{
  "markdown": "# Trust Gate MCP\n\nPost-quantum, tamper-evident receipts for consequential agent actions, as an MCP server.\n\nSeven tools, one shared signing primitive: the open-source [OpenAgentOntology](https://github.com/CWNApps/openagentontology) `mint_receipt`.\n\n**What actually gets signed depends on what you install** -- OAO detects its backend at import time, so this is worth stating plainly rather than advertising the best case:\n\n| Install | Legs | Notes |\n|---|---|---|\n| `pip install trust-gate-mcp` | Ed25519 + ML-DSA-65 (FIPS 204) | Default. Pure Python (`dilithium-py`), no native toolchain. Satisfies PQ-required mode. |\n| `pip install \"trust-gate-mcp[slh]\"` | Ed25519 + ML-DSA-65 + SLH-DSA (FIPS 205) | Adds the hash-based diversity leg via `liboqs`, which survives a lattice break. Native dependency. |\n\nPQ-required verify (the default) demands **at least one** verified post-quantum leg, so the\ndual-leg default is a real post-quantum posture, not a downgrade -- but only the `[slh]` install\ngives you the hash-based third leg.\n\n| Tool | What it does |\n|---|---|\n| `mint_receipt_for_record_change` | Mints a post-quantum receipt for a CRM record change. Works with any CRM (open-core Relaticle, hosted CRMs via their own MCP, custom). Old/new values are SHA-256 hashes. |\n| `audit_my_agent_inventory` | Ranks a CALLER-PROVIDED list of MCP tools by worst-regret if they act. **Read-only.** Cannot auto-discover other servers -- MCP protocol does not allow that. |\n| `mint_action_receipt` | Post-quantum receipt for any consequential agent action. |\n| `verify_receipt` | Verify a receipt from the certificate alone -- offline, no DB. Defaults to PQ-required mode. |\n| `gate_decision` | Two-phase decision gate. PREVIEW returns risk assessment + preview_id without acting. COMMIT verifies inputs match and mints a tamper-evident receipt with execution permit. |\n| `check_egress` | Egress classification. Scans data for sensitivity markers and classifies as PUBLIC / INTERNAL / CONFIDENTIAL / RESTRICTED. Blocks RESTRICTED. Returns classification + retention info + receipt. |\n| `run_exit_drill` | Vendor exit readiness drill. Checks local signing key, local model access (Ollama), and local data export. Returns step-by-step results + receipt. Informational, no side effects. |\n\n## Quantum Hardening (pol.must_do.150 reference implementation)\n\n* **H1** key persistence + bootstrap with FAIL-CLOSED kid-drift check\n* **H2** per-IP token-bucket rate limit (DoS-hardened: FIFO eviction + body cap)\n* **H3** PQ-required verify (defeats signature-stripping downgrade attacks)\n* **H4** 128-bit `kid` on every minted receipt (offline same-notary check)\n* Optional bearer-auth toggle + narrowed CORS via `TRUST_GATE_BEARER_TOKEN` + `TRUST_GATE_ALLOWED_ORIGINS`\n* 33/33 tests including adversarial PQ-strip + IP-rotation attack simulations\n\nSee [PUBLISH.md](./PUBLISH.md) for the full hardening status table.\n\n## Install (stdio)\n\n```bash\npip install trust-gate-mcp\ntrust-gate-mcp\n```\n\nAdd `[slh]` for the hash-based third leg. From a checkout, `pip install -e \".[dev]\"` then\n`python -m trust_gate_mcp`.\n\n## Container deploy (Smithery / any container host)\n\n```bash\ndocker build -t trust-gate-mcp .\ndocker run -p 8081:8081 -v trust-gate-data:/data/oao trust-gate-mcp\n```\n\nThe volume mount on `/data/oao` is **required for production** -- without it the signing key rotates per restart and breaks long-running verification chains. The persistent `key_metadata.json` holds the notary's `kid`; the bootstrap step refuses to start if it drifts.\n\n## License\n\nApache-2.0. Built on the open-source [OpenAgentOntology](https://github.com/CWNApps/openagentontology) primitive.\n",
  "bytes": 3658,
  "sha": "18c3b54e2434a3b4acbe4fc294562437ed0865f4caf55137a13e06d01f3405a3",
  "repo_slug": "cwnapps/trust-gate-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_cwnapps_trust_gate_mcp_9d6c8dd0/readme"
}