# mcpindex.ai > The in-path trust gate for agent tool calls. Pins each MCP tool contract and HOLDs the call when it silently drifts - before your agent acts. Zero credentials. Fail-closed. Not a safety oracle. Secondary: a public directory of MCP servers with advisory screening verdicts (REVIEW / UNVERIFIED at v1) so you can check a tool before you wire it. ## Scale - How many MCP servers are there? 48988 active, latest-version entries in the official registry (methodology + live count: [mcpindex.ai/stats](https://mcpindex.ai/stats)). - What is MCP tool drift? MCP tool drift is any change to a tool's contract, as a Model Context Protocol server serves it, after a client has already seen that contract. Definition, the change kinds that count, method and measured rates with DOIs: [mcpindex.ai/drift](https://mcpindex.ai/drift). - Categories: 29 - Source: registry.modelcontextprotocol.io (canonical), enriched with quality scoring, semantic search, and advisory screen verdicts. Delisted and superseded versions are excluded so the same server never counts twice. ## Drift Gate (in-path; tier-0 live, tiers 1-3 held off by default) - What it is: an in-path trust gate for agent tool calls. It pins each MCP tool's contract trust-on-first-use (TOFU) and, before your agent acts, HOLDs the call the moment that contract silently changes. Unlike the advisory screen below, it sits in the call path, so it can HOLD, not merely alert. - Method: a deterministic contract-diff (ChangeKind taxonomy: added-required-param, required-set-expanded, constraint-narrowed, type-changed, enum-values-removed, removed-param, annotation-flip-to-destructive, param-mirrored-to-header, output-schema-added/changed, tool-added/removed), plus an injection/exfil marker scan over the input and output schema and description. Postures: Monitor (releases drift holds with a note; a tamper hold and an internal error still stop the call) / Guard (default; hold dangerous, INCONCLUSIVE where behaviour is the gate, auto-accept proven-benign) / Strict (hold anything not proven benign - NOT every drift: the benign auto-accept runs before the posture layer, so a proven-benign change proceeds under strict too). Fail-closed. - Install: one-click config-wire across Claude Desktop / Claude Code / Cursor / VS Code / Windsurf / Cline / Zed / Gemini CLI via `uv tool install mcpindex-gate && mcpindex-config-wire` or `curl -fsSL https://mcpindex.ai/install.sh | sh` (rewrites the host config to route each server through the gate, which passes each server its env and stores no credentials), or the SDK wrap() one-liner (TS + Python) around an already-authenticated session. Legacy `mcpindex-preflight` is EOL (frozen 0.7.0); install `mcpindex-gate`, not preflight. See /docs. - Tiered ladder: tier-0 deterministic contract-diff is the live, deterministic leg and runs first. Above it the ladder is built as in-path seams - a cloud tier-1 corpus lookup (a contract judged once clears or condemns it everywhere), a tier-2 LLM consult on the ambiguous, and a tier-3 behavioral verifier that exercises a changed tool to clear or refute the change - but each is held off by default and requires explicit opt-in, so none of them sends anything until you enable it, and each fails closed. - Honest limits: contract_diff_not_safety_verdict (a HOLD means the contract CHANGED vs your pin, not that the new contract is unsafe; when enabled, the behavioral tier clears or refutes a change, it does not prove a tool safe); tiers1to3_held_off_by_default_opt_in; wire_install_egresses_nothing_sdk_wrapper_posts_receipts_fail_closed; calibrated_false_v1 (confidence reported but not yet calibrated against a held-out corpus). - Status: tier-0 deterministic contract-diff is live and verified end-to-end against the live gate; tiers 1-3 are built but held off by default (opt-in). ## Blast-Radius Grade (in-path; advisory, on by default) - What it is: alongside the contract-diff, the gate labels the blast radius of every tool call before your agent acts - what it would do (read, write, delete, send), whether it can be undone, and whether it leaves the machine. A read and an irreversible delete look identical to an agent until something labels them; this is that label. - Method: a deterministic static classifier derived from the tool's own declared contract (name, description, input/output schema). It reads what a call WOULD do; it does not run the tool. Output is a typed action_type, side_effect_class, reversibility, and egress, plus a static autonomy ceiling (the most autonomy a call of this shape should get). Deny-by-construction: every field is a typed enum/hash/bool, so no raw argument value can ride along in the grade. - Posture: advisory and fail-closed - when the contract is ambiguous it grades toward the more dangerous class (assumes a write/irreversible), never down. - Where it runs: on by default in the published clients - @mcp-index/sdk (TypeScript) and mcpindex-gate (Python). Deterministic, no network, no credentials. - Honest limits: blast_radius_is_static_not_a_safety_verdict (it says what a call would do, read from the contract - not whether the contract is safe, and not what a specific call's runtime arguments will actually do); advisory_grade_orchestrator_decides (mcpindex labels the blast radius; your agent or IDE owns whether to allow, pause, or require approval). ## Advisory directory screen (v1) - Verdict contract: 1.1.0 (states ALLOW / DENY / REVIEW / UNVERIFIED; severity INFO..CRITICAL). At v1 the public screen produces REVIEW or UNVERIFIED only - ALLOW and DENY are reserved in the contract, not emitted today. - Capability: check_tool_trust (exposed by the npm MCP server, see below). This is the directory client, not the in-path gate. - Framework bindings: @mcp-index/mastra wires check_tool_trust into Mastra as a beforeToolCall hook (warn or enforce; fail-closed, no credentials). A client of the advisory screen, not the in-path gate. - Pipeline (screen): today the screen is semantic-only - an LLM judge reads each tool description for hidden instructions. The deterministic conformance probe (drives the tool against its declared schema) is built but has NOT yet run on the public corpus, so no published screen verdict carries a conformance result; a clearing ALLOW (which the probe would earn) is not produced at v1. When the probe runs it is monitored, not enforced. Confidence is reported but not yet calibrated (calibrated=false). - History: Verdict history is hash-chained and anchored to Bitcoin via OpenTimestamps (latest confirmed at block 972,876). Cadence bound = confirmation latency (~10 minutes for pending; ~1 hour at N=6 confirmations for Bitcoin-finalized). Sub-window precision asserted, not proven. In-process verify proves the proof carries a Bitcoin BlockHeaderAttestation; confirmation-depth check is the relying party's job against their own Bitcoin node. - Calibration: calibrated=false at v1. Confidences are reported, not yet calibrated against a held-out adversarial corpus. - Exposure: anonymous calls return the current verdict (directive, status, dimension verdicts, severity, expires_at). Free, no key required - nothing on this API is paid-tier. - Conformance gate (D3), terminal v1: Conformance is advisory and uncalibrated in v1 (calibrated=false). The pre-registered bar was 150 human-labeled conforming tools from real servers with a false-positive upper 95% bound at or below 2%, and it was not met by the pre-registered date, 2026-09-01. A conformance result does not block or fail a tool. - Deployment posture: advisory. mcpindex publishes the verdict; the agent or IDE decides whether to act on it. - Full method: [mcpindex.ai/methodology](https://mcpindex.ai/methodology) ## Drift Network (crawler-corroborated; warns you on call 1) - What it is: mcpindex crawls the public MCP registry every day and records which tool contracts silently change. When you pin a tool, the gate can ask the network whether the crawler already caught that contract drifting - and warn you on the FIRST call, before a change you never saw burns you. A contract-diff advisory; it rides alongside the verdict and never moves PROCEED/HOLD. - Opt-in: enable with MCPINDEX_DRIFT_TELEMETRY=detection (off by default). Under the same flag the gate emits one one-way fingerprint signal on a pin/drift and queries the network; it never sends schemas, arguments, descriptions, or URLs. The fingerprint key is public, so a fingerprint still identifies a public server. - Corroboration is crawler-first: the public count floors at the crawler (sources=1), never forgeable install reports. - Public proof: every drift the crawler catches is in the public drift ledger (/ledger). ## Whitepaper - Full architecture of the in-path trust gate (and the trust-to-act category it belongs to): threat model, tiered ladder, methodology, dogfood proof, and the honest limits (contract-diff not safety oracle; calibrated=false; tiers 1-3 held off by default). - Public, free to read in full, with a free PDF (no email required): [mcpindex.ai/whitepaper](https://mcpindex.ai/whitepaper) - PDF: [mcpindex.ai/whitepaper.pdf](https://mcpindex.ai/whitepaper.pdf) ## Research / datasets (archived, citable) - Source Liveness - Baseline v1: a corroborated, timestamp-anchored census of whether the source behind every registry server is still publicly reachable. Finding: 1,830 of 13,105 referenced GitHub repositories (14.0%) were not publicly accessible as of the 2026-07-20 census, affecting 2,069 listed servers. Two independent vantages, 0 cross-vantage disagreements; census digest anchored to Bitcoin via OpenTimestamps. Live: [mcpindex.ai/research/source-liveness](https://mcpindex.ai/research/source-liveness). Archived, CC-BY-4.0: DOI 10.5281/zenodo.21501867 (concept DOI - always resolves to the current version; v1.1 is 10.5281/zenodo.21778894). - Drift Report - Edition v1: aggregate + per-server statistics of silent tool-contract changes across the reachable remote population. Live: [mcpindex.ai/drift-report](https://mcpindex.ai/drift-report). Archived, CC-BY-4.0: DOI 10.5281/zenodo.21449149 (concept DOI - always resolves to the current version; v1.1 is 10.5281/zenodo.21778727). Peer-reviewable write-up: "Registry Descriptions Go Stale Unevenly: An 89-Day Measurement of Model Context Protocol Drift, and Why Drift-Ranked Re-Auditing Under-Covers It", arXiv:2608.00997 (https://arxiv.org/abs/2608.00997); longitudinal panel dataset concept DOI 10.5281/zenodo.21709945. - The Binding Gap (talk, AI Context San Jose, 2026-09-23): across 44,172 tool contracts on 2,043 registry-listed MCP servers in 35 crawls (2026-06-09 to 2026-08-01), 83.8% declare an effect annotation and 59.3% still carry a declaration bound to the contract the server returns, a 24.5-point binding gap. Slides, method limits and citations: [mcpindex.ai/research/binding-gap](https://mcpindex.ai/research/binding-gap). Paper: "Declared vs. Observed: Measuring the Binding Gap in MCP Tool Declarations", Bharti and Agnihotri, DOI 10.5281/zenodo.22649163 (concept; v1.0 is 10.5281/zenodo.22649164); dataset DOI 10.5281/zenodo.21778281 (concept; figures from v1 10.5281/zenodo.21778282). ## Diagrams (CC BY 4.0, free to reuse with attribution) Every figure on the site is inline SVG plus a plain-text rendering, because an answer engine cannot read a picture. Gallery: [mcpindex.ai/diagrams](https://mcpindex.ai/diagrams). Each permalink carries the figure, its text version, a standalone SVG, and a credit line. Reuse is welcome - attribute mcpindex.ai. - Where the gate sits - The gate is inside the call path, so a hold actually stops the call. [mcpindex.ai/diagrams/where-the-gate-sits](https://mcpindex.ai/diagrams/where-the-gate-sits) - Monday / Tuesday - The change arrives with no version bump, no notification and no email. The pin is the only witness. [mcpindex.ai/diagrams/silent-contract-drift-timeline](https://mcpindex.ai/diagrams/silent-contract-drift-timeline) - Trust boundary - With the one-command install, nothing crosses the boundary to mcpindex. [mcpindex.ai/diagrams/trust-boundary](https://mcpindex.ai/diagrams/trust-boundary) - The tier ladder - Only the deterministic rung is on. Tiers 1 to 3 are built and held off by default. [mcpindex.ai/diagrams/tier-ladder](https://mcpindex.ai/diagrams/tier-ladder) - Anatomy of a hold - A hold is a decision with three exits, not an error. [mcpindex.ai/diagrams/anatomy-of-a-hold](https://mcpindex.ai/diagrams/anatomy-of-a-hold) - It held. Now what? - Every exit from a hold is reversible. [mcpindex.ai/diagrams/it-held-now-what](https://mcpindex.ai/diagrams/it-held-now-what) - Posture and ChangeKind - The gate reads a fixed table, not a judgement call - and strict does not hold every drift. [mcpindex.ai/diagrams/posture-matrix](https://mcpindex.ai/diagrams/posture-matrix) - Two jobs, two packages - Installing the directory client does not install the gate. [mcpindex.ai/diagrams/two-jobs-two-packages](https://mcpindex.ai/diagrams/two-jobs-two-packages) - Two verdict surfaces - The screen verdict and the gate verdict are different axes. Neither overrides the other. [mcpindex.ai/diagrams/two-verdict-surfaces](https://mcpindex.ai/diagrams/two-verdict-surfaces) - The drift network loop - The crawler catches the drift before you do, so you are warned on call one. [mcpindex.ai/diagrams/drift-network-loop](https://mcpindex.ai/diagrams/drift-network-loop) - Blast radius - To an agent, a search and an irreversible delete are both just "a tool call" until something labels them. [mcpindex.ai/diagrams/blast-radius](https://mcpindex.ai/diagrams/blast-radius) - The provenance chain - The history cannot be quietly rewritten. Here is exactly what that does not prove. [mcpindex.ai/diagrams/provenance-chain](https://mcpindex.ai/diagrams/provenance-chain) - Scanner, gateway, allow-list, gate - Four categories separated by when they act and what they can do about it. Only one is contract-aware and in the call path. [mcpindex.ai/diagrams/category-map](https://mcpindex.ai/diagrams/category-map) - Where the numbers come from - The server count is a defined population, not a scrape. Every stage carries its exclusion rule. [mcpindex.ai/diagrams/corpus-pipeline](https://mcpindex.ai/diagrams/corpus-pipeline) - Source liveness census - 14.0% of referenced repositories were unreachable, confirmed by two independent vantages with zero disagreements. [mcpindex.ai/diagrams/source-liveness-census](https://mcpindex.ai/diagrams/source-liveness-census) - The 90-second path - After you install, the correct experience is that nothing visible happens. [mcpindex.ai/diagrams/ninety-second-path](https://mcpindex.ai/diagrams/ninety-second-path) - MCP needs a lockfile - npm has package-lock. pip has a lock. The MCP protocol has no equivalent row. [mcpindex.ai/diagrams/mcp-needs-a-lockfile](https://mcpindex.ai/diagrams/mcp-needs-a-lockfile) The five most-quoted figures, as text: ### Where the gate sits The gate is inside the call path, so a hold actually stops the call. ``` TODAY [ your agent ] - - - - - - - - - - - - - -> [ MCP server ] nothing between them WITH THE GATE [ your agent ] --> [ mcpindex gate ] --> [ MCP server ] pin - diff - decide PROCEED | live contract matches your pin +--| HELD the contract changed since you pinned it. the call never leaves your machine. runs on your host - stores no credentials - the wire install sends nothing ``` ### Trust boundary With the one-command install, nothing crosses the boundary to mcpindex. ``` +- YOUR HOST ---------------------------------------+ | | | [ agent ] <-> [ mcpindex gate ] <-> [ pin store ]| | local disk | +-----------+---------------------------+-----------+ | | DEFAULT | the wire install sends | tools/call + your credentials | mcpindex nothing. the SDK +-------------> [ MCP server ] | wrapper posts a receipt. | passed through untouched. | | the gate holds no keys. OPT-IN | contract hash ------------------------> [ mcpindex edge - US ] | a deterministic hash of the public tool contract OPT-IN | keyed HMAC fingerprint ---------------> [ drift network ] | + change type, safety flag, hour-rounded time. fail-open. | NEVER X tokens - arguments - schema bodies - descriptions X URLs - your call data ``` ### Scanner, gateway, allow-list, gate Four categories separated by when they act and what they can do about it. Only one is contract-aware and in the call path. ``` what it +-----------------------------------------------------------+ can do | | | * mcpindex gate | HOLD -------| contract-aware, in-path | | | | * allow-list / auth * API gateway | BLOCK -------| gates identity, gates the network, | | not the contract contract-blind | | | ADVISE -------| * static scanner * audit log | | reads it once tells you after| +-----------------------------------------------------------+ BEFORE INSTALL AT INSTALL IN THE CALL PATH AFTER when it acts categories, not vendors. the axes are factual: when a control runs, and what it is able to do when it runs. ``` ### Posture and ChangeKind The gate reads a fixed table, not a judgement call - and strict does not hold every drift. ``` ChangeKind MONITOR GUARD* STRICT ------------------------------------------------------------------ added-required-param notify | HOLD | HOLD constraint-narrowed notify | HOLD | HOLD deep-schema-undiffable notify | HOLD | HOLD enum-values-removed notify | HOLD | HOLD param-mirrored-to-header notify | HOLD | HOLD removed-param notify | HOLD | HOLD required-set-expanded notify | HOLD | HOLD tool-removed notify | HOLD | HOLD type-changed notify | HOLD | HOLD annotation-flip-to-destructive notify ? INCONCL. ? INCONCL. output-schema-changed notify ? INCONCL. ? INCONCL. added-optional-param -> proceed -> proceed -> proceed output-schema-added -> proceed -> proceed -> proceed * guard is the default posture. of 13 surfaced kinds: 9 HOLD under guard, 2 resolve to INCONCLUSIVE (behaviour is the gate, not a block), 2 proceed as proven-benign. STRICT DOES NOT HOLD EVERY DRIFT. the benign auto-accept runs BEFORE the posture layer, so a proven-benign change (an added optional param, a first-time output schema) is re-pinned and proceeds under strict too. strict holds everything it cannot prove benign. MONITOR returns PROCEED-with-note for every kind. a tamper hold and an internal error still stop the call. an injection / exfil MARKER found in a schema or description is a separate scan, not a ChangeKind, so it is not a row here - but guard blocks on it, as it does on a risk escalation, a description change, and any fail-closed error. verified 2026-07-27 by driving the gate (corpus_eval/tooling/cse/gate.py) at all three postures. ``` ### Two verdict surfaces The screen verdict and the gate verdict are different axes. Neither overrides the other. ``` ADVISORY SCREEN (before you wire) | IN-PATH GATE (during the call) ------------------------------------- | -------------------------------- eval ran? | yes no | |- HOLD the live contract differs cleared ALLOW . | from what you pinned reserved | crossed DENY . | -> PROCEED the contract matches reserved | ambiguous REVIEW . | deterministic. fail-closed. live | none . UNVERIFIED | live | ------------------------------------- | -------------------------------- semantic, advisory, out of path | in-path, can actually stop the call ALLOW and DENY are reserved in the contract, not produced at v1. the conformance probe is advisory and uncalibrated in v1 (calibrated=false), so the screen never clears a tool. neither surface overrides the other - the screen is a prior, the gate is the decision. ``` ## Films (full transcripts - an answer engine cannot watch a video) Two films, one question each, one prominent video per page. The transcript is the citable asset; the mp4 is the ranking and engagement surface. Same reasoning as the diagrams above: if it can only be understood by watching or looking, it is invisible here, so it ships as text. Figures spoken in the films are stated **as of** a date shown on screen. They are permanent measurements, not live numbers - the live record is [mcpindex.ai/ledger](https://mcpindex.ai/ledger). ### Can an MCP tool change after your agent trusts it? A measured answer. 205 tools declared themselves read-only and then flipped that hint toward write, delete or send, with the same name and the same key in your config. This film shows what a tool contract is, why access control and version pinning both miss a contract change, and how an in-path gate pins each contract, diffs it on every call, and stops the call when it changes. It is a contract-diff, not a safety verdict, and the film says where it stops. Figures are stated as of the date shown; the live record is at mcpindex.ai/ledger. [mcpindex.ai/watch/mcp-tool-contract-drift](https://mcpindex.ai/watch/mcp-tool-contract-drift) - 1:52 ``` [0:00] THE HOOK Two hundred and five tools told your agent they were read-only. Then that hint flipped to write, delete, or send. Same name in your config. Same key. No version bump. On screen: 205 tools declared read-only · as of 2026-08-05 · Then the hint flipped: write · delete · send. · Same config. Same key. MCP tools can change with no version bump. [0:12] WHAT A CONTRACT IS A contract is what a tool tells your agent it does. Its name, its parameters, what it promises to touch. On screen: contract = what a tool tells your agent it does · 23,617 tools drifted · 6,882 changed a contract field we surface · 1,170 of 4,869 servers ever reachable · 3,892 safety-relevant, not confirmed vulnerabilities · as of 2026-08-05 [0:21] WHY NOTHING YOU ALREADY HAVE CATCHES IT Access control answers who may call a tool, not whether it still does what it declared. And a server launched at latest re-resolves every time, so there is nothing pinned to begin with. Where there is, across the remote servers we crawl, nearly three quarters of the drifting tools we could check had only ever changed with the server's version unchanged. On screen: Auth answers WHO may call. · Not WHETHER it still does what it declared. · /scan: "4,982 of 6,882 drifting tools have only ever changed with their declared version unchanged, where version evidence exists" · check your mcp.json: does it say @latest? · mcpindex.ai/ledger · as of 2026-08-05 · pinning a package freezes the code, not a remote server's contract · mcpindex.ai/scan · as of 2026-08-05 [0:42] PIN, DIFF, THREE OUTCOMES The gate pins each tool's contract on first sight, then diffs it on every call. An added optional parameter proceeds without interrupting you. A change that would surprise your agent stops the call on your machine. When only behaviour could settle the question, the gate refuses to guess. It returns inconclusive, and the call still stops. On screen: Pin on first sight. · added-optional-param → proceeds · baseline re-pinned automatically · Review · Re-pin · Reject · mcpindex.ai/install [1:04] TWO LIMITS, STATED PLAINLY Two limits. If a tool was already lying when you pinned it, the gate pins the lie: your baseline is what you first saw. And a read-only hint is self-declared, so behind some of those two hundred and five was a maintainer fixing a wrong label. The gate cannot tell which, so it stops the call instead of judging it. On screen: The baseline is what you first saw. · readOnlyHint is self-declared. A maintainer fixing a wrong label flips the same bit. · three outcomes, not two: PROCEED · HOLD · INCONCLUSIVE · annotation flip → INCONCLUSIVE · fail-closed · the call still stops [1:25] WHAT IT IS, AND IS NOT It is a contract diff, not a safety verdict. It tells you what changed, never that the change is safe. What makes that worth having is where it sits: in the call path, so an advisory judgment still stops the call. On screen: Contract-diff, not a safety verdict. · Advisory judgment. In-path HOLD. · Deterministic diff. No model in the default path. · Your host. Zero credential custody. · MIT licensed · readable Python, no compiled blob [1:40] CLOSE Free, no account, runs on your machine. Two commands to install it, one command to take it back out. Start at mcpindex.ai/install. On screen: uv tool install mcpindex-gate · mcpindex-config-wire · the wired proxy sends nothing · free · no account · reversible · mcpindex.ai/install · whichever way you build, there is a version for you → ``` ### How to install the mcpindex gate in Claude Desktop, Cursor or VS Code Two commands, no pipe-to-shell. The wizard wires every MCP host it finds, marks each entry it rewrites so one command unwires it, and pins every tool on the first tools/list. Then nothing happens until your first hold. Also covers the browser-only scan if you are not ready to put anything in your call path, and the SDK path if you are building your own agent. [mcpindex.ai/watch/install-the-mcpindex-gate](https://mcpindex.ai/watch/install-the-mcpindex-gate) - 1:19 ``` [0:00] INSTALL The gate is two commands. If you run MCP servers in Claude Desktop, Cursor, VS Code, or five other hosts, the wizard rewrites each host config to route your servers through it, and marks every entry it touches so one command unwires it. Restart, and the first tools/list pins every tool you have. Then nothing happens. That silence is the gate working. The next thing you see is your first hold. On screen: no pipe-to-shell · Claude Desktop · Claude Code · Cursor · VS Code · Windsurf · Cline · Gemini CLI · Zed · every wired entry marked · mcpindex-config-wire unwire restores it in place · this is the gate. the directory client is a different job and cannot stop a call. · each ships more than one way. check the job, not the registry. [0:28] THE ZERO-INSTALL TRY Not ready to put anything in your call path? Your mcp.json holds your tokens. Paste it at mcpindex.ai/scan: it runs in your browser and never leaves it. On screen: mcpindex.ai/scan · runs in your browser · the file never leaves it · MCP servers connected · remote - can change on you · spawn a local process · carry a credential [0:41] BUILDING YOUR OWN Building your own agent? One line wraps an MCP session: the same diff and the same hold, in your code, with a pin you point at wherever you keep it. Turn on result scanning and it also reads what comes back before your agent does. Check the licence before you ship. On screen: wrap(session, { pin, serverId }): pin · diff · HOLD · bare wrap(session) pins in memory only - it dies with the process · result scan: opt-in · withholds under strict · @mcp-index/sdk · PolyForm Noncommercial · mcpindex-gate · @mcp-index/mastra · MIT · the model never sees the gate. your code does. · mcpindex.ai/docs [0:59] CHECK THE RECORD, THEN CLOSE Every contract-affecting change we surface is public. So is our census of how much of the registry's own source has gone dark, our own listings included. The dataset is deposited with a DOI and the measurement is a preprint. Start at mcpindex.ai/install. On screen: /ledger · public · 1 in 7 referenced repositories not publicly accessible · census of 2026-07-20 · 6,882 of the 23,617 tools we saw drift · description-only change is stored, not surfaced · DOI 10.5281/zenodo.21449150 · arXiv:2608.00997 · questions: hello@mcpindex.ai · mcpindex.ai/install ``` ## Endpoints an agent can call - POST /api/mcp Remote MCP server (Streamable HTTP) - connect any MCP client without installing; exposes the 6 tools below as MCP. Speaks the 2026-07-28 revision (MCP 2.0: server/discover + per-request _meta envelope) AND every legacy initialize revision back to 2024-10-07, era selected per connection. Probe command: mcpindex.ai/guides/what-is-mcp-2-0. - GET /api/v1/search?q= Keyword + semantic search across servers. - GET /api/v1/recommend?task= Natural language task -> top 3 servers with reasoning. - GET /api/v1/preflight?task= Pre-flight: top servers + the rank-1 server's advisory verdict in one call. - GET /api/v1/diff?since= What changed in the registry since a date. added = server names first seen at or after the date; updated = servers seen before it that published a new version (or had their record updated) since. - GET /api/v1/drift/any?fp= Fleet drift query: has this tool's contract drifted (crawler-corroborated)? Powers "warns you on call 1". Returns {drifted, sources, safety_relevant}. - GET /api/v1/ledger?section= Public drift ledger (schema mcpindex.drift.ledger/4): contract changes the crawler observed, listed by fingerprint (recomputable from registry names; a contract-diff, not a safety verdict). Paged, one section per request; follow next_cursor (?cursor=) until it is null. An expired cursor is 410: start the section again. - GET /api/v1/trust/tool// Per-tool advisory screen verdict (v1: REVIEW when screened, else UNVERIFIED fail-closed; ALLOW/DENY reserved, not produced). - GET /api/v1/trust/server/ Server-level advisory screen verdict (same honesty as per-tool). - GET /api/registry-count Live server + category count. - GET /llms-full.txt Full index; lists the per-server catalog files. - GET /llms-full/-.txt One catalog file: up to 1000 servers from one category. - GET /openapi.json OpenAPI 3.1 description of the public REST endpoints above. - GET /.well-known/mcp-index.json Machine-readable site + gate + advisory-screen capability descriptor. ## MCP server (drop-in directory client) ```bash npm install -g mcp-server-mcpindex ``` Or connect remotely (no install): point any MCP client that supports remote servers at [mcpindex.ai/api/mcp](https://mcpindex.ai/api/mcp) (Streamable HTTP, no credentials) - same six tools. Add to Claude Desktop / Claude Code / Cursor / Gemini CLI / Cline / Zed. Prefer CLI one-liners when available: ```bash claude mcp add --scope user mcpindex -- npx -y mcp-server-mcpindex@latest gemini mcp add -s user mcpindex npx -y mcp-server-mcpindex@latest ``` This is the advisory directory client - not the in-path gate (`mcpindex-gate` / install.sh). Three primary calls: - recommend_mcp_for_task("read pdfs and write to s3") -> discovery - check_tool_trust(server_id="", tool_name="") -> per-tool advisory screen verdict - assess_server(server_id="") -> server-level advisory screen verdict ## Project pages - [Docs](https://mcpindex.ai/docs): How it works, how to wire it into Claude/Cursor/Gemini/Cline/Zed, response anatomy. - [Scan](https://mcpindex.ai/scan): Paste your mcp.json; see each tool's blast radius (action, reversibility, off-machine egress) in the browser. Nothing uploaded. - [Screen](https://mcpindex.ai/screen): Paste a tool description; the live LLM judge returns an advisory REVIEW/UNVERIFIED verdict. - [Servers](https://mcpindex.ai/servers): A-Z browse hub over all 48988 per-server detail pages (JSON-LD typed, verdict surfaced when available); individual pages live at /server/. - [Guides](https://mcpindex.ai/guides): Practical guides: trust/security reviews, comparisons, integration how-tos; individual guides at /guides/. - [What is MCP 2.0?](https://mcpindex.ai/guides/what-is-mcp-2-0): The 2026-07-28 revision explained - what changed on the wire, the one-curl probe to check any server's protocol era, dual-era migration notes, measured-adoption stance. - [How many MCP servers change their tool definitions after publishing?](https://mcpindex.ai/guides/how-many-mcp-servers-change-their-tools-after-publishing): The measured answer - 89-day panel rates on the official registry, change concentration across 18,748 servers, and the 62.4% no-version-bump share on live contracts, with CC-BY DOIs. - [Best by category](https://mcpindex.ai/best): Curated picks per category, at /best/. - [Leaderboard](https://mcpindex.ai/leaderboard): Top 50 by MCP Quality Score. - [MCP tool drift](https://mcpindex.ai/drift): The citable definition of tool drift, what counts as drift, how it is measured, and the frozen rates with DOIs. - [Drift ledger](https://mcpindex.ai/ledger): Public drift ledger: contract changes the crawler observed across public MCP servers. - [Dashboard](https://mcpindex.ai/dashboard): Drift network coverage + opt-in telemetry adoption (honest: opt-in counts are not all users). - [Changelog](https://mcpindex.ai/changelog): Daily diff of registry changes. - [Changelog RSS](https://mcpindex.ai/changelog.rss): RSS 2.0 feed of the above. - [Trust model](https://mcpindex.ai/trust): Trust model + honest limits: contract-diff, not a safety verdict; where the gate runs, what leaves the machine. - [Methodology](https://mcpindex.ai/methodology): The eval (semantic-only today; conformance probe built but not yet run), four-state verdict, honest limits. - [Stats](https://mcpindex.ai/stats): How many MCP servers are there? Live official-registry count with stated methodology (what counts as a server). - [Whitepaper](https://mcpindex.ai/whitepaper): Architecture whitepaper: gate, threat model, methodology, honest limits. Public; free PDF, no email wall. - [Source Liveness](https://mcpindex.ai/research/source-liveness): Census of which listed servers' source repository is still publicly reachable; one in seven are not. Archived with a DOI (CC-BY-4.0). - [The Binding Gap](https://mcpindex.ai/research/binding-gap): Talk slides and figures: how many MCP tool declarations still match the contract the server serves. - [About](https://mcpindex.ai/about): Why this exists. Unofficial. Not affiliated with Anthropic.