Policy Gate

What policy-gate does

The policy-gate MCP server evaluates an action request before the action is carried out. A request can include an action name, actor information, and parameters. The engine compares that request with an ordered policy and returns a verdict with a decision, tier, and matching rule when applicable.

The available decisions are allow, require_approval, and deny. The default tier model allows read-only operations and reversible writes, routes hard-to-reverse actions for human approval, and rejects operations forbidden to agents. Rules can match patterns such as payments.* or **.delete, and can inspect typed values such as payment amounts or whether prior contact exists.

Rules use first-match-wins evaluation, while unmatched actions are denied. The supplied examples place production deletion, payments above $50, and credential exposure in the deny category. Opaque vault operations and approved connector invocation are shown as lower-risk examples in the policy model.

How it works

The core function is deterministic: the same policy, request, and ledger produce the same result. No language model is placed in the evaluation path, so decisions can be replayed and audited without model variability.

For policies involving cumulative exposure, the ledger is an explicit input. Committed and in-flight intended amounts are both considered. If a policy requires cumulative state and no ledger is supplied, evaluation fails closed with a denial and ledger_required: true. An unknown amount also causes denial, even when the remaining cap appears sufficient. The engine reads this state but does not reconcile pending intents; the caller must check the target system and provide the updated ledger.

Setup and configuration

The repository requires Node.js 18 or newer and has no dependencies. Run node test.js to execute the included verdict and engine checks, or start the local HTTP service with node server.js; the example service listens on port 8402. The engine can also be embedded with require('./policy-engine.js') and called directly with a policy and request.

The policy is supplied in the request or selected by policy_id. The local API accepts JSON at POST /v1/check. The hosted deployment is available at https://policy-gate.3labsio.workers.dev; its check endpoint is paid, while example verdicts and built-in policy details are available through free read endpoints. No environment variables are documented as required.

Tools and capabilities

• Evaluate a request against a supplied policy or policy identifier with POST /v1/check.
• Match action names with glob patterns and inspect typed parameter conditions.
• Apply tier-based defaults for reads, writes, approval-required operations, and prohibited actions.
• Enforce cumulative limits using committed, intended, and unknown ledger fields.
• Inspect live examples with GET /v1/example and built-in policies with GET /v1/policies.
• Check service liveness with GET /healthz.

Limitations and notes

The policy-gate MCP server does not execute the approved action; it returns a decision for the caller to enforce. Ledger state must live outside the agent, and the agent should not control its own committed records. Reconciliation of unresolved intents is outside the engine, and automatic time-based expiry is not implemented by the described design.

The hosted check API charges $0.005 per evaluation according to the README. The repository also documents a paid sponsorship endpoint, but that endpoint is separate from policy evaluation. No client-specific MCP setup or named desktop client is documented in the supplied material.