mcp-server-mcpindex 0.3.4 → 0.3.5

package/CHANGELOG.md

@@ -4,11 +4,17 @@ All notable changes to `mcp-server-mcpindex` are recorded here.
 
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.5] - 2026-07-12
+
+### Changed
+
+- **Honesty copy for the advisory screen vs in-path gate.** `check_tool_trust` tool description now states v1 produces REVIEW/UNVERIFIED only (ALLOW/DENY reserved) and that this package is the directory client — not `mcpindex-gate`. Package description and README integration example match: REVIEW/UNVERIFIED first; ALLOW/DENY kept as reserved contract branches.
+
 ## [0.3.3] - 2026-06-08
 
 ### Changed
 
-- **Recommended install now rides `@latest`.** The docs wire `npx -y mcp-server-mcpindex@latest` so the host fetches the newest discovery server on each restart — no manual upgrade step. This server is the *advisory* recommender (`recommend_mcp_for_task` / `check_tool_trust` / `assess_server`), **not** the in-path drift gate, so it carries no version pin (the gate, `mcpindex-preflight`, stays pinned + notify-only on purpose). The startup update notice already prints the exact `npm i -g …@latest` command for anyone who pins.
+- **Recommended install now rides `@latest`.** The docs wire `npx -y mcp-server-mcpindex@latest` so the host fetches the newest discovery server on each restart — no manual upgrade step. This server is the *advisory* recommender (`recommend_mcp_for_task` / `check_tool_trust` / `assess_server`), **not** the in-path drift gate, so it carries no version pin (the gate, `mcpindex-gate`, stays pinned + notify-only on purpose). The startup update notice already prints the exact `npm i -g …@latest` command for anyone who pins.
 
 ## [0.3.2] - 2026-06-08
 

package/README.md

@@ -83,9 +83,9 @@ npx -y mcp-server-mcpindex@latest
 | `check_tool_trust` | Pre-invocation advisory verdict for a specific tool on a server. Fail-CLOSED: returns UNVERIFIED when no verdict on file. |
 | `assess_server` | Aggregated pre-flight verdict across all tools on a server. Same shape as `check_tool_trust`. |
 
-## Agent-framework integration: pre-invocation trust gate
+## Agent-framework integration: advisory pre-invocation screen
 
-`check_tool_trust` is the integration surface that lets agent frameworks (Composio, Mastra, LangChain, DSPy, raw LLM-tool-call loops) ask "is this tool safe to invoke right now?" before dispatching the call.
+`check_tool_trust` is the **directory client** integration surface (not the in-path `mcpindex-gate`). It lets agent frameworks (Composio, Mastra, LangChain, DSPy, raw LLM-tool-call loops) ask for an advisory screen verdict before dispatching a call. At v1 you will see REVIEW or UNVERIFIED — not a safety clearance.
 
 ### Verdict contract (v1)
 
@@ -146,16 +146,9 @@ async function gateToolCall({ serverId, toolName, invoke, askHuman }) {
   audit.log({ verdict, caveats: verdict.honest_limits });
 
   switch (verdict.directive) {
-    case 'ALLOW':
-      return invoke();
-
-    case 'DENY':
-      throw new Error(
-        `mcpindex denied ${serverId}/${toolName}: ${JSON.stringify(verdict.dimensions)}`,
-      );
-
     case 'REVIEW':
       // Fail-CLOSED to human. Do NOT auto-execute on REVIEW.
+      // At v1 this is the common screened outcome (semantic-only).
       return askHuman({ verdict, action: `${serverId}/${toolName}` });
 
     case 'UNVERIFIED':
@@ -167,6 +160,17 @@ async function gateToolCall({ serverId, toolName, invoke, askHuman }) {
         note: 'No trust verdict on file. Human review required before first use.',
       });
 
+    case 'ALLOW':
+      // Reserved in the contract — not produced by the v1 public screen.
+      // Keep the branch for future conformance-earned ALLOW; do not expect it today.
+      return invoke();
+
+    case 'DENY':
+      // Reserved in the contract — not produced by the v1 public screen.
+      throw new Error(
+        `mcpindex denied ${serverId}/${toolName}: ${JSON.stringify(verdict.dimensions)}`,
+      );
+
     default:
       // Unknown directive. Fail-CLOSED.
       return askHuman({ verdict, action: `${serverId}/${toolName}` });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mcp-server-mcpindex",
-  "version": "0.3.4",
-  "description": "An MCP server for finding MCP servers, plus advisory trust verdicts (check_tool_trust, assess_server) for agent frameworks. Drop-in for Claude Desktop, Claude Code, Cursor, Gemini CLI, Cline, Zed.",
+  "version": "0.3.5",
+  "description": "An MCP server for finding MCP servers, plus advisory screen verdicts (check_tool_trust, assess_server). Directory client — not the in-path gate (mcpindex-gate). Drop-in for Claude Desktop, Claude Code, Cursor, Gemini CLI, Cline, Zed.",
   "keywords": [
     "mcp",
     "model-context-protocol",

package/src/index.mjs

@@ -106,7 +106,7 @@ const TOOLS = [
   {
     name: 'check_tool_trust',
     description:
-      'Pre-invocation trust check for a specific tool on an MCP server. Returns an advisory verdict object (directive ALLOW | DENY | REVIEW | UNVERIFIED, dimensions, freshness). v1 advisory; conformance monitored not enforced; verdicts may be UNVERIFIED if not yet probed. Agents SHOULD treat UNVERIFIED as "human review required", never as ALLOW.',
+      'Pre-invocation advisory screen for a specific tool on an MCP server. Returns an advisory verdict object (directive ALLOW | DENY | REVIEW | UNVERIFIED, dimensions, freshness). At v1 the public screen produces REVIEW or UNVERIFIED only — ALLOW/DENY are reserved. Not the in-path gate (mcpindex-gate). Agents SHOULD treat UNVERIFIED as "human review required", never as ALLOW.',
     inputSchema: {
       type: 'object',
       properties: {