一个用于查找 MCP 服务器的 MCP 服务器，并提供咨询性信任判定，供智能体框架在调用工具前查询——来自 mcpindex.ai。
一个即插即用的 MCP 服务器，让你的智能体能够在智能体循环内部发现、比较、安装和预检其他 MCP 服务器。由 mcpindex.ai 提供支持——这是官方注册表的智能体原生 MCP 服务器索引（实时数量见 mcpindex.ai/stats），每日进行筛查和漂移监控。
在线站点 · npx mcp-server-mcpindex · 远程 MCP · 安装门控 · 文档 · 信任
npm install -g mcp-server-mcpindex这是目录/咨询客户端（推荐、搜索、信任）。它不安装路径内漂移门控——那是 curl -fsSL https://mcpindex.ai/install.sh | sh。
需要 Node 20+。在 stdio 上同时支持两个协议时代：2026-07-28 修订版（server/discover，按请求的 _meta 信封）以及每个当前客户端都使用的 initialize 握手（2025-11-25 至 2024-10-07），按连接自动选择。
不想安装任何东西？mcpindex 也是一个托管的远程 MCP 服务器。将任何支持远程 MCP 的客户端（Claude connectors、Cursor 等）指向：
https://mcpindex.ai/api/mcpStreamable HTTP，无需凭据。与 npm 包相同的六个工具。
claude mcp add --scope user mcpindex -- npx -y mcp-server-mcpindex@latestgemini mcp add -s user mcpindex npx -y mcp-server-mcpindex@latestRelated MCP server: filesystem-mcp
添加到 ~/Library/Application Support/Claude/claude_desktop_config.json：
{
"mcpServers": {
"mcpindex": {
"command": "npx",
"args": ["-y", "mcp-server-mcpindex@latest"]
}
}
}
@latest让你保持最新：这是咨询性发现服务器（不是路径内漂移 门控），因此不携带版本锁定——npx会在你下次重启主机时获取最新版本，无需手动升级步骤。
重启 Claude Desktop。然后询问：
"帮我找一个能读取 PDF 并将内容写入 S3 的 MCP 服务器。"
Claude 会调用 recommend_mcp_for_task 并返回排名前 3 的服务器及安装命令。
添加到 .cursor/mcp.json：
{
"mcpServers": {
"mcpindex": {
"command": "npx",
"args": ["-y", "mcp-server-mcpindex@latest"]
}
}
}添加到你的 Cline 设置中：
npx -y mcp-server-mcpindex@latest工具 | 功能 |
| 传入自然语言任务。返回排名前 3 的服务器，附带推理、安装命令和质量评分。 |
| 在整个注册表中进行关键词 + 语义搜索。可选类别筛选。 |
| 获取服务器 + 客户端（Claude Desktop、Claude Code、Cursor、Gemini CLI、Cline、Zed）的精确安装 JSON/CLI。 |
| 2-5 个服务器的并排比较——质量评分、安装路径、环境变量。 |
| 针对服务器上特定工具的调用前咨询性判定。失败-关闭：当没有存档判定时返回 UNVERIFIED。 |
| 针对服务器上所有工具的聚合预检判定。与 |
check_tool_trust 是目录客户端集成面（不是路径内 mcpindex-gate）。它让智能体框架（Composio、Mastra、LangChain、DSPy、原始 LLM 工具调用循环）在派发调用前请求咨询性筛查判定。在 v1 中你会看到 REVIEW 或 UNVERIFIED——而不是安全许可。
使用 Mastra？ 姊妹包
@mcp-index/mastra将此筛查作为现成的beforeToolCall钩子提供——npm i @mcp-index/mastra，无需任何接线。
{
"directive": "ALLOW" | "DENY" | "REVIEW" | "UNVERIFIED",
"status": "EVALUATED" | "PARTIAL" | "STALE" | "ERROR",
"granularity": "description-level" | null, // scope of a PARTIAL screen
"dimensions": [
{ "id": "tool_safety", "verdict": "PASS", "severity": "INFO" }
],
"expires_at": "2026-06-30T00:00:00Z",
"honest_limits": [
"conformance_monitored_not_enforced",
"calibrated_false_v1",
"advisory_deployment"
],
"verdict_contract_version": "1.0.0",
"server_id": "github",
"tool_name": "create_pull_request",
"source_url": "https://mcpindex.ai/api/v1/trust/tool/github/create_pull_request",
"fetched_at": "2026-05-28T18:42:11.118Z"
}免费层判定附带指令 + 维度 + 新鲜度。证据引用、LLM 推理和链历史是付费层表面，此处有意省略。
每个 v1 判定都附带以下三个注意事项，你的门控应该在每次派发决策时展示它们：
conformance_monitored_not_enforced - 发布者自行声明；mcpindex 监控漂移但不在网络层阻止。
calibrated_false_v1 - 维度严重性尚未针对真实世界事件数据进行校准。
advisory_deployment - 判定是咨询性的；智能体（或审查智能体的人类）才是决策者。
历史锚定：OTS 比特币锚定历史；在 N=6 次确认（约 1 小时）时比特币最终确定；约 10 分钟内待定。子窗口精度为断言而非证明。
import { Client } from '@modelcontextprotocol/sdk/client/index.js';
import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
const mcpindex = new Client({ name: 'gate', version: '1.0.0' }, { capabilities: {} });
await mcpindex.connect(new StdioClientTransport({
command: 'npx', args: ['-y', 'mcp-server-mcpindex@latest'],
}));
// gateToolCall wraps any agent tool dispatch. Plug it in front of
// the LangChain / DSPy / Mastra / Composio tool-call hook.
async function gateToolCall({ serverId, toolName, invoke, askHuman }) {
const res = await mcpindex.callTool({
name: 'check_tool_trust',
arguments: { server_id: serverId, tool_name: toolName },
});
const verdict = JSON.parse(res.content[0].text);
// Pin the v1 caveats in the audit log no matter what.
audit.log({ verdict, caveats: verdict.honest_limits });
switch (verdict.directive) {
case 'REVIEW':
// Fail-CLOSED to human. Do NOT auto-execute on REVIEW.
// At v1 this is the common screened outcome (semantic-only).
return askHuman({ verdict, action: `${serverId}/${toolName}` });
case 'UNVERIFIED':
// No verdict on file (or upstream unreachable). Fail-CLOSED.
// Recommend human review. Do NOT fail-open to invoke().
return askHuman({
verdict,
action: `${serverId}/${toolName}`,
note: 'No trust verdict on file. Human review required before first use.',
});
case 'ALLOW':
// Reserved in the contract — not produced by the v1 public screen.
// Keep the branch for future conformance-earned ALLOW; do not expect it today.
return invoke();
case 'DENY':
// Reserved in the contract — not produced by the v1 public screen.
throw new Error(
`mcpindex denied ${serverId}/${toolName}: ${JSON.stringify(verdict.dimensions)}`,
);
default:
// Unknown directive. Fail-CLOSED.
return askHuman({ verdict, action: `${serverId}/${toolName}` });
}
}如果判定端点不可达、返回 404、超时、返回格式错误的 JSON，或该服务器尚无存档判定，check_tool_trust 返回 directive: "UNVERIFIED" + status: "ERROR"。它绝不会静默强制转换为 ALLOW。你的门控代码应该将 UNVERIFIED 视为"需要人工审查"，而不是"看起来没问题，放行吧"。
status 是关于筛查完整性的遥测，与 directive 信任决策不同：EVALUATED（完整筛查）、PARTIAL（仅部分表面，例如描述级别——见 granularity）、STALE（判定已超过新鲜度窗口）、ERROR（不可达 / 无存档判定）。PARTIAL 筛查绝不会报告为 EVALUATED。
这已经过测试。见 test/trust.test.mjs。
信任客户端也作为纯 ES 模块导出：
import { checkToolTrust, assessServer } from 'mcp-server-mcpindex/src/trust.mjs';
const verdict = await checkToolTrust({
serverId: 'github',
toolName: 'create_pull_request',
});
if (verdict.directive !== 'ALLOW') {
// Hand to a human, log, or block.
}默认情况下，调用发送到 https://mcpindex.ai。如果你自托管，可用 MCPINDEX_API_BASE=... 覆盖。
免费层限速为 60 次请求/分钟/IP。付费密钥即将推出，用于更高吞吐量和完整证据判定（证据引用、LLM 推理、链历史）。
将 mcpindex 引入智能体的三种方式，适用于不同表面：
包 | 安装 | 功能 |
|
| 目录 + 咨询筛查作为 MCP 服务器：按任务查找服务器，并在调用前使用 |
|
| 相同的咨询筛查，作为 |
|
| 路径内漂移门控： |
咨询筛查 vs 漂移门控： 本包和 @mcp-index/mastra 向 mcpindex 询问"这个工具是否经过审查？"（网络判定）。@mcp-index/sdk 在本地提出一个不同的问题："这个工具的契约自锁定以来是否发生了变化？"两者互补，互不依赖。
MIT。
网站：mcpindex.ai
筛查服务器：mcpindex.ai/screen
非官方。与 Anthropic 无关联。
Aggregated pre-flight trust assessment across all tools on an MCP server. Same verdict shape as check_tool_trust. Use for "is THIS server worth integrating?" decisions. v1 advisory; conformance monitored not enforced; verdicts may be UNVERIFIED if not yet probed.
| Name | Required | Description | Default |
|---|---|---|---|
| server_id | Yes | Server slug to assess. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description discloses behavioral traits: advisory nature, conformance monitoring not enforced, and potential UNVERIFIED verdicts. This adds valuable context beyond a simple read operation, though no side effects or auth needs are mentioned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three concise sentences without redundancy: purpose, use, and behavioral notes. Front-loaded with the core action, efficient and clear.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers purpose, usage guidance, verdict shape, and advisory nature. For a simple one-parameter tool with no output schema, it provides sufficient context, though explicit mention of return format would be slightly better.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter 'server_id' is described in the schema as 'Server slug to assess.' The description does not add new meaning beyond usage context. With 100% schema coverage, a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool performs an aggregated pre-flight trust assessment across all tools on a server, using the specific verb 'assess' and resource 'server'. It distinguishes from sibling 'check_tool_trust' by noting aggregation, and clarifies the verdict shape is identical.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states the use case: 'is THIS server worth integrating?' decisions. It also provides context on when to be cautious with 'v1 advisory; conformance monitored not enforced; verdicts may be UNVERIFIED if not yet probed', guiding appropriate reliance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Pre-invocation advisory screen for a specific tool on an MCP server. Returns an advisory verdict object (directive ALLOW | DENY | REVIEW | UNVERIFIED, dimensions, freshness). At v1 the public screen produces REVIEW or UNVERIFIED only — ALLOW/DENY are reserved. Not the in-path gate (mcpindex-gate). Agents SHOULD treat UNVERIFIED as "human review required", never as ALLOW.
| Name | Required | Description | Default |
|---|---|---|---|
| server_id | Yes | Server slug (e.g. "github", "filesystem"). Same id used by search_mcp_servers. | |
| tool_name | Yes | Tool name as exposed by the server (e.g. "create_pull_request"). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It accurately describes behavior: returns advisory verdict with specific fields, v1 only produces REVIEW or UNVERIFIED. Does not mention side effects, but none expected. Could add authentication requirements, but sufficient for a read-only check.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, no fluff. Front-loads purpose, then constraints, then usage guideline. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter tool with no output schema, the description covers purpose, return value, version limitations, and usage advice. No gaps for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (both parameters described in schema). Description adds no extra meaning beyond what schema provides. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: a pre-invocation advisory screen for a specific tool. It uses specific verb 'check' and resource 'tool trust', and distinguishes from siblings like assess_server and search_mcp_servers by focusing on a single tool's trust level.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use (pre-invocation advisory) and when not (not the in-path gate). Provides clear directive: treat UNVERIFIED as human review required. Distinguishes from sibling tools effectively.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Side-by-side comparison of 2-5 MCP servers - quality scores, install paths, transport types, env vars.
| Name | Required | Description | Default |
|---|---|---|---|
| slugs | Yes | Server slugs to compare. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses the output content (quality scores, install paths, etc.) but does not mention any side effects, auth requirements, or that it is a read-only operation. It assumes a non-destructive nature, but this is not explicit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence encapsulates the core functionality without any wasted words. It is front-loaded with the key action 'Side-by-side comparison' and details the compared attributes.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple one-parameter tool with no output schema, the description is relatively complete by listing the compared attributes. However, it does not mention output format, ordering, or whether results are aggregated, which would enhance completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single parameter 'slugs', with min/max items already defined. The description does not add semantic detail beyond what the schema provides, so it meets the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool compares 2-5 MCP servers side-by-side, listing specific attributes (quality scores, install paths, etc.). This distinguishes it from siblings like assess_server (single server) and recommend_mcp_for_task (recommendation).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use for comparing multiple servers but does not explicitly state when to use it versus alternatives or any prerequisites. It could benefit from guidance on when to choose compare_servers over assess_server or search_mcp_servers.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get the exact install command for a given MCP server and client. Returns a JSON block ready to paste into the client config.
| Name | Required | Description | Default |
|---|---|---|---|
| client | Yes | Target client. | |
| server_slug | Yes | Slug of the server (from search_mcp_servers or recommend_mcp_for_task results). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description discloses the tool returns a JSON command ready to paste. It does not mention any side effects or authentication, but for a retrieval tool this is sufficiently transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no wasted words, perfectly front-loaded with the action and output.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with two well-described parameters and no output schema, the description is complete: it explains what it does and what it returns.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and both parameters have descriptions. The description adds marginal value beyond the schema, so baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves the install command for a given server and client, and specifies the output format (JSON block). This distinguishes it from sibling tools like search or recommend.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the description, but there is no explicit guidance on when to use this tool versus alternatives, nor conditions to avoid usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recommend the best MCP servers for a natural-language task. Returns top 3 ranked picks with reasoning, install commands, and quality scores. Use this when the user asks for the right MCP server for a task they want to do.
| Name | Required | Description | Default |
|---|---|---|---|
| task | Yes | Natural-language description of the task, e.g. "read PDFs and write to S3" or "search GitHub and open a PR". |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the output structure: 'Returns top 3 ranked picks with reasoning, install commands, and quality scores.' This is sufficient for a read-only recommendation tool. It could mention ranking criteria or data sources for greater transparency, but the current description is clear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences: the first states purpose and output, the second gives usage guidance. It is front-loaded with key information and contains no superfluous words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, no output schema), the description adequately covers what the tool does and returns. It mentions the top 3 picks, reasoning, install commands, and quality scores. It could be enhanced by referencing sibling tools for alternative uses, but it is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage with a description for the 'task' parameter. The tool description does not add additional examples or constraints beyond the schema's example. Thus, per the baseline, a score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Recommend the best MCP servers for a natural-language task.' It specifies the verb (recommend), resource (MCP servers), and context (natural-language task). This distinguishes it from sibling tools like search_mcp_servers (which lists servers) and assess_server (which evaluates a single server).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says when to use the tool: 'Use this when the user asks for the right MCP server for a task they want to do.' It lacks explicit when-not-to-use or alternatives, but the context is clear enough for most agents.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Keyword + semantic search across the full MCP server registry. Use when the user knows what tool category they want but not which server.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max results (default 10, max 50). | |
| query | Yes | Search query. | |
| category | No | Optional category filter (e.g. database, browser, github, productivity). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description bears full responsibility for behavioral disclosure. It only states the search capability, missing details on read-only nature, authentication, rate limits, or any side effects. Minimal transparency beyond basic function.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the action and purpose. Every word adds value. No redundancy or unnecessary details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple search tool with 3 parameters and no output schema, the description is adequate but has gaps. It does not explain result format, pagination, or search behavior beyond 'keyword + semantic'. Could be more complete given lack of annotations and output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description does not add meaning beyond the schema; it mentions keyword + semantic search but that is already implicit. No additional parameter guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool performs keyword + semantic search across the MCP server registry, with a specific use case ('when the user knows what tool category they want but not which server'). This distinguishes it from sibling tools like assess_server or get_install_command.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit context for when to use the tool, but does not mention when not to use it or list alternatives. The guidance is clear and useful, but lacks exclusion criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.3.7assess_servercheck_tool_trustcompare_serversget_install_commandrecommend_mcp_for_tasksearch_mcp_serversScored across 6 tools
Each tool targets a clearly distinct purpose: search, recommend, compare, install, and two levels of trust assessment (server-level and tool-level). Even the trust tools are well-differentiated by scope.
All tool names follow a consistent verb_noun pattern using snake_case: assess_server, check_tool_trust, compare_servers, get_install_command, recommend_mcp_for_task, search_mcp_servers.
With 6 tools covering search, recommendation, comparison, installation, and trust, the number is well-scoped for a server registry/helper. No tools feel redundant or unnecessary.
The set covers the core workflow of finding, evaluating, and installing MCP servers. A minor gap is the lack of a tool to retrieve full metadata for a single server (e.g., description, version), but search and comparison partially fill that need.
Search and install 4,000+ security-scanned MCP servers from inside any MCP-aware AI client.
Search and get install details on MCP servers, right from your agent -- a unified marketplace index.
Search, vet & assemble MCP servers from your agent: verified tools, risk labels, and trust scores.
Capability registry for the agentic economy. Semantic search over verified MCP server listings.
