Trust Gate

TrustGate MCP

Tamper-evident receipts for consequential agent actions, as an MCP server, with a decision gate that returns ALLOW, DENY or ESCALATE.

Sixteen tools: seven local ones on one shared signing primitive, the open-source OpenAgentOntology mint_receipt, plus nine optional read-only views over a TrustGate API (see "Read-only API views" below).

What actually gets signed depends on what you install -- OAO detects its backend at import time, so this is worth stating plainly rather than advertising the best case:

PQ-required verify (the default) demands at least one verified post-quantum leg. That shows a post-quantum signature is present and valid over the same bytes. It does not say whose key made it (see "What a valid receipt proves"), and it does not make the default backend production-grade.

Read-only API views (optional, off by default)

Nine tools show what a TrustGate API computes from records YOU supply. They do nothing until you set TRUST_GATE_API_URL (https; http only for localhost), TRUST_GATE_API_KEY (a bearer credential issued for one tenant) and TRUST_GATE_TENANT_ID. The seven local tools above need none of these and never call out.

Each takes one object, request, forwarded as the call body. Rules every one follows:

• Read-only. Nothing is written, signed, executed or authorized. The answer is built from the records you pass in; their claims are yours, not verified facts.
• The tenant is configuration. request may not name a tenant at its top level, and a tenant key at any depth (tenant, tenant_id, tenant-id, TenantId, in any case) must equal TRUST_GATE_TENANT_ID, otherwise the request is refused before any call. Only TRUST_GATE_TENANT_ID is ever sent as the tenant.
• Fail closed. A missing setting, a 404 (the surface is off or not deployed), a rate limit, a server error, a transport error or an answer of the wrong shape returns status: "UNAVAILABLE" with a reason. A refusal from the API returns REFUSED with its short code. Data is never filled in or defaulted.
• The credential is never logged or returned, and no exception text is passed on.
• A mapping or readout is not a compliance finding. Every result says so.
• Version match. The receipt, decision, replay, propose and requalification views (get_receipt_evidence, get_decision_evidence, replay_decision, propose_requalification, compare_qualification_change) and the case, question, evidence and pack views need a TrustGate API version that serves them. Against an older server, or one with the surface switched off, they return UNAVAILABLE (surface_not_available) until it does.
• Requests are capped at 64 KiB; answers are read up to 1 MiB (error bodies up to 4 KiB) and never further. 10 second timeout, no redirects, and proxy environment variables are ignored.

What the gate does and does not do

• Scope. It applies only to actions your code routes through gate_decision. It does not observe, intercept or block anything an agent does, and it does not check afterward whether an action happened. Your code (a hook, a wrapper) must ask first and must obey the answer.
• ALLOW is a closed list. An action gets ALLOW only when its name is a known read verb (read, get, list, search, query, find, show, view, inspect, describe) followed only by words from a small built-in vocabulary of nouns (for example read_file, list_files, search_files, list_dir, get_user, describe_table), the name is a plain identifier, and the resource is built only from words of that vocabulary, a few ordinary document words (readme, guide, changelog, ...) and source or prose file types (md, txt, py, ...), with digits allowed between words (docs/2024/notes.md). A name that contains any other word escalates to a human, because the gate has not seen it. This is deliberately narrow: most real file names escalate. Widening it means adding words to the vocabulary in the source, which is a visible change.
• Structural rules escalate as well. A hidden path (.env, .ssh, .git, ..), an absolute path, a URL, a host name as the first part of a path (example.com/x, localhost), a network address in any of its usual spellings (four dotted numbers of any width, hexadecimal, octal such as 0177.1, one long integer, 0; short dotted numbers such as 1.2.3 stay versions unless the last number is too large for a version or the first is 0 or 127), a resource that starts with -, a phrase of three or more words, anything containing characters other than letters, digits, spaces and _ . - / (after Unicode compatibility folding), and a file whose real type is configuration, data, key, state or archive (a rotation counter such as .1 is ignored when judging the type; a listed data or archive type earlier in a dotted name, such as users.csv.txt, counts too). A resource that carries a command escalates: a listed mutating word (alter, merge, flush, load, ...), a critical verb glued to a word (deleteall), or any multi-word resource after a query verb.
• DENY is for a critical lead verb (payments, deletion, deployment, code execution, privilege changes). A risky word elsewhere in the name, or in the resource, escalates so that a human decides; so do the high-risk lead verbs (format, remove, reset, release, escalate) and a file name that contains a risky word (test_delete_user.py).
• Risky and sensitive words are listed, and the lists are finite. Listed secret and regulated-data words (password, token, key, pass, config, ssn, diagnosis, ... in their glued, plural and digit-swapped forms) give the HIGH tier a specific reason. The lists are not what keeps a name from being allowed (a sensitive name on no list still escalates, because ALLOW is closed). history is not a read noun. Matching runs across word boundaries, so some harmless names show the sensitive reason (api/index.md contains "pii"). A lookup such as list_users is a read like any other: the gate does not judge how much personal data it returns. Common read tools whose names contain a word that is also a risky verb (get_email, list_messages) escalate.
• It is a name-based heuristic, not a proof. ALLOW does not mean the action is safe: an agent that calls a dangerous tool read_file is not caught, because the gate sees names, not behaviour. context is recorded in the receipt as a hash and is not used to decide. There is no operator override in this package.
• Read the verdict from the receipt, and check who issued it. receipt.decision (and receipt.evidence.ontology.verdict) are signed. The top-level `ve