mcp-server-mcpindex 0.3.8 → 0.3.10

package/CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to `mcp-server-mcpindex` are recorded here.
 
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.10] - 2026-07-18
+
+### Fixed
+
+- **`get_install_command` no longer advertises or mislabels a `zed` client.** `zed` was in the client enum but the install builder never produced a zed config, so a zed request silently returned a different client's config under a `zed` header. Removed `zed` from the enum, and `formatInstall` now labels any fallback honestly (never presents one client's config under another client's name).
+- **`check_tool_trust` schema example uses a real registry slug.** The `server_id` example was `"github"`, a short name that never resolves (always ERROR/UNVERIFIED); it now shows a real long-form slug (e.g. `io-github-microsoft-playwright-mcp`) and states it is not a short name.
+- **`compare_servers` description no longer promises "transport types"** that the output table never contained.
+
+## [0.3.9] - 2026-07-15
+
+### Changed
+
+- **Tool descriptions now have a single source of truth (`src/tools-meta.json`).** The stdio CLI (`src/index.mjs`) and the hosted remote endpoint both import the shared name/title/description for the 6 tools, so their copy can no longer drift. Description text is byte-identical to 0.3.8; this is an internal refactor with no change to the advertised tool copy. Bumped so the refactored source is releasable to npm.
+
 ## [0.3.8] - 2026-07-15
 
 ### Fixed

package/README.md

@@ -12,6 +12,16 @@ npm install -g mcp-server-mcpindex
 
 This is the **directory / advisory** client (recommend, search, trust). It does **not** install the in-path drift gate — that is `curl -fsSL https://mcpindex.ai/install.sh | sh`.
 
+### Or connect remotely (no install)
+
+Prefer not to install anything? mcpindex is also a **hosted remote MCP server**. Point any client that supports remote MCP (Claude connectors, Cursor, etc.) at:
+
+```
+https://mcpindex.ai/api/mcp
+```
+
+Streamable HTTP, no credentials. Same six tools as the npm package.
+
 ### Claude Code
 
 ```bash
@@ -87,6 +97,8 @@ npx -y mcp-server-mcpindex@latest
 
 `check_tool_trust` is the **directory client** integration surface (not the in-path `mcpindex-gate`). It lets agent frameworks (Composio, Mastra, LangChain, DSPy, raw LLM-tool-call loops) ask for an advisory screen verdict before dispatching a call. At v1 you will see REVIEW or UNVERIFIED — not a safety clearance.
 
+> **Using Mastra?** The sibling package `@mcp-index/mastra` ships this exact screen as a ready-made `beforeToolCall` hook - `npm i @mcp-index/mastra`, no wiring required.
+
 ### Verdict contract (v1)
 
 ```jsonc
@@ -207,6 +219,18 @@ By default, calls go to `https://mcpindex.ai`. Override with `MCPINDEX_API_BASE=
 
 The free tier is rate-limited to 60 req/min/IP. Paid keys are coming for higher throughput and the full evidence-bearing verdict (evidence quotes, LLM rationale, chain history).
 
+## Related packages
+
+Three ways to bring mcpindex into an agent, for different surfaces:
+
+| Package | Install | What it does |
+| --- | --- | --- |
+| **`mcp-server-mcpindex`** *(this package)* | `npm i -g mcp-server-mcpindex` | Directory + advisory screen as an MCP server: find servers by task, and `check_tool_trust` before a call. |
+| **`@mcp-index/mastra`** | `npm i @mcp-index/mastra` | The same advisory screen wired into Mastra as a `beforeToolCall` hook (warn / enforce). |
+| **`@mcp-index/sdk`** | `npm i @mcp-index/sdk` | In-path drift gate: `wrap()` an MCP session and HOLD a call when a tool's contract drifts from your pin. |
+
+**Advisory screen vs drift gate:** this package and `@mcp-index/mastra` ask mcpindex "has this tool been vetted?" (a network verdict). `@mcp-index/sdk` asks a different question locally: "did this tool's contract change since I pinned it?" Complementary, and none depends on another.
+
 ## License
 
 MIT.

package/manifest.json

@@ -2,11 +2,11 @@
   "manifest_version": "0.2",
   "name": "mcp-server-mcpindex",
   "display_name": "mcpindex",
-  "version": "0.3.8",
+  "version": "0.3.10",
   "description": "The MCP directory that vets servers, not just lists them: search by task, then get an advisory screen on a server before an agent calls its tools. Advisory, conformance monitored not enforced, not a safety verdict.",
   "long_description": "mcpindex is the MCP directory that vets servers, not just lists them. Search by task to find the right server (ranked picks with install commands and quality scores), then get an advisory screen on a specific tool or a whole server before your agent calls it: whether each tool does what it claims. check_tool_trust and assess_server return an advisory verdict (REVIEW / UNVERIFIED at v1), backed by conformance monitoring and a live drift ledger, and fail closed to human review. Zero-config: queries the public mcpindex.ai API, no credentials. Monitored, not enforced; not a safety verdict and not an in-path gate.",
   "author": {
-    "name": "Bhartis LLC",
+    "name": "mcpindex.ai",
     "email": "hello@mcpindex.ai",
     "url": "https://mcpindex.ai"
   },

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "mcp-server-mcpindex",
-  "version": "0.3.8",
+  "version": "0.3.10",
   "mcpName": "io.github.gautamgb/mcp-server-mcpindex",
-  "description": "The MCP directory that vets servers, not just lists them. Search by task, then get an advisory screen on a server before your agent calls its tools: whether each tool does what it claims, backed by conformance monitoring and a public drift ledger. Advisory (REVIEW / UNVERIFIED), monitored not enforced, not a safety verdict. Drop-in for Claude Desktop, Claude Code, Cursor, Gemini CLI, Cline, Zed.",
+  "description": "The MCP directory that vets servers, not just lists them. Search by task, then get an advisory screen on a server before your agent calls its tools: whether each tool does what it claims, backed by conformance monitoring and a public drift ledger. Advisory (REVIEW / UNVERIFIED), monitored not enforced, not a safety verdict. Drop-in for Claude Desktop, Claude Code, Cursor, Gemini CLI, Cline.",
   "keywords": [
     "mcp",
     "model-context-protocol",
@@ -24,7 +24,7 @@
   "bugs": {
     "url": "https://github.com/mcpindex-ai/mcpindex-web/issues"
   },
-  "author": "Bhartis LLC <hello@mcpindex.ai>",
+  "author": "mcpindex.ai <hello@mcpindex.ai>",
   "license": "MIT",
   "type": "module",
   "main": "src/index.mjs",

package/src/index.mjs

@@ -19,6 +19,10 @@ const API_BASE = process.env.MCPINDEX_API_BASE || 'https://mcpindex.ai';
 // Single source of truth for the running version - read from package.json so the
 // User-Agent and the update-check can never drift from what npm actually shipped.
 const PKG_VERSION = createRequire(import.meta.url)('../package.json').version;
+// Single source of truth for tool name/description, shared with the hosted
+// remote endpoint (mcpindex-web/app/api/[transport]/route.ts) so copy can't drift.
+const TOOL_META = createRequire(import.meta.url)('./tools-meta.json');
+const TOOL_DESC = Object.fromEntries(TOOL_META.map((m) => [m.name, m.description]));
 
 const server = new Server(
   { name: 'mcp-server-mcpindex', version: PKG_VERSION },
@@ -32,7 +36,7 @@ const TOOLS = [
   {
     name: 'recommend_mcp_for_task',
     description:
-      'Recommend the best MCP servers for a natural-language task. Returns top 3 ranked picks with reasoning, install commands, and quality scores. Use this when the user asks for the right MCP server for a task they want to do.',
+      TOOL_DESC.recommend_mcp_for_task,
     inputSchema: {
       type: 'object',
       properties: {
@@ -48,7 +52,7 @@ const TOOLS = [
   {
     name: 'search_mcp_servers',
     description:
-      'Keyword + semantic search across the full MCP server registry. Use when the user knows what tool category they want but not which server.',
+      TOOL_DESC.search_mcp_servers,
     inputSchema: {
       type: 'object',
       properties: {
@@ -70,7 +74,7 @@ const TOOLS = [
   {
     name: 'get_install_command',
     description:
-      'Get the exact install command for a given MCP server and client. Returns a JSON block ready to paste into the client config.',
+      TOOL_DESC.get_install_command,
     inputSchema: {
       type: 'object',
       properties: {
@@ -81,7 +85,11 @@ const TOOLS = [
         },
         client: {
           type: 'string',
-          enum: ['claude-desktop', 'claude-code', 'cursor', 'gemini-cli', 'cline', 'zed'],
+          // Only clients the API actually generates a config for. 'zed' was advertised
+          // but never produced (buildInstalls has no zed branch), so a zed request silently
+          // fell back to another client's config; dropped until a real zed generator exists.
+          // formatInstall also labels any fallback honestly as defense-in-depth.
+          enum: ['claude-desktop', 'claude-code', 'cursor', 'gemini-cli', 'cline'],
           description: 'Target client.',
         },
       },
@@ -91,7 +99,7 @@ const TOOLS = [
   {
     name: 'compare_servers',
     description:
-      'Side-by-side comparison of 2-5 MCP servers - quality scores, install paths, transport types, env vars.',
+      TOOL_DESC.compare_servers,
     inputSchema: {
       type: 'object',
       properties: {
@@ -109,13 +117,14 @@ const TOOLS = [
   {
     name: 'check_tool_trust',
     description:
-      'Pre-invocation advisory screen for a specific tool on an MCP server. Returns an advisory verdict object (directive ALLOW | DENY | REVIEW | UNVERIFIED, dimensions, freshness). At v1 the public screen produces REVIEW or UNVERIFIED only - ALLOW/DENY are reserved. Not the in-path gate (mcpindex-gate). Agents SHOULD treat UNVERIFIED as "human review required", never as ALLOW.',
+      TOOL_DESC.check_tool_trust,
     inputSchema: {
       type: 'object',
       properties: {
         server_id: {
           type: 'string',
-          description: 'Server slug (e.g. "github", "filesystem"). Same id used by search_mcp_servers.',
+          description:
+            'Registry slug from search_mcp_servers / recommend results, e.g. "io-github-microsoft-playwright-mcp" (NOT a short name like "github").',
         },
         tool_name: {
           type: 'string',
@@ -128,7 +137,7 @@ const TOOLS = [
   {
     name: 'assess_server',
     description:
-      'Aggregated pre-flight trust assessment across all tools on an MCP server. Same verdict shape as check_tool_trust. Use for "is THIS server worth integrating?" decisions. v1 advisory; conformance monitored not enforced; verdicts may be UNVERIFIED if not yet probed.',
+      TOOL_DESC.assess_server,
     inputSchema: {
       type: 'object',
       properties: {
@@ -262,15 +271,24 @@ function formatSearch(data) {
 function formatInstall(server, client) {
   // server here is the per-server JSON we expose at /api/v1/server/<slug>.
   // Returns a code block with the appropriate install snippet.
-  const target = (server.installs ?? []).find((i) => i.client === client) ?? server.installs?.[0];
+  const exact = (server.installs ?? []).find((i) => i.client === client);
+  const target = exact ?? server.installs?.[0];
   if (!target) return `No install path available for ${server.name}`;
+  // Never mislabel a fallback as the requested client: if this server publishes no
+  // config for `client`, show the header for the config we're ACTUALLY returning and
+  // say so, so an agent doesn't paste (e.g.) a claude-desktop block into another client.
+  const shownClient = exact ? client : (target.client ?? client);
+  const fallbackNote = exact
+    ? ''
+    : `\n(No ${client}-specific config published for this server; showing the ${shownClient} config.)`;
   return [
-    `${server.title} (${server.name}) - ${client}`,
+    `${server.title} (${server.name}) - ${shownClient}`,
     '',
     target.json
       ? '```json\n' + target.json + '\n```'
       : '```bash\n' + target.command + '\n```',
     target.notes ? '\n' + target.notes : '',
+    fallbackNote,
     `\n${server.url ?? `https://mcpindex.ai/server/${server.slug}`}`,
   ].join('\n');
 }

package/src/tools-meta.json

@@ -0,0 +1,32 @@
+[
+  {
+    "name": "recommend_mcp_for_task",
+    "title": "Recommend MCP servers for a task",
+    "description": "Recommend the best MCP servers for a natural-language task. Returns top 3 ranked picks with reasoning, install commands, and quality scores. Use this when the user asks for the right MCP server for a task they want to do."
+  },
+  {
+    "name": "search_mcp_servers",
+    "title": "Search MCP servers",
+    "description": "Keyword + semantic search across the full MCP server registry. Use when the user knows what tool category they want but not which server."
+  },
+  {
+    "name": "get_install_command",
+    "title": "Get install command",
+    "description": "Get the exact install command for a given MCP server and client. Returns a JSON block ready to paste into the client config."
+  },
+  {
+    "name": "compare_servers",
+    "title": "Compare MCP servers",
+    "description": "Side-by-side comparison of 2-5 MCP servers - quality scores, install paths, env vars."
+  },
+  {
+    "name": "check_tool_trust",
+    "title": "Check tool trust (advisory)",
+    "description": "Pre-invocation advisory screen for a specific tool on an MCP server. Returns an advisory verdict object (directive ALLOW | DENY | REVIEW | UNVERIFIED, dimensions, freshness). At v1 the public screen produces REVIEW or UNVERIFIED only - ALLOW/DENY are reserved. Not the in-path gate (mcpindex-gate). Agents SHOULD treat UNVERIFIED as \"human review required\", never as ALLOW."
+  },
+  {
+    "name": "assess_server",
+    "title": "Assess server trust (advisory)",
+    "description": "Aggregated pre-flight trust assessment across all tools on an MCP server. Same verdict shape as check_tool_trust. Use for \"is THIS server worth integrating?\" decisions. v1 advisory; conformance monitored not enforced; verdicts may be UNVERIFIED if not yet probed."
+  }
+]