last deploy · 2026.09.15 · d808e30
The neutral trust-to-act layer for agent tool use. An agent is about to invoke a third-party MCP tool. mcpindex answers one question: is this safe to call right now, given what I can verify about it?
Served to IDEs, agent frameworks, and platform teams that need an independent signal. Structurally barred from being held by Anthropic (the protocol owner) or by a registry operator (the supply side): the trust check has to be third-party to be credible. This page is the working artifact - what is shipped today, what is monitored not enforced, and what is explicitly not yet claimed.
The MCP long tail is already past 19,000 servers in the official registry alone, before counting the other public directories (PulseMCP, Glama, MCP.so, Smithery). The volume problem is solved. The next problem is not discovery. It is whether an agent should actually invoke any given one of those servers when a user asks.
The honest answer today is: nobody knows. Manual review does not scale to 19,000 servers. Star counts are gameable and lag reality. A tool that worked yesterday can ship a backdoor today and the only place that records the change is the maintainer’s git history, which the maintainer controls. The IDE that calls the tool, the framework that orchestrates it, and the human in the loop have no neutral signal to consult.
That gap is the seat. It is structurally third-party (the protocol owner cannot hold it without breaking neutrality; the registry operator cannot hold it without breaking neutrality) and it does not collapse into the IDE because the IDE is the consumer, not the witness. The shape of the answer is a trust check that an agent can call inline, with cryptographic provenance for its own history.
Concrete, current, and honest about the maturity level. The architecture is in place; the calibration that promotes it from advisory to enforcing is the remaining work.
GET /api/v1/trust/tool/{server_id}/{tool_name}Every candidate tool runs through a deterministic conformance probe AND an LLM judge. Both legs execute and are recorded for every case. Conformance is monitored, not enforced: findings sit at MEDIUM severity, below the _fail_closed HIGH/CRITICAL floor. Verdicts today are advisory.
GET /api/v1/case/:id/proofOTS Bitcoin-anchored history with cadence bound = confirmation latency (~10 min for pending; ~1 hour at N=6 confirmations for Bitcoin-finalized); sub-window precision asserted, not proven. Each verdict is appended to a hash chain and anchored via OpenTimestamps; the chain is auditable end-to-end once a block confirms. The published verdict corpus itself now carries on-chain anchors, so a verdict cannot be silently rewritten after the fact.
agenticshelf · agentrapay · tandemReal third-party servers wired into the eval harness end-to-end, plus Wolfram Alpha as a seventh transport branch. Not local fixtures. The harness drives them, records the conversation, and emits a signed case file per invocation.
15 of 150 conforming labels15 of 150 candidate servers currently carry the conformance label. Graduation pending: the false-positive upper-95 bound must reach <=2% on a corpus of at least 150 before the label is anything more than a working signal.
npm install -g mcp-server-mcpindexAdd the trust check to Claude Desktop, Cursor, Cline, or Zed. The agent calls check_tool_trust(server_id, tool_name) before invoking a candidate. MIT license; the check is free in advisory mode.
https://mcpindex.ai/ledgerSafety-relevant contract changes across the reachable registry are recorded and published as they are observed. An agent using the gate is warned on call one, not after the incident writeup.
owner.mcpindex.aiServer owners verify control of their own listing without talking to me. Self-serve proof of control, rate-limited, no account needed.
mcpindex.ai/claimGitHub or Google sign-in mints a free API key in production. No sales call, no waitlist.
npm install -g mcp-server-mcpindex · pip install mcpindex-gatemcp-server-mcpindex 0.3.13, @mcp-index/sdk 0.9.2, and @mcp-index/mastra 0.1.5 on npm; mcpindex-gate 0.9.0 and mcpindex-preflight 0.7.1 on PyPI.
10.5281/zenodo.21449149 · 21501867 · 21709945 · 21778281Four CC-BY datasets measure the registry itself: safety-relevant contract-change incidents, a two-vantage source-liveness census that found 14.0% of server source repos no longer publicly accessible, the longitudinal observation panel behind the drift measurement, and a corpus measuring declared-effect coverage and contract binding.
The line between what works and what is promised matters more than the feature list. Three explicit non-claims:
A live call to the recommendation surface that sits on top of the trust check. Same shape an agent gets when it asks which servers fit a task and whether each is safe to invoke right now.
Matches read, pdf in title/description; category: docs.
$ npx -y @sylphx/pdf-reader-mcpMatches read, pdf in title/description; category: docs.
$ uvx pdf-insight-mcpMatches read, pdf in title/description; category: docs.
$ manual install — see detailThe Quality Score visible per row composites freshness, completeness, installability, documentation, and semver stability. It is a public methodology and a citation magnet by design; it is not the trust verdict. The trust verdict lives behind /api/v1/trust/tool/{server_id}/{tool_name} and is currently advisory.
Three actors could plausibly try to hold this layer. Each one breaks if they do. Naming the constraint up front is part of the analysis.
The protocol owner cannot also be the trust judge of tools written against the protocol. The conflict is the same one that keeps the App Store review out of the hands of the SDK team at scale: the party that benefits from ecosystem growth cannot also be the party that gates which entries are safe. Anthropic shipping a first-party agent-search endpoint does not collapse this seat; it just clarifies it.
PulseMCP, Glama, Smithery, MCP.so all carry inventory. The supply side cannot credibly grade its own supply. They can adopt agent-readable surfaces (and several already have), but the trust check sits one layer above the catalog and needs to come from somewhere with no listing fee, no preferred placement, and no supplier relationship.
The IDE is the consumer. It is the thing that wants to invoke the tool. A consumer attesting to its own input is not a trust check; it is a wish. The IDE will absolutely consume the verdict (Claude Desktop, Cursor, Cline, Zed are the natural callers), but the verdict has to originate outside the call site to mean anything.
The trust layer has two natural consumer shapes. Each gets a different concrete handle.
Cursor specifically. Biggest in-product agent-tool surface; consumer (not host) so the structural-neutrality argument lands cleanly; demonstrated willingness to pay for ecosystem infra.
30-minute call to share the integration shape and verdict-freshness contract. If interest, NDA and a 2-week deep-dive on the corpus and harness. Deal shape: acqui-hire of corpus+harness+author, verdict-feed license with freshness SLA, or strategic investment plus integration partnership. gautam@mcpindex.ai.
Smithery and PulseMCP (registries, license the verdict feed). Composio (backend orchestrator, drop-in pre-flight). Anthropic DevRel (corroboration only, structurally barred from being referee). Mastra, Cline, Zed, Continue as in-IDE consumers similar to Cursor.
Same 30-minute call scoped to your motion. The npm drop-in is the same primitive across all of these. gautam@mcpindex.ai.
Developers shipping an agent that calls third-party MCP servers and wants a neutral pre-flight.
npm install -g mcp-server-mcpindex (v0.3.13), then add it to your MCP client config. Source on GitHub (MIT). PRs against the methodology welcome; the score is meant to be public.
Pivoted 2026-05-15 from a directory-flip framing to the trust-to-act layer above. The current page reflects the post-pivot positioning. Updates on calibration progress and the path from advisory to enforcing will land here as they ship.