer[0..1000],
  mode:     enum[fast, full],
)  // read-only
    apply a silent change to the tool
    contract-diff, not a safety verdictthis is the same deterministic gate that runs in your agent
  5. 05

    Read the verdict#

    A HOLD means the live contract differs from what you pinned, so the call is paused before your agent acts. A PROCEED means there was no breaking difference (a benign added-optional field can pass through). The verdict is about what changed, never a claim that the tool is safe.

    HOLDgate, in-path

    the live contract differs from what you pinned; the call is paused before your agent acts.

    PROCEEDgate, in-path

    no breaking difference (a benign added-optional field can pass); the call goes through.

    REVIEWdirectory screen

    an advisory, semantic-only read flagged something to look at before you wire the tool.

    UNVERIFIEDdirectory screen

    no verdict on file yet; the directory is not asserting anything about it.

  6. 06

    Find the trace on stderr#

    As the gate works it leaves one quiet line per call on your host's stderr, so you can see it is present without it getting in your way.

    On your host's stderr
    mcpindex · noted github/create_issue
mcpindex · noted github/delete_repo - delete, irreversible

⬡ mcpindex - caught a silent change: a new required parameter on github/delete_repo. Held before your agent ran it.

    The first time a tool runs it leaves one dim line. When a contract has drifted, a HOLD banner names what changed and pauses the call - a contract-diff, not a claim the tool is unsafe.

  7. 07

    Bookmark your receipts page - the primary audit surface#

    Each gated call is recorded to a private receipt log keyed to your install. It is credential-blind: the verdict and the action, never the arguments or content. On the receipt that decision is logged on the trust axis: a PROCEED shows as ALLOW, a HOLD as DENY, an inconclusive as REVIEW. This page is the primary place to check what the gate did for you - host clients often bury the gate's stderr lines in log files, but the receipts page is always one click away. Your install id is a random token at ~/.mcpindex/install_id (run: cat ~/.mcpindex/install_id), and your page lives at mcpindex.ai/receipts?id=<install-id>. Open it once and bookmark it. From gate v0.9.0 the gate also prints a local weekly summary line (calls gated, drift seen, holds) that links the same page; the counters are local-only and nothing about that line is sent anywhere.

    Open your Gate Activity — the tool hash, the verdict (ALLOW, REVIEW, or DENY), and the action, one row per gated call. Paste your install id from ~/.mcpindex/install_id, then bookmark the resulting URL.

NextVet an MCP server before you install it
The 90-second pathThe install timeline. At zero seconds you install the gate; at about twenty seconds the installer wires every MCP host it detects; at about thirty seconds you restart the host; at about forty-five seconds the first tools/list pins every tool, silently, with nothing to configure and nothing to see. Then nothing happens until the first drift, which is your first hold and the only time the gate interrupts you. Silence after install is the gate working, not the gate being broken.0sinstallthe gate20swire yourMCP hosts30srestartthe host45sfirst tools/list= every tool pinnedwheneverfirst drift= your first HOLDSILENTnothing to configure.nothing to see.this is correct.THE POINTthe only time the gateever interrupts you.read it, then decide.SILENCE AFTER INSTALL IS THE GATE WORKING, NOT THE GATE BEING BROKEN.
Fig. 16 · After you install, the correct experience is that nothing visible happens.
Read Fig. 16 as text
   0s ------ 20s ------ 30s ------ 45s -------------- whenever
    |          |          |          |                     |
  install    wire your  restart    first tools/list      first drift
  the gate   hosts      the host   = every tool pinned   = your first HOLD

                                   +---- silent ----+    +--- the point ---+
                                   | nothing to     |    | this is the only|
                                   | configure.     |    | time the gate   |
                                   | nothing to     |    | interrupts you. |
                                   | see. correct.  |    |                 |
                                   +----------------+    +-----------------+

  silence after install is the gate working, not the gate being broken.

Permalink, SVG & reuse · CC BY 4.0

Anatomy of a holdA held call reads: HELD, filesystem write_file. ChangeKind added-required-param, a fixed taxonomy rather than free prose. Pinned: write_file with path and content, which is your baseline. Live: write_file with path, content and a newly required mode parameter, which is what the server sends now. Posture guard, which is why it held; monitor would only notify. Blast radius write, not reversible, stays on this machine. Three exits are offered: re-pin, reject, or tune the posture. All three are reversible.HELDfilesystem · write_fileChangeKindadded-required-parampinnedwrite_file(path, content)livewrite_file(path, content, mode*)postureguardblast radiusWRITE · not reversible · local* newly required→ re-pin→ reject→ tune posture1A fixed taxonomy. One of thirteensurfaced kinds. Never free prose.2Your baseline. What you saw first.3What the server sends now.4Why it held here. Monitor wouldnotify and let it through.5What the call would have done.6Three exits. All reversible.THE GATE SAYS “THIS CHANGED”, NEVER “THIS IS UNSAFE”.
Fig. 05 · A hold is a decision with three exits, not an error.
Read Fig. 05 as text
  |- HELD   filesystem - write_file
     ChangeKind    added-required-param       (1) fixed taxonomy. never free prose.
     pinned        write_file(path, content)  (2) your baseline. what you saw first.
     live          write_file(path, content,  (3) what the server sends now.
                              mode *)
                              * newly required
     posture       guard                      (4) why it held here. monitor would notify.
     blast radius  WRITE - not reversible     (5) what the call would have done.
                   - stays on this machine
     -> re-pin   -> reject   -> tune posture  (6) three exits. all reversible.

  the gate says "this changed", never "this is unsafe".

Permalink, SVG & reuse · CC BY 4.0

It held. Now what?A decision tree for a held call. If you expected the change, re-pin and the new contract becomes your baseline. If you did not expect it, ask whether it is breaking or destructive: if yes, reject the call, check the server changelog, and check the public ledger to see whether the crawler saw it too; if no, re-pin or move that server to the monitor posture. If the gate is holding too often, move from guard to monitor to notify and proceed, or to strict, which holds anything it cannot prove benign.HELDdid you expect this change?YESre-pin. the new contract becomes your baseline. done.NOis the change breaking or destructive?YESreject the call. check the server’s changelog, and check /ledger tosee whether the crawler caught the same drift.NOre-pin, or move that one server to the monitor posture.holding too often?guard → monitornotify and proceed. you still see every change.guard → stricthold on any drift, including benign.EVERY EXIT IS REVERSIBLE. A RE-PIN CAN BE RE-PINNED.
Fig. 06 · Every exit from a hold is reversible.
Read Fig. 06 as text
  |- HELD
     |
     +- did you expect this change?
     |     yes --> re-pin. the new contract becomes your baseline. done.
     |      no --> is it breaking or destructive?
     |                 yes --> reject the call. check the server's changelog.
     |                         check /ledger - did the crawler see it too?
     |                  no --> re-pin, or move that server to the monitor posture.
     |
     +- holding too often?
           guard --> monitor    notify and proceed. you still see every change.
           guard --> strict     hold anything not PROVEN benign.

  every exit is reversible. a re-pin can be re-pinned.

Permalink, SVG & reuse · CC BY 4.0

Questions
Do I need an account to install the mcpindex gate?
No. The gate installs locally with one command, needs no account, and holds no credentials. An account only matters later if you opt into cloud tiers or higher limits.
What does a HOLD from the gate actually mean?
A HOLD means the tool's live declared contract differs from what you pinned on first sight, so the gate pauses the call before your agent acts. It is a contract-diff (this changed), not a claim that the tool is safe or unsafe.
Will the gate change how I use my tools?
No. It sits in the path and stays quiet, leaving one trace line per call on stderr. You only notice it when a tool's contract changes and it holds the call for you to look at.