Skip to main content
Glama
jessepetersondev

consentgate-mcp

by jessepetersondev
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Remote

consentgate-mcp

A Model Context Protocol server that lets any MCP-capable agent (Claude Desktop, Claude Code, Cursor, custom agents, …) gate its own actions behind a human's consent policy via ConsentGate.

The agent asks before it acts; you stay in control. High-stakes actions can block on an explicit Approve / Deny tap delivered to your Telegram.

Tools

Tool

Blocks?

What it does

check_action

no

Evaluates an action against your consent rules. Returns allow, deny, or ask (no rule matched). Use it before any sensitive/irreversible action.

request_approval

yes (≤120s)

Sends an Approve/Deny prompt to your Telegram and blocks until you tap or it times out. Returns allow only on an explicit human Approve; everything else (deny, timeout, not-available) is deny.

Both fail closed: anything other than an explicit allow means do not proceed.

Related MCP server: Relay

Prerequisites

  1. A ConsentGate account and an API key → https://consentgate.fyi/dashboard/keys (cg_…).

  2. For request_approval (interactive approvals): the Pro plan and a linked Telegram account (Dashboard → Telegram → Connect). check_action works on any plan.

Configuration

Environment variables:

Var

Required

Default

Notes

CONSENTGATE_API_KEY

✅

—

Your cg_… key.

CONSENTGATE_BASE_URL

—

https://consentgate.fyi

Override for self-hosted instances.

Claude Desktop

Add to claude_desktop_config.json (Settings → Developer → Edit Config):

{
  "mcpServers": {
    "consentgate": {
      "command": "npx",
      "args": ["-y", "consentgate-mcp"],
      "env": { "CONSENTGATE_API_KEY": "cg_your_key_here" }
    }
  }
}

Claude Code

claude mcp add consentgate --env CONSENTGATE_API_KEY=cg_your_key_here -- npx -y consentgate-mcp

Generic MCP client

Run npx -y consentgate-mcp (stdio transport) with CONSENTGATE_API_KEY in the environment.

Run from source

Until the package is published to npm, point your client at the built file (node /abs/path/to/mcp/dist/index.js) instead of npx consentgate-mcp.

cd mcp
npm install        # also builds via the `prepare` script
npm run build      # -> dist/index.js
CONSENTGATE_API_KEY=cg_… npm run smoke   # lists tools + a live check_action

How an agent should use it

A good agent policy:

Before performing any action that sends messages, spends money, deletes data, posts publicly, or changes external state, call check_action. If the result is allow, proceed. If deny, stop. If ask (or the action is high-stakes), call request_approval and proceed only on an explicit allow.

Example (request_approval):

{
  "action": "transfer_funds",
  "category": "spending",
  "metadata": { "amount": "$500", "to": "Acme Corp" },
  "wait_seconds": 90
}
// -> blocks; you tap Approve in Telegram -> { "decision": "allow", "resolved_by": "human" }

License

MIT

Available Tools

2 tools
check_actionCheck an action against the consent policyA
Read-only

Check whether an action is permitted by the ConsentGate owner's consent policy BEFORE you perform it. Call this for any potentially sensitive, irreversible, or high-impact action — e.g. sending email or messages, posting publicly, spending money, deleting or overwriting files, calling external/destructive APIs, or changing system state. Returns a decision: "allow" (you may proceed), "deny" (do NOT proceed), or "ask" (no rule matched — not approval; use request_approval to get a human decision, or ask the user). This call does not block. FAIL CLOSED: if the result is anything other than "allow", do not perform the action.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYesThe specific action you intend to take, e.g. "send_email", "delete_file", "transfer_funds".
categoryYesAction category. Built-in categories: email, social_post, message, file_write, file_delete, api_call, spending, calendar, system, custom. Any short label (<=50 chars) is accepted.
metadataNoStructured details of the action (e.g. recipient, amount, path, url). Used by the owner's rules and shown in any approval prompt. Max 10KB.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses several behavioral traits beyond the annotations: it is non-blocking ('This call does not block.'), fail-closed ('FAIL CLOSED: if the result is anything other than "allow", do not perform the action.'), and clarifies that 'ask' is not approval. These add meaningful context that the readOnlyHint and openWorldHint annotations do not provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is four sentences long, with each sentence earning its place: purpose, usage examples, return values, and the critical fail-closed instruction. It is front-loaded with the main action and is dense with useful guidance, with no fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Even without an output schema, the description fully explains the return values and their meanings, the non-blocking nature, and the fail-closed behavior. It also handles the 'ask' edge case by directing to request_approval. This is complete for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides 100% parameter coverage, including examples and built-in categories. The description adds minimal extra parameter meaning, such as that metadata is 'used by the owner's rules,' but does not significantly expand on what the schema already says. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool checks whether an action is permitted by the consent policy before performing it. It specifies the verb 'check' and the resource 'consent policy', and differentiates from the sibling tool request_approval by noting that 'ask' is not approval and should use request_approval.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly instructs when to use this tool: 'for any potentially sensitive, irreversible, or high-impact action' with concrete examples. It also provides an explicit alternative for the 'ask' result: 'use request_approval to get a human decision, or ask the user.' This is strong guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

request_approvalRequest explicit human approval (blocks)A

Request a human's explicit approval for an action and BLOCK until they decide or the timeout elapses. Use for high-stakes actions, or whenever check_action returned "ask". The owner gets an Approve/Deny prompt on Telegram. Returns "allow" ONLY if a human tapped Approve. Returns "deny" on tap-deny, on timeout (fail-closed), or when interactive approvals are unavailable (owner not on Pro, or Telegram not linked — see upgrade_required / telegram_linked). NEVER treat a non-"allow" result as permission.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYesThe specific action requiring approval, e.g. "send_email", "transfer_funds".
categoryYesAction category. Built-in categories: email, social_post, message, file_write, file_delete, api_call, spending, calendar, system, custom. Any short label (<=50 chars) is accepted.
metadataNoStructured details shown to the human in the approval prompt (e.g. recipient, amount, summary). Max 10KB.
wait_secondsNoHow long to block waiting for the human's tap (1-120s). On timeout the result fails closed to "deny".

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses extensive behavioral details: blocking behavior, exact return values, fail-closed timeout, unavailable conditions, and a strong safety caveat. This goes well beyond the annotations (readOnlyHint=false, openWorldHint=true) and adds critical context for an agent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a concise block of information with clear front-loading of the core purpose. Every sentence contributes critical usage or safety information, and the overal length is justified for a safety-critical tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description fully explains return values and edge cases. It covers success (allow), deny conditions, timeout, unavailable scenarios, and safety rules, making it complete for an agent to use correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description does not add extra parameter-specific meaning beyond what the schema already provides; it focuses on overall tool behavior instead.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states exactly what the tool does: request human approval and block until decision or timeout. It clearly distinguishes this from the sibling tool check_action by saying 'Use for high-stakes actions, or whenever check_action returned "ask"'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says when to use this tool (high-stakes actions, check_action returned ask) and when to avoid treating results as permission. The description also mentions alternatives via the check_action reference, giving clear contextual guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 2 tool updatesv0.1.1
    • First observedcheck_action
    • First observedrequest_approval
Deploy Server
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A4.6/5.0

Scored across 2 tools

Disambiguation5/5

check_action and request_approval have clearly distinct purposes: one performs a policy check, the other requests human approval. There is no overlap or ambiguity between them.

Naming Consistency5/5

Both tools follow the same verb_noun pattern with snake_case: check_action and request_approval. The naming is consistent, descriptive, and predictable.

Tool Count3/5

With only two tools, the set feels minimal but not unreasonable for a focused consent gate. It is borderline according to the calibration, as 1-2 tools tends to be thin, but here the two tools cover the core consent workflow.

Completeness4/5

The core consent flow is covered: check_action for policy evaluation and request_approval for handling 'ask' results or high-stakes actions. There is no dead end, though a gap exists for managing or viewing the consent policy itself, which is likely configured outside the tool surface.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • vantagate-mcp-server

    Aderix
    A
    license
    Not graded
    quality
    D
    maintenance
    Human-in-the-Loop authorization gateway for AI Agents. Securely pause MCP workflows and route high-risk actions to human approvers via Slack or Email.
    85 npm
    1
    MIT

  • Relay

    andeya
    A
    license
    Not graded
    quality
    B
    maintenance
    Adds a human-in-the-loop checkpoint to MCP-capable AI coding agents, enabling them to pause and request user feedback before executing actions.
    10 npm
    71
    MIT

  • @looppause/mcp

    soteeabam
    A
    license
    Not graded
    quality
    C
    maintenance
    Pauses AI agent execution and routes approval requests to humans via Slack or email, with cryptographically signed proof of the human's decision.
    18 npm
    MIT

  • call-a-human-mcp

    nishantmodak
    A
    license
    A
    quality
    A
    maintenance
    An MCP server that enables AI agents to pause and request human approval or information via Slack, Telegram, or macOS dialogs before proceeding with actions.
    2
    15
    Apache 2.0