Gate Authority Network

What gate-authority-network does

The gate-authority-network MCP server checks whether an actor still has at least one live authority path from a principal. The decision is based on authority state obtained from external trust domains, rather than only on whether a credential is correctly formatted, unexpired, or signed.

A successful resolution can produce VALID / ALLOW when a usable path exists. It can produce INVALID / DENY when known paths are revoked or otherwise invalid, or UNKNOWN / DENY when the requested freshness or availability cannot be established. The action data can include a protocol, action name, and resource for integration or audit context.

GATE is intended to complement identity, credential, gateway, and authorization systems. It does not act as the application policy decision point. Questions such as whether a principal may delete a particular customer record remain with systems such as OPA, Cedar, AuthZEN, Cerbos, Permit, or OpenFGA.

How it works

Applications send a principal, actor, action context, consistency mode, and optional freshness limit for verification. The public SDK example uses GateClient and calls verify(). The MCP package provides the MCP integration surface for this authority-state resolution flow.

The bounded mode verifies against the canonical primary using a bounded primary-read snapshot age. The strict mode is available only to eligible plans and still means canonical primary-read verification; it does not synchronously confirm every external issuer system.

The gate-authority-network MCP server resolves live state rather than issuing a portable signed authority proof. Its result is a current resolution outcome, not a replacement for OAuth, MCP authentication, A2A, OpenID Federation, Security Event Tokens, Shared Signals, or an API gateway.

Setup and configuration

Node.js 20 or newer is required for the repository demo. Install the MCP package from npm with:

npm install @gate-avn/mcp@dev

The package is also listed in the Official MCP Registry as io.github.Projetxana/gate-authority-network. The repository separately provides the SDK package @gate-avn/sdk@dev and a public demonstration using GATE_URL as the endpoint setting.

Two service paths are documented. The hosted sandbox uses a synthetic authority graph and provides a temporary key with a seven-day lifetime and a quota of 500 verifications per project per day. The live Free Network uses a real API key, a canonical hosted endpoint, 50,000 verifications per month, one authority issuer, and bounded consistency.

Tools and capabilities

• Resolve whether a principal-to-actor delegation path is currently live.
• Account for revocation and external authority state across trust domains.
• Request bounded or eligible strict consistency behavior.
• Return ALLOW, DENY, or an indeterminate UNKNOWN / DENY result.
• Carry MCP action, resource, and protocol context with a verification request.
• Preserve alternate valid paths when evaluating authority state.

Limitations and notes

The gate-authority-network MCP server is experimental Developer Preview software and is not described as production-ready or enterprise GA. The current operational boundary is one Canadian primary database, with no production regional replicas and no independent third-party issuer propagation SLA. maxStalenessMs measures primary snapshot age only.

The Free Network does not include strict consistency. The preview also does not provide a cryptographically signed GATE receipt. HTTP, x402, AuthZEN, A2A, AP2, and SSF adapters exist in the Stage 16 repository baseline but are not published as public npm packages according to the README.

Use GATE with an existing policy engine and identity infrastructure. It verifies live authority state; it does not decide business permissions, mint a proprietary delegation token, replace OAuth, or replace the application’s authorization controls.