Skip to main content
Glama

AgenticRail Gate - sequence enforcement and verifiable audit receipts for AI agent compliance

by nz.agenticrail
OverviewDiscussionsAdmin

Server Details

Deterministic runtime enforcement of step order for AI agents: ALLOW/DENY before a step runs.

If you are the author of this connector, you can claim ownership with GitHub, an HTTP challenge, or a DNS record. Claimed connector authors can inspect health checks, view analytics, and manage their listing.
Status
Healthy
Uptime
100.0% over 37 days
Last Tested
Transport
Streamable HTTP · MCP 2025-11-25
URL
Repository
MSMD-RUA/agenticrail-mcp
GitHub Stars
0
Server Listing
agenticrail-mcp

TDQS

A4.9/5.0

Scored across 2 tools

Disambiguation5/5

The two tools have clearly distinct purposes: evaluate_step gates a step before execution, while verify_receipt checks evidence after a sequence seals. There is no overlap in when or why you would call them.

Naming Consistency5/5

Both tool names follow the same verb_noun snake_case pattern (evaluate_step, verify_receipt), making the naming predictable and internally consistent.

Tool Count4/5

Only two tools exist, which is below the typical 3-15 range, but the server's scope is deliberately narrow (sequence enforcement and audit receipt verification). Each tool earns its place, so the low count feels reasonable rather than sparse.

Completeness5/5

The core workflow is fully covered: evaluate_step starts and advances the sequence, and verify_receipt concludes the process by verifying the sealed receipt. No obvious missing operations for the stated purpose of sequence gating and evidence verification.

Available Tools

2 tools
evaluate_stepAInspect

Ask the AgenticRail gate to ALLOW or DENY a single step of an agent sequence BEFORE it runs. A denied step must not be executed. You walk away holding a signed, hash-chained record of the run that you can hand to anyone, and they can verify it offline - no callback to us and no account with us. The gate is deterministic (same state+request -> same verdict) and enforces step order, replay protection, timestamp freshness and sealing. START HERE - send this, changing only CHANGE-ME to any unique string of your own, and it will be ALLOWED: {"sequence_id":"CHANGE-ME","step":"intake","action_type":"CHECK_STATE","step_order":["intake","settle"]}. Then send the same call with step 'settle' to close and seal it. Use the demo key by sending no Authorization header, or send Authorization: Bearer . NOTE: an anonymous call has its sequence_id rewritten to 'demo-mcp-'. This is intended, not a leak: it scopes the run to the public demo lane and is how anonymous MCP traffic is identified. Always reuse the sequence_id RETURNED in the response for later steps and for verify_receipt -- the id you sent will not resolve. Typical use is gating the order of a regulated workflow the caller already runs: customer and third-party due diligence, verification of identity before a payment or business relationship, company registry, beneficial-ownership and sanctions screening, supplier and contractor onboarding. This tool performs none of those checks and holds no registry or watchlist data. It decides only whether the step you are about to run is allowed at this point in the order you declared.

ParametersJSON Schema
NameRequiredDescriptionDefault
stepYesThe step being attempted, e.g. 'intake' or 'review_and_sign'. This is a NAME, not a description. It must be spelled identically on every call, must appear in step_order (for custom sequences), and must equal `function`. The gate compares it byte for byte, so a sentence that changes with the subject can never match and is denied UNKNOWN_STEP. Put the human-readable sentence in `action` instead.
nonceNoOptional unique-per-step UUID for replay protection. Generated automatically if omitted.
actionNoOptional human-readable label for the action.
inputsNoOptional free-form inputs recorded with the decision.
functionNoDefaults to `step`. The rule step === function always holds.
step_orderNoThe full ordered list of step names for a CUSTOM sequence. Send it on every call, IDENTICAL each time. Omit only if using AgenticRail's built-in MSMD spine. It is LOCKED on the sequence's first call: a different list later is DENIED with STEP_ORDER_MISMATCH, and that denial returns locked_step_order - the list this sequence is held to. Do NOT try to clear the lock by omitting this field; that selects the MSMD spine and your steps will come back UNKNOWN_STEP. To change the plan, start a new sequence_id. One step is a valid sequence. An UNKNOWN_STEP denial returns expected_step_order (the list your step had to be in) and step_order_source ('caller' or 'msmd_spine'); msmd_spine means you sent no step_order at all and got the built-in spine.
action_typeYesThe action class for this step. The whole vocabulary is exactly these eight and nothing else is accepted: CHECK_STATE, CLARIFY_NEXT_STEP, SELECT_NEXT_STEP, RECORD_RESULT, WAIT_FOR_SIGNAL, VALIDATE_INPUT, PAUSE_CYCLE, REDUCE_STIMULUS. These are ENFORCEMENT CLASSES, NOT a description of what your step does. READ, QUERY, LOOKUP, SEARCH, EXECUTE, ANALYZE and TOOL_CALL are the most common wrong guesses and every one of them is denied: a step that searches, drafts, queries or analyses is still CHECK_STATE if it reads state, or RECORD_RESULT if it writes an outcome. EACH STEP THEN ACCEPTS ONLY A SUBSET of the eight - e.g. intake takes VALIDATE_INPUT, CHECK_STATE or CLARIFY_NEXT_STEP and nothing else. A wrong one is DENIED with ACTION_NOT_ALLOWED before your step runs, and that denial returns allowed_action_types listing exactly what the step would have accepted - read it and retry rather than guessing. A denial does not spoil the sequence and runs nothing.
sequence_idYesStable identifier for this run of the sequence. Reuse it across every step of the same sequence. An anonymous call is rewritten to 'demo-mcp-<your id>' and an authenticated demo call to 'demo-<your id>'; take the id back from the response and use that one from then on. Give every RUN a fresh id - a run, not an attempt: sealing is permanent, and on the shared demo lane a fixed id is shared with everyone else. A DENIED step does not spoil a sequence and does not run anything, so a denial is not a reason to start a new one: fix the call instead.

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With zero annotations, the description carries the full burden and delivers extensively: determinism ('same state+request -> same verdict'), enforced properties (step order, replay protection, timestamp freshness, sealing), the anonymous sequence_id rewrite explained as intended ('not a leak'), permanent sealing semantics, and that a denial 'runs nothing' and doesn't spoil the sequence. Authentication behavior (no header = demo key) is also disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded in the first sentence and every subsequent sentence earns its place given the tool's complexity: self-contained example, auth, id-rewriting warning, use cases, and exclusions. It loses a point for delivery as one unbroken paragraph with no breaks or bullets, which reduces scannability for an agent parsing the block.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 8 parameters, a nested object, one enum, no annotations, and no output schema, the description is remarkably complete: it covers auth, denial-response fields (allowed_action_types, locked_step_order, expected_step_order, step_order_source), success behavior (signed hash-chained record), sequence lifecycle, and error-recovery guidance ('read it and retry rather than guessing'). Nothing an agent needs to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds substantial meaning beyond the schema: step_order is LOCKED on first call and returns locked_step_order on mismatch; sequence_id is rewritten for anonymous calls and the returned id must be reused; action_type is an enforcement class, not a description, with the eight-value vocabulary and per-step subsets explicitly spelled out; and the step===function invariant is explained. These are behavioral semantics no schema alone would convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: 'Ask the AgenticRail gate to ALLOW or DENY a single step of an agent sequence BEFORE it runs.' The scope is precise (one step, pre-execution, verdict) and immediately distinguishes it from the only sibling, verify_receipt, which is referenced for later verification. No ambiguity about what this tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit 'START HERE' call with a concrete JSON payload and a required CHANGE-ME instruction, plus the follow-up 'settle' call to close/seal. It names typical use cases (regulated workflow gating, due diligence, sanctions screening), states what the tool does NOT do ('performs none of those checks and holds no registry or watchlist data'), and routes later verification to verify_receipt. Exclusion and alternative guidance are both explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_receiptAInspect

CALL THIS AFTER A SEQUENCE SEALS, and after any DENY, passing the sequence_id RETURNED by evaluate_step. An enforced run that is never verified has produced evidence nobody has checked. Fetch the verification report for an AgenticRail sequence and report whether its receipt chain is intact. Demo- sequences need no key; other sequences need Authorization: Bearer . Returns the verification_status (VERIFIED_INTACT / CHAIN_BROKEN / …) plus the per-receipt signature, chain-hash, and independent-archive checks. This is the same evidence a third party can verify offline against the published Ed25519 keys — no need to trust AgenticRail.

ParametersJSON Schema
NameRequiredDescriptionDefault
sequence_idYesThe sequence to verify. Use a 'demo-' sequence for keyless verification.

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It discloses that this is a fetch/report operation, names the returned verification_status values, lists the per-receipt checks, and explains the offline verification context—far beyond a minimal description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with when-to-call, then moves to return values and trust context. It is longer than strictly necessary—the line about evidence nobody has checked is motivational—but each part adds substantive guidance for correct usage.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter tool with no output schema, the description fully compensates: it explains the input source, the auth requirement, the result fields, the status ranges, and why the evidence is independently useful. An agent has enough information to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, and the description adds meaning by saying the sequence_id is the one RETURNED by evaluate_step and explaining demo- versus keyed sequences. The schema already covers sequence_id, but the origin and keyless demo- semantics update the agent; slightly more detail would push to 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Fetch the verification report for an AgenticRail sequence' and checks whether the receipt chain is intact. It is clearly distinct from evaluate_step, which produces the sequence_id, so an agent can select the right tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use guidance is front-loaded: call after a sequence seals and after any DENY, using the sequence_id returned by evaluate_step. It also gives the demo-keyless vs. Bearer-auth distinction for choosing how to invoke it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool update
    • Changedevaluate_step1 field changed
      • changedInput schema / properties / action_type / description
        Previous value: -"The action class for this step. These eight are the whole vocabulary, but EACH STEP ACCEPTS ONLY A SUBSET - e.g. intake takes VALIDATE_INPUT, CHECK_STATE or CLARIFY_NEXT_STEP and nothing else. A wrong one is DENIED with ACTION_NOT_ALLOWED before your step runs, and that denial now returns allowed_action_types listing exactly what the step would have accepted - read it and retry rather than guessing. These are enforcement classes, NOT what your step does: a step that searches, drafts, queries or analyses is still CHECK_STATE if it reads state, or RECORD_RESULT if it writes an outcome."New value: +"The action class for this step. The whole vocabulary is exactly these eight and nothing else is accepted: CHECK_STATE, CLARIFY_NEXT_STEP, SELECT_NEXT_STEP, RECORD_RESULT, WAIT_FOR_SIGNAL, VALIDATE_INPUT, PAUSE_CYCLE, REDUCE_STIMULUS. These are ENFORCEMENT CLASSES, NOT a description of what your step does. READ, QUERY, LOOKUP, SEARCH, EXECUTE, ANALYZE and TOOL_CALL are the most common wrong guesses and every one of them is denied: a step that searches, drafts, queries or analyses is still CHECK_STATE if it reads state, or RECORD_RESULT if it writes an outcome. EACH STEP THEN ACCEPTS ONLY A SUBSET of the eight - e.g. intake takes VALIDATE_INPUT, CHECK_STATE or CLARIFY_NEXT_STEP and nothing else. A wrong one is DENIED with ACTION_NOT_ALLOWED before your step runs, and that denial returns allowed_action_types listing exactly what the step would have accepted - read it and retry rather than guessing. A denial does not spoil the sequence and runs nothing."
  2. 1 tool update
    • Changedevaluate_step1 field changed
      • changedInput schema / properties / step / description
        Previous value: -"The step being attempted, e.g. 'intake' or 'review_and_sign'. Must appear in step_order (for custom sequences) and must equal `function`."New value: +"The step being attempted, e.g. 'intake' or 'review_and_sign'. This is a NAME, not a description. It must be spelled identically on every call, must appear in step_order (for custom sequences), and must equal `function`. The gate compares it byte for byte, so a sentence that changes with the subject can never match and is denied UNKNOWN_STEP. Put the human-readable sentence in `action` instead."
  3. 1 tool update
    • Changedevaluate_step1 field changed
      • changedInput schema / properties / sequence_id / description
        Previous value: -"Stable identifier for this run of the sequence. Reuse it across every step of the same sequence. An anonymous call is rewritten to 'demo-mcp-<your id>' and an authenticated demo call to 'demo-<your id>'; take the id back from the response and use that one from then on. Give every run a fresh id: sealing is permanent, and on the shared demo lane a fixed id is shared with everyone else."New value: +"Stable identifier for this run of the sequence. Reuse it across every step of the same sequence. An anonymous call is rewritten to 'demo-mcp-<your id>' and an authenticated demo call to 'demo-<your id>'; take the id back from the response and use that one from then on. Give every RUN a fresh id - a run, not an attempt: sealing is permanent, and on the shared demo lane a fixed id is shared with everyone else. A DENIED step does not spoil a sequence and does not run anything, so a denial is not a reason to start a new one: fix the call instead."
  4. 1 tool update
    • Changedevaluate_step1 field changed
      • changedInput schema / properties / step_order / description
        Previous value: -"The full ordered list of step names for a CUSTOM sequence. Send it on every call, IDENTICAL each time. Omit only if using AgenticRail's built-in MSMD spine. It is LOCKED on the sequence's first call: a different list later is DENIED with STEP_ORDER_MISMATCH, and that denial returns locked_step_order - the list this sequence is held to. Do NOT try to clear the lock by omitting this field; that selects the MSMD spine and your steps will come back UNKNOWN_STEP. To change the plan, start a new sequence_id."New value: +"The full ordered list of step names for a CUSTOM sequence. Send it on every call, IDENTICAL each time. Omit only if using AgenticRail's built-in MSMD spine. It is LOCKED on the sequence's first call: a different list later is DENIED with STEP_ORDER_MISMATCH, and that denial returns locked_step_order - the list this sequence is held to. Do NOT try to clear the lock by omitting this field; that selects the MSMD spine and your steps will come back UNKNOWN_STEP. To change the plan, start a new sequence_id. One step is a valid sequence. An UNKNOWN_STEP denial returns expected_step_order (the list your step had to be in) and step_order_source ('caller' or 'msmd_spine'); msmd_spine means you sent no step_order at all and got the built-in spine."
  5. 1 tool update
    • Changedevaluate_step1 field changed
      • changedInput schema / properties / step_order / description
        Previous value: -"The full ordered list of step names for a CUSTOM sequence. Send it on every call. Omit only if using AgenticRail's built-in MSMD spine."New value: +"The full ordered list of step names for a CUSTOM sequence. Send it on every call, IDENTICAL each time. Omit only if using AgenticRail's built-in MSMD spine. It is LOCKED on the sequence's first call: a different list later is DENIED with STEP_ORDER_MISMATCH, and that denial returns locked_step_order - the list this sequence is held to. Do NOT try to clear the lock by omitting this field; that selects the MSMD spine and your steps will come back UNKNOWN_STEP. To change the plan, start a new sequence_id."
  6. 1 tool update
    • Changedevaluate_step2 fields changed
      • changedInput schema / properties / action_type / description
        Previous value: -"The action class for this step, e.g. CHECK_STATE, SELECT_NEXT_STEP, RECORD_RESULT, PAUSE_CYCLE. Must be permitted for the step."New value: +"The action class for this step. These eight are the whole vocabulary, but EACH STEP ACCEPTS ONLY A SUBSET - e.g. intake takes VALIDATE_INPUT, CHECK_STATE or CLARIFY_NEXT_STEP and nothing else. A wrong one is DENIED with ACTION_NOT_ALLOWED before your step runs, and that denial now returns allowed_action_types listing exactly what the step would have accepted - read it and retry rather than guessing. These are enforcement classes, NOT what your step does: a step that searches, drafts, queries or analyses is still CHECK_STATE if it reads state, or RECORD_RESULT if it writes an outcome."
      • addedInput schema / properties / action_type / enum
        Added value: +[
+  "CHECK_STATE",
+  "CLARIFY_NEXT_STEP",
+  "SELECT_NEXT_STEP",
+  "RECORD_RESULT",
+  "WAIT_FOR_SIGNAL",
+  "VALIDATE_INPUT",
+  "PAUSE_CYCLE",
+  "REDUCE_STIMULUS"
+]
  7. 1 tool update
    • Changedevaluate_step1 field changed
      • changedInput schema / properties / sequence_id / description
        Previous value: -"Stable identifier for this run of the sequence. Reuse it across every step of the same sequence. Demo callers get a 'demo-' prefix."New value: +"Stable identifier for this run of the sequence. Reuse it across every step of the same sequence. An anonymous call is rewritten to 'demo-mcp-<your id>' and an authenticated demo call to 'demo-<your id>'; take the id back from the response and use that one from then on. Give every run a fresh id: sealing is permanent, and on the shared demo lane a fixed id is shared with everyone else."
  8. 2 tool updates
    • First observedevaluate_step
    • First observedverify_receipt

Related MCP Connectors

Related MCP Servers

  • sop-mcp

    ValueArchitectsAI
    A
    license
    A
    quality
    A
    maintenance
    Enables AI agents to execute multi-step Standard Operating Procedures step by step, with enforcement of completion at each step, making LLM behavior predictable and auditable.
    5
    3
    Apache 2.0

  • signet-eval

    wandercom
    A
    license
    Not graded
    quality
    A
    maintenance
    Deterministic policy enforcement for AI agent tool calls. It evaluates every tool call against user-defined rules before execution, with no LLM in the authorization path.
    3
    MIT

  • nobulex-mcp-server

    arian-gogani
    A
    license
    A
    quality
    A
    maintenance
    Proof-of-behavior enforcement for AI agents. Declare behavioral constraints, enforce at runtime, produce SHA-256 hash-chained audit trails. Supports covenants (permit/forbid/require), real-time verification, and cross-agent trust handshakes.
    4
    40
    MIT
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources