audit_my_agent_inventory
Rank a CALLER-PROVIDED list of MCP tools by worst-regret if they act, with a signed receipt. Cannot auto-discover the inventory -- MCP does not allow that; the caller must pass it in.
LABSCO SUMMARY
A receipt you can only check by asking the issuer is a database lookup, not evidence.
Verification here runs from the certificate by itself, which is what keeps it useful when the vendor is gone, uninterested, or the party in dispute. The same idea points at the vendor in the exit drill: it asks whether you still hold a signing key, a local model and your own data.
What it is
An accountability layer for agent actions, built on the open-source OpenAgentOntology signing primitive: post-quantum receipts for things that matter, a preview-then-commit decision gate, egress classification, and a drill for how much a vendor's disappearance would cost you.
What you get
- A receipt verified from the certificate alone, offline, with no database call to whoever issued it
- Verification that defaults to post-quantum-required, so a receipt missing its ML-DSA-65 or SLH-DSA leg fails rather than passing as a weaker signature
- A two-phase gate: the preview returns a risk assessment and a preview_id without acting, and the commit takes that id back, checks the inputs still match, mints the receipt and returns an execution permit
- Receipts for a CRM record change with old and new values carried as SHA-256 hashes, so the audit trail does not hold the data it describes
- Receipts for any other consequential action, optionally attesting what triggered it — human, agent or script, via API, CLI or cron — and which model made the decision
- A data sample scanned for sensitivity markers and classified PUBLIC, INTERNAL, CONFIDENTIAL or RESTRICTED, with RESTRICTED egress blocked
- A list of MCP tools you pass in, ranked by worst regret if they act — the tool cannot discover other servers itself, and says so
- An exit drill that checks your local signing key, local model access through Ollama, and local data export, and reports step by step with no side effects
Requirements
Python. pip install trust-gate-mcp runs it over stdio and signs with Ed25519 plus ML-DSA-65 in pure Python, with no native toolchain; the [slh] extra adds the hash-based SLH-DSA leg through liboqs and needs one. A hosted endpoint at https://trust-gate-mcp.onrender.com/mcp speaks streamable HTTP. Running the container in production needs the volume mounted at /data/oao — without it the signing key rotates on every restart and long-running verification chains break. TRUST_GATE_BEARER_TOKEN and TRUST_GATE_ALLOWED_ORIGINS turn on bearer auth and narrow CORS.
Setup effort
One command — pip install trust-gate-mcp
USE CASES
01
Making an agent's risky action reviewable afterwards
Mint a receipt at the moment it acts, recording the operation, the target and what decided it, then verify that receipt later without contacting anything.
02
Putting a checkpoint in front of something irreversible
Run the preview for a risk assessment, decide, then commit with the same preview_id — the inputs are checked to be unchanged before the permit is issued.
03
Keeping an audit trail of CRM edits without copying the data
Record each field change as a receipt where old and new values are hashes, so the trail proves what changed without holding what it was.
04
Checking what is about to leave the building
Classify the sample against sensitivity markers before it goes to an external provider; anything RESTRICTED is blocked and the result comes back with its own receipt.
05
Working out which attached tool could do the most damage
Pass the list of tools your agent is holding and get them ranked by worst regret if they act, with a signed record of the assessment.
06
Testing whether you could walk away from a vendor
Run the drill and read it step by step: local signing key, local model access, local data export — informational, with nothing changed.
7 tools
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
check_egress
Egress classification check. Scans a data sample for sensitivity markers (heuristic) and classifies as PUBLIC / INTERNAL / CONFIDENTIAL / RESTRICTED. Blocks RESTRICTED-class egress. Returns classification, retention info, and a tamper-evident receipt.
gate_decision
Two-phase decision gate. PREVIEW phase returns a risk assessment and preview_id without acting. COMMIT phase requires that preview_id back, verifies inputs match, mints a tamper-evident receipt, and returns an execution permit. Stateless. Optional attestation: triggered_by_type, triggered_by_source, decision_model.
mint_action_receipt
Mint a post-quantum receipt for an arbitrary consequential agent action. Optional attestation: triggered_by_type (human/agent/script), triggered_by_source (api/cli/cron), decision_model (the LLM model used). Allowlisted to safe chars.
mint_receipt_for_record_change
Mint a post-quantum receipt for one CRM record change. Old/new values are carried as SHA-256 hashes. Works with any CRM (Relaticle, hosted CRMs, custom).
run_exit_drill
Vendor exit readiness drill. Checks local signing key, local model access (Ollama), and local data export capability. Returns step-by-step results and a tamper-evident receipt. Informational -- no side effects.
verify_receipt
Verify a Trust Gate receipt from the certificate alone (offline). require_pq=True (default via OAO_REQUIRE_PQ) FAILS if the ML-DSA-65 or SLH-DSA legs are missing -- defends against signature-stripping downgrade attacks.
BEFORE YOU INSTALL
What to know first
Tools you get
7 tools when we connected. pip install "trust-gate-mcp[slh]" adds SLH-DSA signing beyond Ed25519 and ML-DSA-65. audit_my_agent_inventory ranks only the tools you pass it.
Requires
uvx on PATH
CONTEXT COST
Light Standing cost
Rated by the size of the 7 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Connect your client
Add the block to your client, or run the command directly.
Server setup
Configuration file
JSON
{
"mcpServers": {
"trust-gate-mcp": {
"command": "uvx",
"args": [
"trust-gate-mcp"
]
}
}
}pip
TERMINAL
pip install trust-gate-mcp
