What fails open, what fails closed.
When mcpindex infrastructure fails, gate decisions do not change. The decision path runs locally on your machine and fails closed; the hosted side enriches decisions but never makes them. That is a design boundary, not a promise - each surface below states exactly what its failure does, and each claim is checkable in the shipped SDK source.
- Drift gate (SDK / interceptor)
Local. No network call on the decision path - the gate compares the pinned contract hash against the live server, on your machine.
on failure · Fails closed. A scan, diff, or validation error on a drifted contract returns HOLD, never PROCEED. failOpen exists as an explicit opt-in and stamps every verdict it touches with failOpenWarning.
- Pin store
Local file. Carries the public contract hash and optional public schema - never a token or credential, by construction.
on failure · A missing pinned schema reads as "nothing to compare against" and holds - it does not silently pass.
- Fleet drift advisories
Network read from mcpindex.ai. Advisory only: rides alongside a decision.
on failure · Fails open by design - an unreachable advisory feed never converts a decision in either direction. It enriches; it does not decide.
- Hosted APIs (/api/mcp, preflight, screen)
Network. Discovery, screening, and hosted verdict lookups.
on failure · Unavailable means unavailable - an error, not a synthetic verdict. No surface fabricates a PROCEED or a PASS while the control plane is down.
- Badges
Served by the hosted API with a 5-minute cache and a verdict expiry stamp.
on failure · An outage renders a broken image, not a stale green. A verdict past its expiry renders "stale" even while everything is up - the badge never overstates how fresh the evidence is.
- Ambient notice + drift telemetry
Ambient notice writes one line to stderr, first touch per tool - never stdout, never the agent channel, no argument values. Telemetry is off by default (zero egress) until MCPINDEX_DRIFT_TELEMETRY is set.
on failure · Nothing to fail: neither can alter a gate decision, and neither sends anything you did not turn on.
On 2026-08-01 the hosting platform disabled this site's deployments for 3h40m (a usage-cap event; details in the incident log). Every hosted surface above was unreachable. No gate decision changed, no badge rendered a false pass, and installed SDKs kept enforcing their pins offline - the failure behaved exactly as this page says it should. Semantics on this page were last verified against the SDK source on 2026-08-01.
Live uptime at the external status page · trust model · methodology