Trust Gate MCP

Post-quantum, tamper-evident receipts for consequential agent actions, as an MCP server.

Seven tools, one shared signing primitive: the open-source OpenAgentOntology mint_receipt.

What actually gets signed depends on what you install -- OAO detects its backend at import time, so this is worth stating plainly rather than advertising the best case:

Install Legs Notes
pip install trust-gate-mcp Ed25519 + ML-DSA-65 (FIPS 204) Default. Pure Python (dilithium-py), no native toolchain. Satisfies PQ-required mode.
pip install "trust-gate-mcp[slh]" Ed25519 + ML-DSA-65 + SLH-DSA (FIPS 205) Adds the hash-based diversity leg via liboqs, which survives a lattice break. Native dependency.

PQ-required verify (the default) demands at least one verified post-quantum leg, so the dual-leg default is a real post-quantum posture, not a downgrade -- but only the [slh] install gives you the hash-based third leg.

Tool What it does
mint_receipt_for_record_change Mints a post-quantum receipt for a CRM record change. Works with any CRM (open-core Relaticle, hosted CRMs via their own MCP, custom). Old/new values are SHA-256 hashes.
audit_my_agent_inventory Ranks a CALLER-PROVIDED list of MCP tools by worst-regret if they act. Read-only. Cannot auto-discover other servers -- MCP protocol does not allow that.
mint_action_receipt Post-quantum receipt for any consequential agent action.
verify_receipt Verify a receipt from the certificate alone -- offline, no DB. Defaults to PQ-required mode.
gate_decision Two-phase decision gate. PREVIEW returns risk assessment + preview_id without acting. COMMIT verifies inputs match and mints a tamper-evident receipt with execution permit.
check_egress Egress classification. Scans data for sensitivity markers and classifies as PUBLIC / INTERNAL / CONFIDENTIAL / RESTRICTED. Blocks RESTRICTED. Returns classification + retention info + receipt.
run_exit_drill Vendor exit readiness drill. Checks local signing key, local model access (Ollama), and local data export. Returns step-by-step results + receipt. Informational, no side effects.

Quantum Hardening (pol.must_do.150 reference implementation)

  • H1 key persistence + bootstrap with FAIL-CLOSED kid-drift check
  • H2 per-IP token-bucket rate limit (DoS-hardened: FIFO eviction + body cap)
  • H3 PQ-required verify (defeats signature-stripping downgrade attacks)
  • H4 128-bit kid on every minted receipt (offline same-notary check)
  • Optional bearer-auth toggle + narrowed CORS via TRUST_GATE_BEARER_TOKEN + TRUST_GATE_ALLOWED_ORIGINS
  • 33/33 tests including adversarial PQ-strip + IP-rotation attack simulations

See PUBLISH.md for the full hardening status table.

Install (stdio)

pip install trust-gate-mcp
trust-gate-mcp

Add [slh] for the hash-based third leg. From a checkout, pip install -e ".[dev]" then python -m trust_gate_mcp.

Container deploy (Smithery / any container host)

docker build -t trust-gate-mcp .
docker run -p 8081:8081 -v trust-gate-data:/data/oao trust-gate-mcp

The volume mount on /data/oao is required for production -- without it the signing key rotates per restart and breaks long-running verification chains. The persistent key_metadata.json holds the notary's kid; the bootstrap step refuses to start if it drifts.

License

Apache-2.0. Built on the open-source OpenAgentOntology primitive.

Project links

Data verified by PyPI on Jul 29, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Latest release

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for spectre2k26 from gravatar.com spectre2k26

GitHub Statistics

Data verified by PyPI on Jul 29, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

Apache-2.0
View SPDX License List

Requires

Python >=3.10

Provides Extra

dev slh

Tags

ai-safety decision-trust ed25519 fips-204 fips-205 mcp ml-dsa post-quantum slh-dsa trust trustatom

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

trust_gate_mcp-0.2.1.tar.gz (52.4 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

trust_gate_mcp-0.2.1-py3-none-any.whl (32.9 kB view details)

Uploaded Python 3

File details

Details for the file trust_gate_mcp-0.2.1.tar.gz.

File metadata

  • Download URL: trust_gate_mcp-0.2.1.tar.gz
  • Upload date:
  • Size: 52.4 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.13

File hashes

Hashes for trust_gate_mcp-0.2.1.tar.gz
Algorithm Hash digest
SHA256 8fc2ff32cc0fb5f12f55f53282abaf4b4a4ec4e46a2a091315cf8dff5aa29fb4
MD5 948ca2a4c90507eb6a11972dc930544c
BLAKE2b-256 8c631cbfb4983bfbce16ffcaac92d59f50fef9623c056e5ae9c2f252a9ce361a

See more details on using hashes here.

Provenance

The following attestation bundles were made for trust_gate_mcp-0.2.1.tar.gz:

Publisher: publish-pypi.yml on CWNApps/trust-gate-mcp

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file trust_gate_mcp-0.2.1-py3-none-any.whl.

File metadata

  • Download URL: trust_gate_mcp-0.2.1-py3-none-any.whl
  • Upload date:
  • Size: 32.9 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.13

File hashes

Hashes for trust_gate_mcp-0.2.1-py3-none-any.whl
Algorithm Hash digest
SHA256 ff8601a674c1068031c1caa2f5a405abbc0b7725c62a90273301352f457c1d7d
MD5 a69545bdc9e0dd2c8410b8bf50e278a9
BLAKE2b-256 e5e563ea66ba54df047dfcd1c71a163e93933f5f1cd89f2245310f737e4ea742

See more details on using hashes here.

Provenance

The following attestation bundles were made for trust_gate_mcp-0.2.1-py3-none-any.whl:

Publisher: publish-pypi.yml on CWNApps/trust-gate-mcp

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page