Verification here runs from the certificate by itself, which is what keeps it useful when the vendor is gone, uninterested, or the party in dispute. The same idea points at the vendor in the exit drill: it asks whether you still hold a signing key, a local model and your own data.
An accountability layer for agent actions, built on the open-source OpenAgentOntology signing primitive: post-quantum receipts for things that matter, a preview-then-commit decision gate, egress classification, and a drill for how much a vendor's disappearance would cost you.
- A receipt verified from the certificate alone, offline, with no database call to whoever issued it
- Verification that defaults to post-quantum-required, so a receipt missing its ML-DSA-65 or SLH-DSA leg fails rather than passing as a weaker signature
- A two-phase gate: the preview returns a risk assessment and a preview_id without acting, and the commit takes that id back, checks the inputs still match, mints the receipt and returns an execution permit
- Receipts for a CRM record change with old and new values carried as SHA-256 hashes, so the audit trail does not hold the data it describes
- Receipts for any other consequential action, optionally attesting what triggered it — human, agent or script, via API, CLI or cron — and which model made the decision
- A data sample scanned for sensitivity markers and classified PUBLIC, INTERNAL, CONFIDENTIAL or RESTRICTED, with RESTRICTED egress blocked
- A list of MCP tools you pass in, ranked by worst regret if they act — the tool cannot discover other servers itself, and says so
- An exit drill that checks your local signing key, local model access through Ollama, and local data export, and reports step by step with no side effects
Python. pip install trust-gate-mcp runs it over stdio and signs with Ed25519 plus ML-DSA-65 in pure Python, with no native toolchain; the [slh] extra adds the hash-based SLH-DSA leg through liboqs and needs one. A hosted endpoint at https://trust-gate-mcp.onrender.com/mcp speaks streamable HTTP. Running the container in production needs the volume mounted at /data/oao — without it the signing key rotates on every restart and long-running verification chains break. TRUST_GATE_BEARER_TOKEN and TRUST_GATE_ALLOWED_ORIGINS turn on bearer auth and narrow CORS.
One command — pip install trust-gate-mcp