# Agent Action Gate [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/AAH20/agent-action-gate  
**GitHub Stars:** 0  
**Views:** 1  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/agent-action-gate

## Description
Gate/Prove: deny unattended destructive agent tools. Instant Audit $499 on a2zsoc.com.

## Claude Desktop Quick Installation
No confirmed install details yet, so no config is published. Follow the setup steps in the repository above.

## Documentation

## What Agent Action Gate MCP server does

Agent Action Gate MCP server places a policy decision between an agent and the MCP tools it wants to call. It is designed to prevent unattended destructive operations, including shell execution, control impairment, provisioning, and decommissioning. Unknown actions are denied, and model confidence is not treated as evidence of human approval.

The server returns a decision envelope containing the execution mode, whether automatic execution is permitted, a ledger identifier, and a receipt hash. Decisions can be `deny`, `simulate`, or `allow`. Read-oriented calls can be allowed, while write operations default to simulation so their side effects do not occur during evaluation.

## How it works

Run the MCP entry point with `PYTHONPATH=. python3 -m aag serve`. The process exposes a stdio MCP interface and does not execute the underlying tool. A client first sends the intended call to `gate_check`; the client remains responsible for deciding whether to invoke the actual tool after receiving the gate result.

For high-tier actions, an allow decision requires both a matching proof token and `approved: true`. Without those conditions, an unattended destructive request is denied, even when the supplied confidence is high. The implementation also supports a kill switch through `AAG_KILL_SWITCH=1` or a `KILL` file at `artifacts/KILL`.

Each decision is recorded in an append-only JSONL Action Ledger using a hash chain. The `ledger_verify` tool checks the ledger, while the returned ledger ID and receipt hash provide references for a decision. Python callers can use `AgentActionGate` and `evaluate_mcp_call` directly without running the stdio loop.

## Setup and configuration

Clone the repository and run the demonstration with `make demo`, or invoke the module directly for checks and benchmarks. A fixture can be evaluated with `PYTHONPATH=. python3 -m aag check <fixture>`. The included examples cover unattended shell activity, identity reads, impaired defenses, simulated writes, and proved decommissioning.

Set `AAG_PROVE_TOKEN` for approved high-tier actions, or pass a token with `--prove-token` when using the command-line check. The README shows a stdio configuration for Cursor and Claude using the repository as the working directory and `PYTHONPATH` in the environment. A container image is also documented at `ghcr.io/aah20/agent-action-gate:0.2.0`.

## Tools and capabilities

The Agent Action Gate MCP server exposes:

- `gate_check` for evaluating a proposed MCP tool call.
- `ledger_verify` for validating the hash-chained Action Ledger.
- Unknown-action denial and human-in-the-loop proof checks.
- Simulation mode for writes and explicit allow or deny decisions.
- Receipt hashes and ledger identifiers in decision responses.
- A Python library mapper for evaluating MCP calls without stdio.

## Limitations and notes

The Agent Action Gate MCP server is a gate, not an executor. It cannot itself perform the tool call after approval, and clients must place the check before the real invocation. The repository describes the cost examples as illustrative rather than quotes. Its commercial offerings, including the Instant Audit and consultation, are separate from the software. The project is licensed under MIT.

_Full upstream README: https://allmcps.com/mcp/agent-action-gate/readme_