Agent Action Gate MCP server

Agent Action Gate

Gate/Prove runtime for agent and MCP tool calls.

Normalize tool intent → deny unknown → never treat model confidence as approval → HITL prove on destructive / provision / decommission → Action Ledger (hash chain).

Extracted from GRC_Claw @grc-claw/agent-policy-firewall. This repo is the sharp foundry slice: one command, no cathedral.

<!-- mcp-name: io.github.AAH20/agent-action-gate -->

Commercial (how this is sold): $499 Instant Audit and consultation on a2zsoc.com.

Why this exists (revenue + cost)

AI-agent companies do not pay for “another MCP.” They pay to stop unattended destructive tools and to prove Gate/Prove gaps before SOC 2 Type I, PE diligence, or insurance renewal.

Hard rule: never equate agent intent or model score to human approval.

Illustrative cost sketch (not a quote): make bench.

Quick start

make demo

PYTHONPATH=. python3 -m aag demo
PYTHONPATH=. python3 -m aag check fixtures/t1059_unattended_shell.json
PYTHONPATH=. python3 -m aag bench

Unattended high-tier calls DENY even at 0.99 confidence. ALLOW needs AAGPROVETOKEN (or --prove-token) and approved: true.

export AAG_PROVE_TOKEN='replace-me'
PYTHONPATH=. python3 -m aag check fixtures/proved_decommission.json --prove-token "$AAG_PROVE_TOKEN"

Kill-switch: AAGKILLSWITCH=1 or touch artifacts/KILL.

MCP stdio server

This process never executes tools. Clients call gate_check before they would invoke a destructive tool.

PYTHONPATH=. python3 -m aag serve

Cursor / Claude example (mcpServers):

{
  "agent-action-gate": {
    "command": "python3",
    "args": ["-m", "aag", "serve"],
    "cwd": "/path/to/agent-action-gate",
    "env": { "PYTHONPATH": ".", "AAG_PROVE_TOKEN": "replace-me" }
  }
}

Docker / registry image:

docker run --rm -i ghcr.io/aah20/agent-action-gate:0.2.0

Official MCP Registry name: io.github.AAH20/agent-action-gate

Envelope

Every decision includes:

• neverequateintenttoapproval: true
• allowautoexecute (false on unattended high tiers)
• mode: deny | simulate | allow
• ledgerid / receipthash
• CTAs: Instant Audit + consultation

Library mapper

Same Gate/Prove policy from Python without the stdio loop:

from aag.gate import AgentActionGate
from aag.mcp import evaluate_mcp_call

gate = AgentActionGate(prove_token="replace-me")
evaluate_mcp_call(gate, {"params": {"name": "shell.exec", "arguments": {"note": "no payload"}}})

Fixtures (labeled, not payloads)

Layout

aag/
  gate.py      HITL + kill-switch + unknown deny
  ledger.py    hash-chained JSONL
  server.py    MCP stdio (gate_check, ledger_verify)
  mcp.py       MCP tools/call mapper (no execution)
  cost.py      illustrative avoidance sketch
  demo.py      fixture runner
fixtures/      ATT&CK-tagged cases
server.json    MCP Registry metadata
tests/         Gate/Prove + MCP contract

Shortened. The full README is on GitHub.