Purpose
agent-gate is an MCP server used to add a fail-closed quality gate and a hash-chained receipt ledger to any AI agent workflow. Its core goal is to solve common but subtle failures in agent systems: model updates cause output quality degradation, changes quietly break workflows, and agents still claim success when results are wrong. agent-gate turns discipline into a tool that agents must actually pass, rather than relying on smarter models.
Main Capabilities
- Fail-closed checklist: A check is satisfied only if it is explicitly proven true; lack of proof is not equivalent to proof of passing.
- Tamper-resistant receipts: Each decision is recorded in the form (decision, metric, value, conclusion) and linked into a sha256 chain. Editing or deleting any historical receipt will make verify_chain() return false. An honest log is enforced by the data structure.
- Human gating by default: The default ship gate includes the required check "any irreversible or external-facing action has human approval." The agent drafts; the human approves.
- Default ship gate encodes Fleet Mode: Includes five checks: deterministic_checks_pass, independent_refute_review, no_secrets, human_gated_if_irreversible, honest_receipt_logged.
- Standard-library core: agent_gate/gate.py (fail-closed checklist) and agent_gate/ledger.py (hash-chained receipts) are pure standard-library implementations, fast to read and fast to trust. agent_gate/server.py is a thin MCP adapter layered on top, with the only runtime dependency being mcp.
- Receipt persistence: Receipts are persisted to ~/.agent-gate/receipts.jsonl, and this can be overridden via AGENT_GATE_LEDGER.
Usage
agent-gate can be added to the configuration of an MCP client (such as Claude Desktop or Claude Code). Once configured, the agent can call verify_gate(...) before telling the user the task is complete, and the user also gets a tamper-resistant decision trail.
It can also be used directly without relying on an MCP client: the core modules are pure standard library, and tests cover Python 3.11 to 3.13 (see CI). MCP tools are tested by actual invocation, not just by import testing.
Run the demo command yourself:
PYTHONPATH=. python3 examples/demo.py
Applicable Scenarios
Suitable for workflows that require agents to be accountable for the quality of their own output, especially in the following situations: the agent may "self-approve and self-revise" and produce low-quality results; the agent's decision process needs to be audited; receipts need to be protected from tampering; irreversible operations need to be ensured to have human approval.
Limitations and Notes
- The only runtime dependency of the MCP adapter layer is mcp.
- The repository itself practices high standards: CI runs pytest on Python 3.11–3.13, and line coverage below the threshold (currently 97%) fails the build; CodeQL static analysis (security-extended) runs on every push, PR, and weekly; all GitHub Actions are pinned to full commit SHAs and kept up to date by Dependabot; the main branch requires CI and CodeQL checks to pass before merging.
- Licensed under MIT.
- Built by Jeff Otterson (Jott2121), derived from the gating discipline of bow and Fleet Mode.
- The same series also includes rag-guard and agent-cost-attribution.
- The companion measurement tool sabot is the measurement side of this philosophy: agent-gate adds fail-closed gates to workflows, while sabot injects controlled failures into running LangGraph, CrewAI, and AutoGen pipelines, measuring whether such gates and review stages actually trigger; the median self-check detection rate on three production frameworks is 16.7%, with a preregistered specification, an Apache-2.0 test harness, and all raw trajectories made public.
