In-path trust gate for agent tool calls. Pin → diff → HOLD on drift. Free. Deterministic. mcpindex.ai