A Trust to act layer for MCP Tools!

I've been wiring MCP servers into agent workflows (Cursor, Claude Code, custom orchestrators) and kept hitting the same wall: discovery is easy, trust isn't.

Glama alone lists ~30k servers. PulseMCP, Smithery, and the official registry add more — with a lot of overlap. You can find a server in seconds. What you can't do is know whether you should let an autonomous agent call it — especially for anything irreversible (payments, deletes, outbound messages, arbitrary code paths).

Directories are great at listing. They're structurally awkward at grading the things they host. I don't think the registry that courts developers should also be the default referee on whether those tools are safe to invoke.

So I built mcpindex.ai — a trust-to-act layer for agent tool use.

What it does today (v1, advisory):

• Indexes MCP servers with agent-readable surfaces (/llms.txt, /.well-known/mcp-index.json, JSON-LD across the site)
• Ranks servers by intent (e.g. "read PDFs from Drive", "scrape a page and summarize") via a recommend API
• Exposes a per-tool clearance signal (check_tool_trust) that agents can gate on before invoking a third-party tool
• Verdicts are structured, versioned, and designed to be fail-closed at higher autonomy levels

What it does not claim (being explicit because this space is full of hand-waving):

• v1 is advisory — not production-grade calibrated clearance
• Conformance probing runs, but it's monitored, not enforcing in v1
• I'm not claiming "tamper-proof" or that conformance alone means safe
• Packaged stdio servers still need sandboxing before full production introspection; HTTP remote coverage is the v1 focus

The problem I'm trying to solve:

The binding constraint on long-tail MCP adoption isn't "can I find a server?" — it's "should my agent call this one without a human in the loop?"

Manual review doesn't scale to tens of thousands of tools. Static listicles go stale the week they're published. What I want is something closer to a default-deny gate keyed to autonomy level: discovery-only vs reversible vs irreversible.

Rough architecture:

1. Agent selects a tool call
2. Framework intercepts and calls check_tool_trust with a hash of the live tool definition
3. Verdict returns ALLOW / REVIEW / DENY (plus evidence pointers)
4. Agent branches deterministically — no "interpret the score" step

If you're integrating LangChain, DSPy, Mastra, Composio, or rolling your own orchestrator, the integration shape is the same: one MCP call between "model emitted tool call" and "tool runs."

Why I'm posting here:

Building in public. Early users, harsh feedback wanted.

• What MCP server do you reach for first — and how do you decide it's safe?
• Would you wire a preflight check into your agent loop today, or only after calibration matures?
• Is "neutral third-party referee" even the right model, or should frameworks own this?

Site: https://mcpindex.ai
One-click preflight install: https://mcpindex.ai/install.sh
If you want a specific server looked at: gb@mcpindex.ai (I try to return a signed evidence object within 72h for good-faith requests)