agent-gate is an MCP server that enforces a deterministic gate before an AI agent can claim a task done, using fail-closed checklists and a tamper-evident hash-chained receipt ledger.
Get the gate checklist (gate_checklist): Retrieve the checks an agent must satisfy before claiming a task complete. The default ship gate requires: deterministic_checks_pass, independent_refute_review, no_secrets, human_gated_if_irreversible, and honest_receipt_logged.
Verify evidence against a gate (verify_gate): Submit evidence (a map of check IDs to values) evaluated fail-closed — a check passes only if its value is exactly true; anything missing or non-true blocks. Returns {passed: bool, blocking: [check_ids]}.
Record a tamper-evident receipt (record_receipt): Append a hash-chained receipt to the ledger with fields for decision, metric, value, and verdict (e.g., kept, killed, shipped, blocked). Each receipt is SHA-256 linked to the previous one, making the log tamper-evident.
Read and verify receipts (read_receipts): Retrieve all stored receipts and verify hash chain integrity — any tampering or deletion will cause the integrity check to return false.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@agent-gate verify my latest changes pass the ship gate"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
An MCP server that lets an AI agent gate its own work before it claims "done": deterministic checks, then an independent refute-first review, then a tamper-evident honest receipt.
Agents that grade their own homework ship low-quality output. agent-gate turns that discipline into tools an agent must actually pass: a fail-closed checklist and an append-only, hash-chained receipts ledger. It is Fleet Mode, an agent-orchestration doctrine, made into a runnable tool. Receipts over hype, enforced by the data structures.
🧩 One layer of a five-repo cost-governance stack for operating AI agents cost-efficiently; bow is the flagship that runs every layer in production.
agent: "done!" -> verify_gate(evidence) -> { passed: false, blocking: ["independent_refute_review", "no_secrets"] }
The expensive failures in agent systems are the silent ones: a model update degrades output, a change quietly breaks a workflow, an agent declares success while the work is wrong. The fix is not a smarter model. It is a gate the agent cannot talk its way past:
Fail-closed. A check counts as satisfied only if it is explicitly true. Missing proof is not proof. (Mirrors a promotion gate, not an informal check.)
Tamper-evident receipts. Every decision is recorded as (decision, metric, value, verdict) linked into a sha256 chain. Edit or delete any past receipt and verify_chain() returns false. The honest log is enforced by the structure, not by good intentions.
Human-gated by default. "Any irreversible/outward act got human approval" is a required check. Agents draft, humans approve.
Related MCP server: QuantaOptima
Tool | What it does |
| Returns the checklist the agent must satisfy before claiming done. |
| Evaluates evidence fail-closed and returns |
| Appends an honest, hash-chained receipt; returns it. |
| Returns every receipt plus whether the chain is intact. |
The default ship gate encodes Fleet Mode: deterministic_checks_pass, independent_refute_review, no_secrets, human_gated_if_irreversible, honest_receipt_logged.
pip install mcp-agent-gate # or: pip install -e . (from source)Add it to your MCP client (Claude Desktop / Claude Code) config:
{
"mcpServers": {
"agent-gate": { "command": "python", "args": ["-m", "agent_gate.server"] }
}
}Now your agent can call verify_gate(...) before it tells you it is finished, and you get a tamper-evident trail of what it decided. Receipts persist to ~/.agent-gate/receipts.jsonl (override with AGENT_GATE_LEDGER).
from agent_gate.gate import DEFAULT_SHIP_GATE
from agent_gate.ledger import Ledger
res = DEFAULT_SHIP_GATE.evaluate({
"deterministic_checks_pass": True,
"independent_refute_review": True,
"no_secrets": True,
"human_gated_if_irreversible": True,
# honest_receipt_logged missing -> fail-closed
})
print(res.passed, res.blocking) # False ['honest_receipt_logged']
led = Ledger("receipts.jsonl")
led.append(decision="ship v0.1", metric="tests", value="pass", verdict="shipped")
print(led.verify_chain()) # True (until someone edits the log)Tested, stdlib-only core. agent_gate/gate.py (fail-closed checklist) and agent_gate/ledger.py (hash-chained receipts) are pure stdlib: fast to read, fast to trust. agent_gate/server.py is a thin MCP adapter over them (the one runtime dependency: mcp).
Tests pass on Python 3.11-3.13 (see CI). The MCP tools are tested by calling them, not just importing.
pip install -e ".[dev]" && python -m pytest -qRun it yourself: PYTHONPATH=. python3 examples/demo.py
------------------------------------------------------------
1. Agent claims done — but two checks are missing
------------------------------------------------------------
{
"passed": false,
"blocking": [
"human_gated_if_irreversible",
"honest_receipt_logged"
]
}
------------------------------------------------------------
2. Agent satisfies all five checks
------------------------------------------------------------
{
"passed": true,
"blocking": []
}
------------------------------------------------------------
3. Record a hash-chained receipt
------------------------------------------------------------
{
"seq": 1,
"decision": "ship v0.1",
"verdict": "shipped",
"hash": "015202a168512f15..."
}
{
"seq": 2,
"decision": "deploy",
"verdict": "approved",
"hash": "9533d304d4dd07e5..."
}
------------------------------------------------------------
4. Verify the chain — edit receipts.jsonl to see this flip to False
------------------------------------------------------------
chain_intact: Trueagent-gate is about not shipping unverified work, so the repository holds itself to the same bar:
Coverage-gated test matrix — ci.yml runs pytest on Python 3.11–3.13 and fails the build if line coverage drops below the threshold (currently 97% covered).
CodeQL — static analysis (security-extended) runs on every push, PR, and weekly; findings surface in the Security tab.
Pinned supply chain — every GitHub Action is pinned to a full commit SHA; Dependabot keeps those pins and the Python deps current.
Branch protection — main requires the CI and CodeQL checks to pass before a merge.
Disclosure policy — see SECURITY.md.
See CONTRIBUTING.md.
Built by Jeff Otterson (Jott2121). agent-gate operationalizes the gating discipline from bow (an autonomous all-Claude chief-of-staff agent) and the Fleet Mode doctrine. Siblings in the same line: rag-guard and agent-cost-attribution. MIT licensed.
sabot is the measurement side of this idea. agent-gate adds a fail-closed gate to an agent workflow; sabot plants controlled faults inside running LangGraph, CrewAI and AutoGen pipelines and measures whether gates and reviewer stages like these actually fire. Median own-check detection across three production frameworks: 16.7%, with a pre-registered spec, an Apache-2.0 harness, and every raw trace published.
Return the checklist an agent must satisfy before it may claim a task done.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | ship |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry full behavioral disclosure. Only implies a read operation ('return'), but no mention of side effects, authentication, or idempotency. Minimal transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, very concise, but at the cost of missing critical information. Could be improved by adding parameter and usage context while remaining brief.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, one undocumented parameter. Description does not explain return format, checklist content, or affect of the 'name' parameter. Incomplete for agent use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter 'name' is not explained in the description. Schema coverage is 0%, so the description should compensate but does not. Agent cannot know what 'name' means or how to use it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool returns a checklist for a task completion gate. It is specific about the resource and action, and the context from sibling names suggests differentiation from receipts and verification tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like verify_gate or read_receipts. No context about preconditions or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Return every receipt plus whether the hash chain is intact (tamper-evident).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description carries the burden. It discloses it returns all receipts and integrity status but does not mention side effects, permissions, pagination, or cost, leaving gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One concise sentence with key information upfront; no unnecessary words or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters, output schema, or annotations, the description is minimally adequate but lacks details on scope, output format, or potential limitations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With zero parameters and 100% schema coverage, the description adds value by explaining what the tool returns (receipts and hash chain integrity), beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states it returns every receipt plus a tamper-evident check, clearly distinguishing it from siblings like gate_checklist (different resource) and record_receipt (write operation).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives; lacks context about prerequisites, when to avoid, or specific use cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Append an honest, hash-chained receipt to the ledger and return it. verdict is typically one of: kept, killed, shipped, blocked.
| Name | Required | Description | Default |
|---|---|---|---|
| decision | Yes | ||
| metric | Yes | ||
| value | Yes | ||
| verdict | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description mentions that the receipt is 'honest, hash-chained' (implying immutability) and that it returns the receipt. However, it fails to disclose side effects (e.g., appending is additive, not destructive) or any required permissions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description consists of two short sentences that front-load the main action and include an example. It is efficient but could benefit from additional context without being verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given four required parameters, no output schema, and no annotations, the description is too brief. It does not explain the return format, error handling, or what the hash chain implies operationally, leaving significant gaps for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description only explains the 'verdict' parameter with typical values. The other three parameters (decision, metric, value) are left undefined, so agents cannot determine their meaning or format.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action: 'Append an honest, hash-chained receipt to the ledger and return it.' It also gives examples of typical verdict values. However, it does not explicitly differentiate from sibling tools like read_receipts or gate_checklist.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention prerequisites or scenarios where this tool is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Evaluate evidence against a gate. FAIL-CLOSED: a check is satisfied only if its value is exactly true; anything missing or non-true blocks. Returns {"passed": bool, "blocking": [check_ids]}.
| Name | Required | Description | Default |
|---|---|---|---|
| evidence | Yes | ||
| name | No | ship |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses exact logic (only true passes, fail-closed) and return format. Since no annotations are provided, the description adequately covers behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with main action and return format. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite no annotations and no output schema, the description is minimal. Lacks parameter details and context on how 'evidence' relates to gates or siblings like gate_checklist.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description adds no meaning about parameters. Does not explain 'evidence' structure or 'name' usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the verb 'evaluate' and resource 'evidence against a gate', with additional detail on fail-closed behavior. However, it does not explicitly distinguish between sibling tools like gate_checklist.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Describes core behavior (fail-closed) and return format, indicating strict truthiness check. But no guidance on when not to use or alternatives among siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v0.1.0gate_checklistread_receiptsrecord_receiptverify_gateEach tool targets a distinct aspect of gatekeeping: checklist retrieval, receipt reading, receipt recording, and gate verification. No overlap in purpose.
Names mix patterns: 'gate_checklist' is a noun phrase, while 'read_receipts', 'record_receipt', and 'verify_gate' are verb_noun. The 'gate' prefix is used inconsistently.
Four tools is a reasonable number for a focused gatekeeping server, neither too few nor too many.
Core operations are covered, but missing tools to create or modify gates and checklists limits full lifecycle support.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Control plane for autonomous software labor. Agents claim objectives over MCP with audit trail.
Remote MCP for A2A failure replay MCP, structured receipts, audit logs, and reviewer-ready evidence.
MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
The vetted, cross-LLM marketplace of doer agents — itself an MCP server.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/Jott2121/agent-gate'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
