{
  "markdown": "# agenticrail-mcp\n\nA **Model Context Protocol** server that exposes the live [AgenticRail](https://agenticrail.nz) enforcement gate to any MCP client as two tools.\n\nAgenticRail is a deterministic enforcement layer for AI agents: it holds an agent to its declared step order, refuses replays and skipped steps, and seals each completed sequence with a signed receipt. This server is the MCP adapter in front of it.\n\n**Endpoint:** `https://mcp.agenticrail.nz/` (Streamable HTTP, stateless)\n**Protocol:** `2026-07-28` — the revision that retired the `initialize` exchange and `Mcp-Session-Id`. This server was built stateless with neither, so it needed no migration. `initialize` is still answered for older clients.\n**Registry:** `nz.agenticrail/gate` on the [official MCP registry](https://registry.modelcontextprotocol.io/v0/servers?search=agenticrail)\n\n## Tools\n\n| Tool | What it does | Calls |\n|------|--------------|-------|\n| `evaluate_step` | ALLOW/DENY a single agent step **before** it runs; seals a signed receipt | `POST https://api.agenticrail.nz/v1/evaluate` |\n| `verify_receipt` | Fetch a sequence's verification report; confirm the receipt chain is intact | `POST https://report.agenticrail.nz/report` |\n\nCall `evaluate_step` before running each step of a sequence, and do not run a step the gate DENYs.\n\n### A DENY tells you how to fix it\n\nEvery refusal carries its own remedy in the response envelope — unsigned, DENY-only, because it describes the sequence's state now rather than the decision that was made:\n\n| refusal | what comes back |\n|---|---|\n| `ACTION_NOT_ALLOWED` | `allowed_action_types` — exactly what this step would have accepted |\n| `SEQUENCE_VIOLATION` | `next_expected_step` — the step the sequence is waiting for |\n| `STEP_ORDER_MISMATCH` | `locked_step_order` — the order this sequence was locked to on its first call |\n| `UNKNOWN_STEP` | `expected_step_order` + `step_order_source` (`caller` or `msmd_spine`) |\n\n`action_type` is an **enum of eight values**, and each step accepts only a subset — a compliant client cannot construct an invalid one. **`step_order` is locked on the first call and needs at least one entry**; omitting it selects the built-in MSMD spine rather than clearing the lock, so to change the plan, start a new `sequence_id`.\n\n## Connect\n\n```bash\n# zero config — uses the public demo key\nclaude mcp add --transport http agenticrail https://mcp.agenticrail.nz/\n\n# with your own key\nclaude mcp add --transport http agenticrail https://mcp.agenticrail.nz/ \\\n  --header \"Authorization: Bearer <your-agenticrail-key>\"\n```\n\nAny Streamable-HTTP MCP client works — point it at the URL.\n\n## Try it without installing anything\n\n```bash\nBASE=https://mcp.agenticrail.nz/\n\ncurl -s -X POST \"$BASE\" -H 'content-type: application/json' \\\n  -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/list\"}' | jq .\n\n# ⚠️ Use a sequence_id nobody else will pick. On the shared demo key the id is\n# GLOBAL and sealing is PERMANENT — a fixed one in an example works once for one\n# person on earth and returns SEALED_SEQUENCE for everyone after.\nSEQ=\"mcp-smoke-$(date +%s)-$RANDOM\"\n\ncurl -s -X POST \"$BASE\" -H 'content-type: application/json' \\\n  -d \"{\\\"jsonrpc\\\":\\\"2.0\\\",\\\"id\\\":2,\\\"method\\\":\\\"tools/call\\\",\\\"params\\\":{\n        \\\"name\\\":\\\"evaluate_step\\\",\n        \\\"arguments\\\":{\\\"sequence_id\\\":\\\"$SEQ\\\",\\\"step\\\":\\\"intake\\\",\n                       \\\"action_type\\\":\\\"CHECK_STATE\\\"}}}\" | jq .\n```\n\nWith no `Authorization` header the public demo key is used and your `sequence_id` comes back rewritten to **`demo-mcp-<your id>`** — `demo-` marks the public lane, `mcp-` marks it as anonymous MCP traffic. **Use the id returned in the response from then on; the one you sent will not resolve.** This is intended, not a leak.\n\n**A `demo-` sequence's report needs no key to read, so treat anything you send on it as public.**\n\n## Design — read before changing\n\n- **Protocol adapter only.** This worker holds **no internal secrets** and has no privileged path to the enforcement core. It calls the same **public API** an external caller uses, so the tool logic is decoupled from AgenticRail's internals *and* from the MCP transport version.\n- **Service bindings, not fetch.** `mcp.agenticrail.nz` is on the same zone as `api.` and `report.`, so a plain `fetch()` would be a same-zone loopback (Cloudflare error 1002). The bindings hit the identical public handlers — they are not an internal bypass.\n- **Stateless Streamable HTTP.** No `Mcp-Session-Id` is issued or required; every POST is self-contained. The transport shell is `handleRpc` + the `fetch` handler — the only part a spec revision touches. The value-bearing calls (`callEvaluate` / `callVerify`) are plain HTTPS and don't change.\n- **`GET /` serves the discovery card; every other GET path 404s.** `POST` is left permissive on purpose so a client that appends a path to the endpoint URL still works.\n- **A 404 on `/.well-known/oauth-*` is correct** — it is how an MCP server says *no auth required*. `agent.json`, `agent-card.json`, `x402` and `ai-plugin.json` are protocols this server does not implement; answering them would be a claim.\n\n## Deploy\n\n```bash\nnpx wrangler deploy\n```\n\n## Links\n\n- Docs — https://agenticrail.nz/docs/\n- Verify a sequence yourself — https://report.agenticrail.nz/report\n- OpenAPI — https://agenticrail.nz/openapi.json\n- Enforcement spec — https://agenticrail.nz/spec/\n\n---\n\nOperated by TUARA KURI LIMITED (NZBN 9429053582867), Hokianga, Aotearoa New Zealand.\n",
  "bytes": 5468,
  "sha": "f269981005acc977b896eaf8d2127731e7adfa3cc9ab7218bf3542f2a8f7a78b",
  "repo_slug": "msmd-rua/agenticrail-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_nz_agenticrail_gate_10338c8a/readme"
}