World Monitor
Real-time global intelligence on conflict, markets, energy, trade, shipping and cyber. 104 tools.
Post-quantum, tamper-evident receipts for agent actions. Ed25519 + ML-DSA-65, offline verify.
Wähle die KI-App, die du nutzt, und kopiere die Einstellungen.
5/5 Prüfungen bestanden · Was du fragst, läuft über den Server des Anbieters (trust-gate-mcp.onrender.com) · ✓ Befehle geprüft am 13. Nov. 2026
Zuerst: Welche KI nutzt du?
Wähle deine App, dann erscheinen die Schritte unten.
Klappt mit Claude · etwa 2 Min.
Kein Schlüssel, nichts zu installieren · Einmal auf claude.ai oder in der Desktop-App einrichten, dann im Chat nutzen · kostenlose Konten können 1 hinzufügen · bei Team/Enterprise fügt ein Owner ihn hinzu
CustomizeConnectors
Kopiere jeden Wert in das gleichnamige Feld in Claude und klicke Continue
Trust Gatehttps://trust-gate-mcp.onrender.com/mcpKlicke auf der von Claude erkannten Anmelde-Seite auf Continue · wähle bei Authentication, was der Anbieter angibt (Sign in now, Sign in when needed oder No sign in), dann Add
+ConnectorsTrust Gate
Nutze Trust Gate und sag mir, was du für mich tun kannst; zeig mir dann eine Sache✓ Wenn Claude sagt, dass es Trust Gate nutzt, oder ein Werkzeug von Trust Gate in der Antwort zeigt, bist du verbunden
Menünamen am 11. Nov. 2026 mit der Hilfe von Anthropic abgeglichen · dein Bildschirm kann je nach App-Version leicht abweichen
Klappt mit ChatGPT je nach Tarif
Volles MCP: ChatGPT Business, Enterprise oder Edu im Web · Pro: verbindet mit Lese-/Abrufrechten, Werkzeuge, die Daten ändern, gehen evtl. nicht · Plus: in der Doku nicht bestätigt; siehst du auf der Plugins-Seite eine Option für eigene MCP-Server, kannst du es versuchen · nur Web
Plugins+Add custom MCP server
Namen eingeben, Adresse unter Connection einfügen, Risikohinweis abhaken und Create as a plugin klicken
Trust Gatehttps://trust-gate-mcp.onrender.com/mcpNeuen Chat öffnen und vor dem Tippen Trust Gate aus deinen Plugins wählen
Nutze Trust Gate und sag mir, was du für mich tun kannst; zeig mir dann eine Sache✓ Wenn ChatGPT sagt, dass es Trust Gate nutzt, oder ein Werkzeug von Trust Gate in der Antwort zeigt, bist du verbunden
Menünamen am 11. Nov. 2026 mit der Hilfe von OpenAI abgeglichen · dein Bildschirm kann je nach App-Version leicht abweichen
Klappt mit Claude Code · etwa 2 Min.
Kein Schlüssel, nichts zu installieren
Mac: Command+Leertaste drücken und Terminal tippen · Windows: PowerShell öffnen
claude mcp add --transport http --scope user trust-gate https://trust-gate-mcp.onrender.com/mcpTrust Gate sollte in der Liste als verbunden erscheinen
Nutze Trust Gate und sag mir, was du für mich tun kannst; zeig mir dann eine Sache✓ Wenn Claude Code sagt, dass es Trust Gate nutzt, oder ein Werkzeug von Trust Gate in der Antwort zeigt, bist du verbunden
Menünamen am 11. Nov. 2026 mit der Hilfe von Anthropic abgeglichen · dein Bildschirm kann je nach App-Version leicht abweichen
Klappt mit Cursor · etwa 2 Min.
Kein Schlüssel, nichts zu installieren
Nutze Trust Gate und sag mir, was du für mich tun kannst; zeig mir dann eine Sache✓ Wenn Cursor sagt, dass es Trust Gate nutzt, oder ein Werkzeug von Trust Gate in der Antwort zeigt, bist du verbunden
Menünamen am 11. Nov. 2026 mit der Hilfe von Cursor abgeglichen · dein Bildschirm kann je nach App-Version leicht abweichen
Klappt mit VS Code · etwa 2 Min.
Kein Schlüssel, nichts zu installieren
VS Code fragt nach einer Bestätigung; klicke Install
Nutze Trust Gate und sag mir, was du für mich tun kannst; zeig mir dann eine Sache✓ Wenn VS Code sagt, dass es Trust Gate nutzt, oder ein Werkzeug von Trust Gate in der Antwort zeigt, bist du verbunden
Menünamen am 11. Nov. 2026 mit der Hilfe von VS Code abgeglichen · dein Bildschirm kann je nach App-Version leicht abweichen
Andere Apps mit MCP, etwa Windsurf, Zed oder Gemini CLI, fügen Server unterschiedlich hinzu. Sieh in der App-Liste nach
Adresse für Apps, die über das Web verbinden
https://trust-gate-mcp.onrender.com/mcpJSON-Einstellungen stehen unten unter „Für Entwickler“
Claude Code
claude mcp add --transport http --scope user trust-gate https://trust-gate-mcp.onrender.com/mcpCursor (~/.cursor/mcp.json)
{
"mcpServers": {
"trust-gate": {
"url": "https://trust-gate-mcp.onrender.com/mcp"
}
}
}VS Code (mcp.json)
{
"servers": {
"trust-gate": {
"type": "http",
"url": "https://trust-gate-mcp.onrender.com/mcp"
}
}
}Diese Einstellungen werden aus dem Registry-Eintrag des Entwicklers erzeugt. Wenn in der README etwas anderes steht, folge der README.
Basierend darauf, wie sich dieser Server verbindet, und auf der eigenen Doku jeder App, geprüft am 10. Nov. 2026.
Verbinden sich über das Internet in
ClaudeChatGPTGooseLM StudioMsty StudioCherry StudioCursorVS Code + GitHub CopilotVisual StudioWindsurf (Devin Desktop)ZedKiroClineContinueJetBrains AI AssistantClaude CodeCodex CLIGemini CLIOpenCodenodecodeWarpLibreChatOpen WebUIRaycast
Tool-Namen und -Beschreibungen genau so, wie der Server sie am 10. Nov. 2026 gemeldet hat. Geschrieben hat sie der Entwickler, nicht wir; wir zeigen sie als reinen Text.
mint_receipt_for_record_changeMint a signed receipt (Ed25519, plus ML-DSA-65 when the post-quantum backend is available) for one CRM record change. Old/new values are carried as SHA-256 hashes. Works with any CRM (Relaticle, hosted CRMs, custom).
audit_my_agent_inventoryRank a CALLER-PROVIDED list of MCP tools by worst-regret if they act (a name-based heuristic that weights a name's first word most). Read-only: it mints no receipt. Cannot auto-discover the inventory -- MCP does not allow that; the caller must pass it in.
mint_action_receiptMint a signed receipt (Ed25519, plus ML-DSA-65 when the post-quantum backend is available) for an arbitrary consequential agent action. Optional attestation: triggered_by_type (human/agent/script), triggered_by_source (api/cli/cron), decision_model (the LLM model used). Attestati
verify_receiptVerify a TrustGate receipt from the certificate alone (offline). ok=true means unchanged since signing, signed, kid consistent with the embedded key, and (require_pq default on) at least one post-quantum leg verified; unsigned receipts fail. It does not prove who signed: pass exp
gate_decisionTwo-phase decision gate with a real verdict. PREVIEW returns ALLOW, DENY or ESCALATE with the risk tier and reasons, plus a preview_id, without acting. COMMIT re-evaluates the same inputs and mints a signed receipt for the verdict. Only ALLOW returns a GRANTED permit; DENY return
check_egressEgress classification check. Scans a data sample for a finite list of sensitivity markers and classifies as NO_MARKERS_FOUND / INTERNAL / CONFIDENTIAL / RESTRICTED. RESTRICTED sets blocked=true; this tool cannot block anything itself, and NO_MARKERS_FOUND is not clearance to send
run_exit_drillVendor exit readiness drill. Checks local signing key, local model access (Ollama). Returns step-by-step results and a tamper-evident receipt. Informational; it signs one receipt, which creates the signing key on a host that has none yet.
inspect_oversight_caseReadiness report for one oversight case, computed from the records you supply. Read-only view of the records you supply; it writes, signs and executes nothing. Needs TRUST_GATE_API_URL, TRUST_GATE_API_KEY and TRUST_GATE_TENANT_ID to be set, and the tenant comes from that setting,
propose_role_questionQuestions routed to a role for one oversight case, from the records and source lookups you supply. It proposes; it never asks anyone. Read-only view of the records you supply; it writes, signs and executes nothing. Needs TRUST_GATE_API_URL, TRUST_GATE_API_KEY and TRUST_GATE_TENAN
get_intervention_evidenceEvidence for whether an intervention could be shown to have taken effect, from the records you supply. Read-only view of the records you supply; it writes, signs and executes nothing. Needs TRUST_GATE_API_URL, TRUST_GATE_API_KEY and TRUST_GATE_TENANT_ID to be set, and the tenant
compare_qualification_changeStatus of each proposed retest after a change (current, not current or unbound), from the proposal inputs and results you supply. Read-only view of the records you supply; it writes, signs and executes nothing. Needs TRUST_GATE_API_URL, TRUST_GATE_API_KEY and TRUST_GATE_TENANT_ID
export_acceptance_packAcceptance-pack export for one or more cases, optionally mapped to one control id and version you name. Read-only view of the records you supply; it writes, signs and executes nothing. Needs TRUST_GATE_API_URL, TRUST_GATE_API_KEY and TRUST_GATE_TENANT_ID to be set, and the tenant
get_receipt_evidenceEvidence view of one receipt you supply, with what the service could and could not check. Read-only view of the records you supply; it writes, signs and executes nothing. Needs TRUST_GATE_API_URL, TRUST_GATE_API_KEY and TRUST_GATE_TENANT_ID to be set, and the tenant comes from th
get_decision_evidenceEvidence view, verdict and open questions for one decision and the facts you supply. Read-only view of the records you supply; it writes, signs and executes nothing. Needs TRUST_GATE_API_URL, TRUST_GATE_API_KEY and TRUST_GATE_TENANT_ID to be set, and the tenant comes from that se
replay_decisionReplay of a decision's evidence path over the records you supply. It replays records; it executes nothing. Read-only view of the records you supply; it writes, signs and executes nothing. Needs TRUST_GATE_API_URL, TRUST_GATE_API_KEY and TRUST_GATE_TENANT_ID to be set, and the ten
propose_requalificationImpact and a requalification PROPOSAL for a change, over the graph you supply. It never runs a retest. Read-only view of the records you supply; it writes, signs and executes nothing. Needs TRUST_GATE_API_URL, TRUST_GATE_API_KEY and TRUST_GATE_TENANT_ID to be set, and the tenant
Wir prüfen Informationen, die jeder sehen kann; den Code haben wir nicht gelesen. Checks, die nicht zutreffen, werden nicht mitgezählt. · Geprüft am 13. Nov. 2026
Der Registry-Name wurde mit dem GitHub-Konto CWNApps bestätigt, dem das Repo gehört
Code zuletzt geändert: vor 9 Tagen
Nutzt Apache-2.0
Antwort in 108 ms (HTTP 200)
Keine Anmeldung nötig
Wir haben 16 Tool-Beschreibungen gelesen und keine versteckten Anweisungen an die KI gefunden
Fragen, Tipps teilen oder melden, dass etwas nicht geht. Sortiert nach „hilfreich“.
Noch keine Beiträge. Stell die erste Frage oder teile einen Tipp.
Beiträge hier stammen von Nutzern, nicht vom PopNx-Team.
Noch keine Bewertungen
Verglichen mit allen aktiven Servern dieser Kategorie in der Registry. Sterne zählen nur, wenn dem Herausgeber das Repo gehört.
Er hat 5 von 5 zutreffenden Basischecks bestanden. Den Code haben wir nicht gelesen. Bevor du einen Schlüssel oder Token hinzufügst, sieh nach, welche Zugriffe der Server verlangt, und nutze einen Schlüssel, der nur die Berechtigungen hat, die du brauchst.
Die Registry nennt keinen erforderlichen Schlüssel, manche Server bitten dich aber bei der ersten Nutzung, dich anzumelden.
Er läuft in der Cloud des Entwicklers. Du verbindest dich übers Internet, ohne etwas zu installieren, aber was du sendest, läuft über die Server des Entwicklers.
Das GitHub-Repo wurde zuletzt vor 9 Tagen geändert, und die neueste Version (0.2.0) kam vor 5 Monaten in die Registry.
Apps, die MCP unterstützen, etwa Claude Desktop, Claude Code, Cursor und VS Code. Er verbindet sich per URL und funktioniert daher auch in Apps mit Remote-MCP, etwa ChatGPT im Web (volles MCP ab Business; Pro nur lesend).
In derselben Kategorie: World Monitor, Claude Flow, Windmill
Server derselben Kategorie von anderen Entwicklern, sortiert nach Sternen.
So liest du eine Karte:↓ Downloads pro Wochei★ GitHub-SterneiDrei Säulen: Bewertungen · Checks · NutzungiAktualisiert = neueste Version in der Registry veröffentlichti
Real-time global intelligence on conflict, markets, energy, trade, shipping and cyber. 104 tools.
AI orchestration with hive-mind swarms, neural networks, and 87 MCP tools for enterprise dev.
Run Windmill scripts and flows and manage jobs, schedules, resources and variables.
Unverändert aus dem Repo des Entwicklers übernommen. PopNx MCP hat den Inhalt weder geprüft noch empfiehlt es ihn. HTML, Bilder und Skripte wurden entfernt. Links führen von dieser Website weg.
Tamper-evident receipts for consequential agent actions, as an MCP server, with a decision gate that returns ALLOW, DENY or ESCALATE.
Sixteen tools: seven local ones on one shared signing primitive, the open-source OpenAgentOntology mint_receipt, plus nine optional read-only views over a TrustGate API (see "Read-only API views" below).
What actually gets signed depends on what you install -- OAO detects its backend at import time, so this is worth stating plainly rather than advertising the best case:
| Install | Legs | Notes |
|---|---|---|
pip install trust-gate-mcp | Ed25519 + ML-DSA-65 | Default. The ML-DSA leg comes from dilithium-py, a pure-Python library whose own README says it must not be used for cryptographic applications and that it is not constant-time. It keeps receipts tamper-evident and satisfies PQ-required mode, but treat that leg as unhardened. |
pip install "trust-gate-mcp[slh]" | Ed25519 + ML-DSA-65 (native backend) | Installs liboqs-python, which needs the native liboqs library; the signing primitive then prefers liboqs for ML-DSA-65. It adds a hash-based leg only if that liboqs still ships SPHINCS+-SHA2-128s-simple (a pre-standard variant, not byte-compatible with the final FIPS 205 standard). liboqs 0.16.0, the only release liboqs-python currently targets, removed SPHINCS+, so as of 2026-09-29 this extra gives the native ML-DSA backend and no hash-based leg (not verified with liboqs installed). If liboqs cannot be imported the primitive silently falls back to dilithium-py; run_exit_drill names the active backend and whether the hash-based leg is available. Use this install if the post-quantum legs matter to you. |
PQ-required verify (the default) demands at least one verified post-quantum leg. That shows a post-quantum signature is present and valid over the same bytes. It does not say whose key made it (see "What a valid receipt proves"), and it does not make the default backend production-grade.
| Tool | What it does |
|---|---|
mint_receipt_for_record_change | Mints a receipt for a CRM record change. Works with any CRM (open-core Relaticle, hosted CRMs via their own MCP, custom). Old/new values are SHA-256 hashes (unsalted, so a low-entropy value can be guessed from its hash). |
audit_my_agent_inventory | Ranks a CALLER-PROVIDED list of MCP tools by worst-regret if they act (a name-based heuristic that weights a name's first word most: delete_file ranks above file_delete). Read-only: it mints no receipt. Cannot auto-discover other servers -- MCP protocol does not allow that. A row that is not an object is an error, never silently skipped. |
mint_action_receipt | Receipt for any consequential agent action. Attestation values (triggered_by_*, decision_model) are caller claims: limited to safe characters, signed, not verified. Decision values that contain a gate verdict word (allow, deny, escalate, grant, permit, approve, withheld, committed), operation names with gate as a word, and the gate's own policy id are refused. That check is best effort: to accept a receipt as a gate verdict, pin the signer and check the signed issuer_tool (see below). |
verify_receipt | Verify a receipt from the certificate alone -- offline, no DB. Refuses unsigned receipts, checks the kid, and accepts expected_kid to pin the signer (counted only when that key's own Ed25519 signature verifies). Defaults to PQ-required mode. When it says ok it returns a verified block (decision, evidence hash, signed time, issuer_tool, operation and the whole verified ontology manifest, including the action and resource): read those values, not your own parse of the receipt. |
gate_decision | Two-phase decision gate with a real verdict. PREVIEW returns ALLOW, DENY or ESCALATE with the risk tier and reasons, without acting. COMMIT re-evaluates and mints a signed receipt for the verdict. Only ALLOW returns a GRANTED permit; DENY returns DENIED; ESCALATE returns WITHHELD_PENDING_HUMAN and a human decides. See below. |
check_egress | Flags sensitive markers in a data sample (a finite list of keywords, SSN and card-number shapes, and common credential formats, including NAME=value assignments) as NO_MARKERS_FOUND / INTERNAL / CONFIDENTIAL / RESTRICTED. Credential-shaped values and personal identifiers are RESTRICTED and set blocked: true; credential keywords alone are CONFIDENTIAL. A harmless sample that looks like an assignment of a key or password can be flagged too. It cannot block anything itself: your code must read blocked and obey it. NO_MARKERS_FOUND is not clearance to send. Returns classification + retention info + receipt. |
run_exit_drill | Vendor exit readiness drill. Checks the local signing key (names the post-quantum backend and whether the hash-based leg is available) and that a local model endpoint is configured (Ollama; it is not contacted, and a remote host is not counted). Returns step-by-step results + receipt. Informational; it signs one receipt, which creates the signing key on a host that has none yet. |
Nine tools show what a TrustGate API computes from records YOU supply. They do nothing until you set TRUST_GATE_API_URL (https; http only for localhost), TRUST_GATE_API_KEY (a bearer credential issued for one tenant) and TRUST_GATE_TENANT_ID. The seven local tools above need none of these and never call out.
| Tool | Shows |
|---|---|
inspect_oversight_case | Readiness report for one oversight case |
propose_role_question | Questions routed to a role for a case. It proposes; it asks no one |
get_intervention_evidence | Evidence on whether an intervention could be shown to have taken effect |
compare_qualification_change | Status of each proposed retest after a change: current, not current or unbound |
export_acceptance_pack | Acceptance-pack export, optionally mapped to one control id and version you name |
get_receipt_evidence | Evidence view of one receipt, with what the service could and could not check |
get_decision_evidence | Evidence view, verdict and open questions for a decision and its facts |
replay_decision | Replay of a decision's evidence path over supplied records. It executes nothing |
propose_requalification | Impact and a requalification proposal. It never runs a retest |
Each takes one object, request, forwarded as the call body. Rules every one follows:
request may not name a tenant at its top level, and a tenant key at any depth (tenant, tenant_id, tenant-id, TenantId, in any case) must equal TRUST_GATE_TENANT_ID, otherwise the request is refused before any call. Only TRUST_GATE_TENANT_ID is ever sent as the tenant.status: "UNAVAILABLE" with a reason. A refusal from the API returns REFUSED with its short code. Data is never filled in or defaulted.get_receipt_evidence, get_decision_evidence, replay_decision, propose_requalification, compare_qualification_change) and the case, question, evidence and pack views need a TrustGate API version that serves them. Against an older server, or one with the surface switched off, they return UNAVAILABLE (surface_not_available) until it does.gate_decision. It does not observe, intercept or block anything an agent does, and it does not check afterward whether an action happened. Your code (a hook, a wrapper) must ask first and must obey the answer.read, get, list, search, query, find, show, view, inspect, describe) followed only by words from a small built-in vocabulary of nouns (for example read_file, list_files, search_files, list_dir, get_user, describe_table), the name is a plain identifier, and the resource is built only from words of that vocabulary, a few ordinary document words (readme, guide, changelog, ...) and source or prose file types (md, txt, py, ...), with digits allowed between words (docs/2024/notes.md). A name that contains any other word escalates to a human, because the gate has not seen it. This is deliberately narrow: most real file names escalate. Widening it means adding words to the vocabulary in the source, which is a visible change..env, .ssh, .git, ..), an absolute path, a URL, a host name as the first part of a path (example.com/x, localhost), a network address in any of its usual spellings (four dotted numbers of any width, hexadecimal, octal such as 0177.1, one long integer, 0; short dotted numbers such as 1.2.3 stay versions unless the last number is too large for a version or the first is 0 or 127), a resource that starts with -, a phrase of three or more words, anything containing characters other than letters, digits, spaces and _ . - / (after Unicode compatibility folding), and a file whose real type is configuration, data, key, state or archive (a rotation counter such as .1 is ignored when judging the type; a listed data or archive type earlier in a dotted name, such as users.csv.txt, counts too). A resource that carries a command escalates: a listed mutating word (alter, merge, flush, load, ...), a critical verb glued to a word (deleteall), or any multi-word resource after a query verb.format, remove, reset, release, escalate) and a file name that contains a risky word (test_delete_user.py).history is not a read noun. Matching runs across word boundaries, so some harmless names show the sensitive reason (api/index.md contains "pii"). A lookup such as list_users is a read like any other: the gate does not judge how much personal data it returns. Common read tools whose names contain a word that is also a risky verb (get_email, list_messages) escalate.read_file is not caught, because the gate sees names, not behaviour. context is recorded in the receipt as a hash and is not used to decide. There is no operator override in this package.receipt.decision (and receipt.evidence.ontology.verdict) are signed. The top-level `ve