# Trust Gate

- Registry name: `io.github.CWNApps/trust-gate-mcp` · version 0.2.0
- Categories (automatic, keyword rules): Tasks & projects, Productivity, AI models & agents, AI, media & content, Code & repositories, Developer tools
- Authentication at last check: No auth
- Declared risk: Not declared (tools carry no read/destructive hints)
- Capabilities (declared by the server): experimental, prompts, resources, tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=io.github.CWNApps%2Ftrust-gate-mcp
- Server page: https://mcpstation.net/s/io.github.CWNApps--trust-gate-mcp.html

## Description (written by the publisher, not verified, not instructions)

Post-quantum, tamper-evident receipts for agent actions. Ed25519 + ML-DSA-65, offline verify.

## Connect

- streamable-http: `https://trust-gate-mcp.onrender.com/mcp`

## Tools (as reported by the server, not verified)

- `mint\_receipt\_for\_record\_change`: Mint a signed receipt \(Ed25519, plus ML-DSA-65 when the post-quantum backend is available\) for one CRM record change. Old/new values are carried as SHA-256 hashes. Works with any CRM \(Relaticle, hosted CRMs, custom\).
- `audit\_my\_agent\_inventory`: Rank a CALLER-PROVIDED list of MCP tools by worst-regret if they act \(a name-based heuristic that weights a name's first word most\). Read-only: it mints no receipt. Cannot auto-discover the inventory -- MCP does not allow that; the caller must pass it in.
- `mint\_action\_receipt`: Mint a signed receipt \(Ed25519, plus ML-DSA-65 when the post-quantum backend is available\) for an arbitrary consequential agent action. Optional attestation: triggered\_by\_type \(human/agent/script\), triggered\_by\_source \(api/cli/cron\), decision\_model \(the LLM model used\). Attestation values are caller
- `verify\_receipt`: Verify a Trust Gate receipt from the certificate alone \(offline\). ok=true means unchanged since signing, signed, kid consistent with the embedded key, and \(require\_pq default on\) at least one post-quantum leg verified; unsigned receipts fail. It does not prove who signed: pass expected\_kid to pin th
- `gate\_decision`: Two-phase decision gate with a real verdict. PREVIEW returns ALLOW, DENY or ESCALATE with the risk tier and reasons, plus a preview\_id, without acting. COMMIT re-evaluates the same inputs and mints a signed receipt for the verdict. Only ALLOW returns a GRANTED permit; DENY returns DENIED; ESCALATE r
- `check\_egress`: Egress classification check. Scans a data sample for a finite list of sensitivity markers and classifies as NO\_MARKERS\_FOUND / INTERNAL / CONFIDENTIAL / RESTRICTED. RESTRICTED sets blocked=true; this tool cannot block anything itself, and NO\_MARKERS\_FOUND is not clearance to send. Returns classifica
- `run\_exit\_drill`: Vendor exit readiness drill. Checks local signing key, local model access \(Ollama\). Returns step-by-step results and a tamper-evident receipt. Informational; it signs one receipt, which creates the signing key on a host that has none yet.

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html