Gnt

What the gnt MCP server does

The gnt MCP server gives agents access to a policy layer whose rules are maintained as files in a connected GitHub repository. Teams propose or update rules through pull requests, and merging a pull request approves the rule. Each rule uses Markdown with YAML frontmatter containing details such as its title, status, owner, citations, approval information, and pull request reference.

Agents can submit a description of a proposed action before execution. The system returns one of three verdicts: allowed, blocked, or needs_human. A response can include a reason, the rules cited for the decision, and the number of rules retrieved. The fail-closed needs_human result applies when no approved rule covers the action, retrieval fails, or the check cannot complete.

How it works

The gnt MCP server exposes one MCP endpoint with five tools. Rules are indexed in gnt's store, and MCP calls read from that store rather than cloning the GitHub repository for every request. Rule provenance links decisions to the approved rule file and the pull request that introduced it.

The normal workflow starts with the CLI. After authentication and repository connection, gnt prebrain can scan sources, extract candidate rules, and open pull requests. Teams can also initialize a local rules/ directory, propose rules for review, inspect pending reviews, and download the latest compiled skill pack. Merging the pull request is the approval step; there is no separate publishing action.

Setup and configuration

Install the CLI with npm or the provided shell installer. Node.js version 22.13 or newer is required. A basic setup uses these commands:

npm install -g @gnt-ai/cli
gnt login
gnt connect github
gnt prebrain

The repository must contain rules before gnt prebrain can scan useful material; gnt init creates example files when needed. The CLI stores credentials and local configuration under ~/.gnt by default. GNT_API_URL changes the API endpoint, GNT_WEB_URL changes the web address used during browser login, and GNT_CONFIG_DIR changes the local configuration directory.

A Docker demo is also available through ./demo.sh. It builds a local Compose stack, seeds a refund rule, and calls check_action. Without an Anthropic key, the demo exercises the fail-closed path and returns needs_human.

Tools and capabilities

The gnt MCP server provides these tools:

• check_action: Evaluate a described action against approved rules and return a verdict, reason, and cited rules.
• search_rules: Perform semantic search across approved organizational rules, with optional tag filtering.
• get_rule: Retrieve one approved rule and its provenance.
• list_skill_packs: List compiled skill-pack versions for an organization, newest first.
• get_skill_pack: Retrieve a compiled skill pack's manifest and file list.

The CLI also supports rule linting, status checks, gap discovery, rule review, and skill-pack synchronization. Local linting validates rule frontmatter before review, and the repository includes a GitHub Action that can run the same check in a rules repository's pull requests.

Limitations and notes

The hosted setup uses gnt's API and database, while rules also remain in the connected GitHub repository. Cloud extraction sends source text directly to Anthropic, or to Vercel AI Gateway when configured; it does not send that raw source text to gnt's own servers. Local extraction can use Ollama through gnt prebrain --mode local, while extracted rule candidates are still sent to gnt's API to open the pull request.

Self-hosting has an authentication limitation: gnt login depends on a browser page from the hosted web app, and the repository does not provide a CLI-only or manual key setup flow. A self-hosted deployment therefore needs a frontend for that login route. The self-hosted API only sends error data to Sentry when SENTRY_DSN is explicitly configured.