{
  "markdown": "# Agent Action Gate\n\nGate/Prove runtime for **agent and MCP tool calls**.\n\nNormalize tool intent → deny unknown → **never treat model confidence as approval** → HITL prove on destructive / provision / decommission → Action Ledger (hash chain).\n\nExtracted from GRC_Claw `@grc-claw/agent-policy-firewall`. This repo is the sharp foundry slice: one command, no cathedral.\n\n<!-- mcp-name: io.github.AAH20/agent-action-gate -->\n\n**Commercial (how this is sold):** [$499 Instant Audit](https://a2zsoc.com/productized-services#instant-audit-tripwire) and [consultation](https://a2zsoc.com/consultation) on [a2zsoc.com](https://a2zsoc.com).\n\n## Why this exists (revenue + cost)\n\nAI-agent companies do not pay for “another MCP.” They pay to **stop unattended destructive tools** and to **prove Gate/Prove gaps** before SOC 2 Type I, PE diligence, or insurance renewal.\n\n| Cost driver | What this gate does | Buyer outcome |\n|---|---|---|\n| Ungated `shell.exec` / disable-control / decommission | DENY unless HITL prove token + `approved` | Avoid production blast |\n| Agent “95% sure” | `never_equate_intent_to_approval: true` | Intent ≠ ledger proof |\n| Write tools fire on first thought | Default **SIMULATE** (no side effects) | FDE minutes, not incident cost |\n| No audit trail | Append-only Action Ledger with hash chain | Diligence packet |\n\nHard rule: **never equate agent intent or model score to human approval.**\n\nIllustrative cost sketch (not a quote): `make bench`.\n\n## Quick start\n\n```bash\nmake demo\n```\n\n```bash\nPYTHONPATH=. python3 -m aag demo\nPYTHONPATH=. python3 -m aag check fixtures/t1059_unattended_shell.json\nPYTHONPATH=. python3 -m aag bench\n```\n\nUnattended high-tier calls **DENY** even at 0.99 confidence. ALLOW needs `AAG_PROVE_TOKEN` (or `--prove-token`) **and** `approved: true`.\n\n```bash\nexport AAG_PROVE_TOKEN='replace-me'\nPYTHONPATH=. python3 -m aag check fixtures/proved_decommission.json --prove-token \"$AAG_PROVE_TOKEN\"\n```\n\nKill-switch: `AAG_KILL_SWITCH=1` or touch `artifacts/KILL`.\n\n## MCP stdio server\n\nThis process **never executes** tools. Clients call `gate_check` before they would invoke a destructive tool.\n\n```bash\nPYTHONPATH=. python3 -m aag serve\n```\n\nCursor / Claude example (`mcpServers`):\n\n```json\n{\n  \"agent-action-gate\": {\n    \"command\": \"python3\",\n    \"args\": [\"-m\", \"aag\", \"serve\"],\n    \"cwd\": \"/path/to/agent-action-gate\",\n    \"env\": { \"PYTHONPATH\": \".\", \"AAG_PROVE_TOKEN\": \"replace-me\" }\n  }\n}\n```\n\nDocker / registry image:\n\n```bash\ndocker run --rm -i ghcr.io/aah20/agent-action-gate:0.2.0\n```\n\nOfficial MCP Registry name: `io.github.AAH20/agent-action-gate`\n\n## Envelope\n\nEvery decision includes:\n\n- `never_equate_intent_to_approval: true`\n- `allow_auto_execute` (false on unattended high tiers)\n- `mode`: `deny` | `simulate` | `allow`\n- `ledger_id` / `receipt_hash`\n- CTAs: Instant Audit + consultation\n\n## Library mapper\n\nSame Gate/Prove policy from Python without the stdio loop:\n\n```python\nfrom aag.gate import AgentActionGate\nfrom aag.mcp import evaluate_mcp_call\n\ngate = AgentActionGate(prove_token=\"replace-me\")\nevaluate_mcp_call(gate, {\"params\": {\"name\": \"shell.exec\", \"arguments\": {\"note\": \"no payload\"}}})\n```\n\n## Fixtures (labeled, not payloads)\n\n| File | Technique | Expected |\n|---|---|---|\n| `t1059_unattended_shell.json` | T1059 | DENY unattended destructive |\n| `t1078_read_identity.json` | T1078 | ALLOW read |\n| `t1562_impair_defenses.json` | T1562 | DENY unattended destructive |\n| `write_ticket_simulate.json` | — | SIMULATE write |\n| `proved_decommission.json` | T1578 | ALLOW only with HITL token |\n\n## Layout\n\n```text\naag/\n  gate.py      HITL + kill-switch + unknown deny\n  ledger.py    hash-chained JSONL\n  server.py    MCP stdio (gate_check, ledger_verify)\n  mcp.py       MCP tools/call mapper (no execution)\n  cost.py      illustrative avoidance sketch\n  demo.py      fixture runner\nfixtures/      ATT&CK-tagged cases\nserver.json    MCP Registry metadata\ntests/         Gate/Prove + MCP contract\n```\n\n## Paid evaluation (not free prove)\n\nIf you deploy agents or MCP servers and need a Gate/Prove read before SOC 2, PE diligence, or insurance:\n\n→ **[$499 Instant Audit](https://a2zsoc.com/productized-services#instant-audit-tripwire)**  \n→ **[consultation](https://a2zsoc.com/consultation)** (sprint / vCISO)\n\nUnpaid take-homes: refuse — run `make demo` and buy Instant Audit.\n\n## License\n\nMIT\n",
  "bytes": 4365,
  "sha": "f3e47e341ffcbdc851bf0efc1f2cb1f8e29757404d6b64d1972fb2d277d92936",
  "repo_slug": "aah20/agent-action-gate",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_aah20_agent_action_gate_30ecc817/readme"
}