Agent Action Gate

What Agent Action Gate MCP server does

Agent Action Gate MCP server places a policy decision between an agent and the MCP tools it wants to call. It is designed to prevent unattended destructive operations, including shell execution, control impairment, provisioning, and decommissioning. Unknown actions are denied, and model confidence is not treated as evidence of human approval.

The server returns a decision envelope containing the execution mode, whether automatic execution is permitted, a ledger identifier, and a receipt hash. Decisions can be deny, simulate, or allow. Read-oriented calls can be allowed, while write operations default to simulation so their side effects do not occur during evaluation.

How it works

Run the MCP entry point with PYTHONPATH=. python3 -m aag serve. The process exposes a stdio MCP interface and does not execute the underlying tool. A client first sends the intended call to gate_check; the client remains responsible for deciding whether to invoke the actual tool after receiving the gate result.

For high-tier actions, an allow decision requires both a matching proof token and approved: true. Without those conditions, an unattended destructive request is denied, even when the supplied confidence is high. The implementation also supports a kill switch through AAG_KILL_SWITCH=1 or a KILL file at artifacts/KILL.

Each decision is recorded in an append-only JSONL Action Ledger using a hash chain. The ledger_verify tool checks the ledger, while the returned ledger ID and receipt hash provide references for a decision. Python callers can use AgentActionGate and evaluate_mcp_call directly without running the stdio loop.

Setup and configuration

Clone the repository and run the demonstration with make demo, or invoke the module directly for checks and benchmarks. A fixture can be evaluated with PYTHONPATH=. python3 -m aag check <fixture>. The included examples cover unattended shell activity, identity reads, impaired defenses, simulated writes, and proved decommissioning.

Set AAG_PROVE_TOKEN for approved high-tier actions, or pass a token with --prove-token when using the command-line check. The README shows a stdio configuration for Cursor and Claude using the repository as the working directory and PYTHONPATH in the environment. A container image is also documented at ghcr.io/aah20/agent-action-gate:0.2.0.

Tools and capabilities

The Agent Action Gate MCP server exposes:

• gate_check for evaluating a proposed MCP tool call.
• ledger_verify for validating the hash-chained Action Ledger.
• Unknown-action denial and human-in-the-loop proof checks.
• Simulation mode for writes and explicit allow or deny decisions.
• Receipt hashes and ledger identifiers in decision responses.
• A Python library mapper for evaluating MCP calls without stdio.

Limitations and notes

The Agent Action Gate MCP server is a gate, not an executor. It cannot itself perform the tool call after approval, and clients must place the check before the real invocation. The repository describes the cost examples as illustrative rather than quotes. Its commercial offerings, including the Instant Audit and consultation, are separate from the software. The project is licensed under MIT.