Trust Gate MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| TRUST_GATE_BEARER_TOKEN | No | Optional bearer token for authentication. | |
| TRUST_GATE_ALLOWED_ORIGINS | No | Comma-separated list of allowed origins for CORS. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| mint_receipt_for_record_changeC | Mint a signed receipt (Ed25519, plus ML-DSA-65 when the post-quantum backend is available) for one CRM record change. Old/new values are carried as SHA-256 hashes. Works with any CRM (Relaticle, hosted CRMs, custom). |
| audit_my_agent_inventoryA | Rank a CALLER-PROVIDED list of MCP tools by worst-regret if they act (a name-based heuristic that weights a name's first word most). Read-only: it mints no receipt. Cannot auto-discover the inventory -- MCP does not allow that; the caller must pass it in. |
| mint_action_receiptA | Mint a signed receipt (Ed25519, plus ML-DSA-65 when the post-quantum backend is available) for an arbitrary consequential agent action. Optional attestation: triggered_by_type (human/agent/script), triggered_by_source (api/cli/cron), decision_model (the LLM model used). Attestation values are caller claims: allowlisted to safe characters, signed, not verified. Decisions that contain a gate verdict word are reserved for gate_decision. |
| verify_receiptA | Verify a Trust Gate receipt from the certificate alone (offline). ok=true means unchanged since signing, signed, kid consistent with the embedded key, and (require_pq default on) at least one post-quantum leg verified; unsigned receipts fail. It does not prove who signed: pass expected_kid to pin the signer's Ed25519 key; a pin counts only when that key's own signature verifies (see signer_pinned). The post-quantum keys in a receipt are not covered by the kid. |
| gate_decisionA | Two-phase decision gate with a real verdict. PREVIEW returns ALLOW, DENY or ESCALATE with the risk tier and reasons, plus a preview_id, without acting. COMMIT re-evaluates the same inputs and mints a signed receipt for the verdict. Only ALLOW returns a GRANTED permit; DENY returns DENIED; ESCALATE returns WITHHELD_PENDING_HUMAN and a human must decide outside this tool. Applies only to actions the caller routes through it: it does not observe or block what an agent does. Verb-tier heuristic on the action name and resource, not a proof. Stateless. Optional attestation: triggered_by_type, triggered_by_source, decision_model. |
| check_egressA | Egress classification check. Scans a data sample for a finite list of sensitivity markers and classifies as NO_MARKERS_FOUND / INTERNAL / CONFIDENTIAL / RESTRICTED. RESTRICTED sets blocked=true; this tool cannot block anything itself, and NO_MARKERS_FOUND is not clearance to send. Returns classification, retention info, and a tamper-evident receipt. |
| run_exit_drillA | Vendor exit readiness drill. Checks local signing key, local model access (Ollama). Returns step-by-step results and a tamper-evident receipt. Informational; it signs one receipt, which creates the signing key on a host that has none yet. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 7 tools
Receipt minting appears in mint_receipt_for_record_change, mint_action_receipt, gate_decision, and implicitly check_egress/run_exit_drill, but detailed descriptions separate CRM record changes from arbitrary actions and gate verdicts. A caller might still momentarily confuse mint_action_receipt with gate_decision when an action involves a gate verdict word, though the reserved-word note mitigates this.
Almost all names use snake_case with a leading verb (verify_, mint_, audit_, check_, run_), and the pattern is easy to scan. Minor deviations: gate_decision reads more like a noun phrase than a verb_noun action, and audit_my_agent_inventory adds 'my' and is longer than the others.
Seven tools is well within the ideal 3-15 range for a narrowly scoped trust/receipt server. Each tool covers a distinct operation — verify, mint two receipt types, gate, egress classify, audit inventory, exit drill — so none feels redundant or purely ornamental.
Core receipt lifecycle is present: mint signed receipts, verify offline, gate decisions, egress classification, inventory audit, and exit drill. Missing a few ancillary lifecycle operations such as explicit key management/rotation, receipt listing/retrieval, or a post-escalation human decision path, but these are either outside scope or intentionally external.