Trust Gate

Rank a CALLER-PROVIDED list of MCP tools by worst-regret if they act (a name-based heuristic that weights a name's first word most). Read-only: it mints no receipt. Cannot auto-discover the inventory -- MCP does not allow that; the caller must pass it in.

Egress classification check. Scans a data sample for a finite list of sensitivity markers and classifies as NO_MARKERS_FOUND / INTERNAL / CONFIDENTIAL / RESTRICTED. RESTRICTED sets blocked=true; this tool cannot block anything itself, and NO_MARKERS_FOUND is not clearance to send. Returns classification, retention info, and a tamper-evident receipt.

Status of each proposed retest after a change (current, not current or unbound), from the proposal inputs and results you supply. Read-only view of the records you supply; it writes, signs and executes nothing. Needs TRUST_GATE_API_URL, TRUST_GATE_API_KEY and TRUST_GATE_TENANT_ID to be set, and the tenant comes from that setting, never from an argument. Returns status OK, REFUSED or UNAVAILABLE (a missing setting, a surface that is off, or an error is UNAVAILABLE, never made-up data). The TrustGate API must be a version that serves this view; it returns UNAVAILABLE until then. A mapping or readout is not a compliance finding.

Acceptance-pack export for one or more cases, optionally mapped to one control id and version you name. Read-only view of the records you supply; it writes, signs and executes nothing. Needs TRUST_GATE_API_URL, TRUST_GATE_API_KEY and TRUST_GATE_TENANT_ID to be set, and the tenant comes from that setting, never from an argument. Returns status OK, REFUSED or UNAVAILABLE (a missing setting, a surface that is off, or an error is UNAVAILABLE, never made-up data). The TrustGate API must be a version that serves this view; it returns UNAVAILABLE until then. A mapping or readout is not a compliance finding.

Two-phase decision gate with a real verdict. PREVIEW returns ALLOW, DENY or ESCALATE with the risk tier and reasons, plus a preview_id, without acting. COMMIT re-evaluates the same inputs and mints a signed receipt for the verdict. Only ALLOW returns a GRANTED permit; DENY returns DENIED; ESCALATE returns WITHHELD_PENDING_HUMAN and a human must decide outside this tool. Applies only to actions the caller routes through it: it does not observe or block what an agent does. Verb-tier heuristic on the action name and resource, not a proof. Stateless. Optional attestation: triggered_by_type, triggered_by_source, decision_model.

Evidence view, verdict and open questions for one decision and the facts you supply. Read-only view of the records you supply; it writes, signs and executes nothing. Needs TRUST_GATE_API_URL, TRUST_GATE_API_KEY and TRUST_GATE_TENANT_ID to be set, and the tenant comes from that setting, never from an argument. Returns status OK, REFUSED or UNAVAILABLE (a missing setting, a surface that is off, or an error is UNAVAILABLE, never made-up data). The TrustGate API must be a version that serves this view; it returns UNAVAILABLE until then. A mapping or readout is not a compliance finding.

Evidence for whether an intervention could be shown to have taken effect, from the records you supply. Read-only view of the records you supply; it writes, signs and executes nothing. Needs TRUST_GATE_API_URL, TRUST_GATE_API_KEY and TRUST_GATE_TENANT_ID to be set, and the tenant comes from that setting, never from an argument. Returns status OK, REFUSED or UNAVAILABLE (a missing setting, a surface that is off, or an error is UNAVAILABLE, never made-up data). The TrustGate API must be a version that serves this view; it returns UNAVAILABLE until then. A mapping or readout is not a compliance finding.

Evidence view of one receipt you supply, with what the service could and could not check. Read-only view of the records you supply; it writes, signs and executes nothing. Needs TRUST_GATE_API_URL, TRUST_GATE_API_KEY and TRUST_GATE_TENANT_ID to be set, and the tenant comes from that setting, never from an argument. Returns status OK, REFUSED or UNAVAILABLE (a missing setting, a surface that is off, or an error is UNAVAILABLE, never made-up data). The TrustGate API must be a version that serves this view; it returns UNAVAILABLE until then. A mapping or readout is not a compliance finding.

Readiness report for one oversight case, computed from the records you supply. Read-only view of the records you supply; it writes, signs and executes nothing. Needs TRUST_GATE_API_URL, TRUST_GATE_API_KEY and TRUST_GATE_TENANT_ID to be set, and the tenant comes from that setting, never from an argument. Returns status OK, REFUSED or UNAVAILABLE (a missing setting, a surface that is off, or an error is UNAVAILABLE, never made-up data). The TrustGate API must be a version that serves this view; it returns UNAVAILABLE until then. A mapping or readout is not a compliance finding.

Mint a signed receipt (Ed25519, plus ML-DSA-65 when the post-quantum backend is available) for an arbitrary consequential agent action. Optional attestation: triggered_by_type (human/agent/script), triggered_by_source (api/cli/cron), decision_model (the LLM model used). Attestation values are caller claims: allowlisted to safe characters, signed, not verified. Decisions that contain a gate verdict word are reserved for gate_decision.

Mint a signed receipt (Ed25519, plus ML-DSA-65 when the post-quantum backend is available) for one CRM record change. Old/new values are carried as SHA-256 hashes. Works with any CRM (Relaticle, hosted CRMs, custom).

Impact and a requalification PROPOSAL for a change, over the graph you supply. It never runs a retest. Read-only view of the records you supply; it writes, signs and executes nothing. Needs TRUST_GATE_API_URL, TRUST_GATE_API_KEY and TRUST_GATE_TENANT_ID to be set, and the tenant comes from that setting, never from an argument. Returns status OK, REFUSED or UNAVAILABLE (a missing setting, a surface that is off, or an error is UNAVAILABLE, never made-up data). The TrustGate API must be a version that serves this view; it returns UNAVAILABLE until then. A mapping or readout is not a compliance finding.

Questions routed to a role for one oversight case, from the records and source lookups you supply. It proposes; it never asks anyone. Read-only view of the records you supply; it writes, signs and executes nothing. Needs TRUST_GATE_API_URL, TRUST_GATE_API_KEY and TRUST_GATE_TENANT_ID to be set, and the tenant comes from that setting, never from an argument. Returns status OK, REFUSED or UNAVAILABLE (a missing setting, a surface that is off, or an error is UNAVAILABLE, never made-up data). The TrustGate API must be a version that serves this view; it returns UNAVAILABLE until then. A mapping or readout is not a compliance finding.

Replay of a decision's evidence path over the records you supply. It replays records; it executes nothing. Read-only view of the records you supply; it writes, signs and executes nothing. Needs TRUST_GATE_API_URL, TRUST_GATE_API_KEY and TRUST_GATE_TENANT_ID to be set, and the tenant comes from that setting, never from an argument. Returns status OK, REFUSED or UNAVAILABLE (a missing setting, a surface that is off, or an error is UNAVAILABLE, never made-up data). The TrustGate API must be a version that serves this view; it returns UNAVAILABLE until then. A mapping or readout is not a compliance finding.

Vendor exit readiness drill. Checks local signing key, local model access (Ollama). Returns step-by-step results and a tamper-evident receipt. Informational; it signs one receipt, which creates the signing key on a host that has none yet.

Verify a TrustGate receipt from the certificate alone (offline). ok=true means unchanged since signing, signed, kid consistent with the embedded key, and (require_pq default on) at least one post-quantum leg verified; unsigned receipts fail. It does not prove who signed: pass expected_kid to pin the signer's Ed25519 key; a pin counts only when that key's own signature verifies (see signer_pinned). The post-quantum keys in a receipt are not covered by the kid.