Tune how strictly the gate holds

What you'll have · ~3 min

You understand Monitor, Guard, and Strict by toggling them on the live demo, and you know how to set the one you want for the way you installed the gate.

The gate reaches a contract-diff verdict first, then a posture decides what to do with it. The verdict underneath never changes; the posture only sets how cautious the hold is. Guard is the default.

  1. 01

    Meet the three postures#

    Toggle the posture on the demo below and apply the same change to see how the decision shifts.

    • Monitor notifies and proceeds (awareness, no friction).
    • Guard (default) holds the unambiguously breaking and dangerous changes, and auto-accepts a proven-benign drift (an added optional param, a byte-identical description) so cosmetic churn never raises a false alarm.
    • Strict holds on any drift.
    in-path drift gate
    posture
    pinned contract TOFU baseline
    make_report(
  title:    string,
  count:    integer[0..1000],
  mode:     enum[fast, full],
)  // read-only
    apply a silent change to the tool
    contract-diff, not a safety verdict·this is the same deterministic gate that runs in your agent
  2. 02

    Set your posture#

    How you set it depends on how the gate is installed:

    • Claude Desktop bundle: choose the Protection posture in the install dialog. It sets the posture for you.
    • Standalone proxy or manual wiring: pass a flag to the proxy: mcpindex-proxy --posture strict (or monitor), ahead of the upstream server arguments.
    • The SDK: pass it to wrap(), for example posture: Posture.STRICT in TypeScript or posture=Posture.STRICT in Python.
    • Installed with the one-liner / config-wire: those launch under Guard by default.

    Posture is per server (each wired server runs its own gate), so you can be stricter on a high-blast-radius server than on a read-only one.

  3. 03

    Confirm which posture is active#

    There is no separate 'show posture' command, and the posture name is not stored in your receipts. The reliable signal is its effect: under Monitor an unambiguously breaking change is logged ALLOW, where Guard or Strict would hold it and log DENY (or REVIEW, for a change that needs behavioral validation). So if a change you expected to be held shows ALLOW in your Gate Activity, you are running Monitor.

    Check your Gate Activity — the verdict column: under Monitor an unambiguously breaking change shows as ALLOW, where Guard or Strict would show DENY (or REVIEW).

  4. 04

    Which posture to pick#

    Start on Guard, the default: it catches real breaking changes without nagging on cosmetic churn. Move to Strict when you want to review every drift yourself, for higher-stakes or production agents. Use Monitor when you want the signal but never a pause, awareness only.

NextIntegrate the gate in your own code
Questions
What is the default posture for the mcpindex gate?
Guard. It holds the unambiguously breaking and dangerous contract changes and auto-accepts proven-benign drift (an added optional parameter, a byte-identical description) so cosmetic churn never raises a false alarm.
How do I make the gate hold on every contract change?
Run it in Strict posture. How you set that depends on the install: pass --posture strict to mcpindex-proxy, choose it in the Claude Desktop install dialog, or pass posture=Posture.STRICT to the SDK's wrap(). Config-wired installs run Guard by default.