Skip to main content
Glama
RileyBetts

ceco proof gate

by RileyBetts
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

ceco proof gate

Runtime policy enforcement extracted from ceco-offline (development @ 484bb16, 2026-07-04).

This package is the proof gate only: an MCP server that evaluates agent actions against a Policy State Machine, emits a tamper-evident audit trail, and optionally dispatches approved transitions to internal / federated handlers.

It does not include the ceco compile / synthesis pipeline (ceco derive, SMT/Lean generation, ceco-mcp analysis server, or supplier-onboarding demo).

What is included

Area

Modules

Gate MCP + SSE daemon

gate_mcp_server, gate_daemon, gate_config

Transition evaluation

runtime, dsl, sexp, simulate (concrete), validator

Federation / handlers

mcp_client, mcp_federation, internal_mcp_server, internal_handlers

Context & anchors

context_resolvers, policy_anchor, code_guards, proof_cache

Audit / attestation

audit/ (hash chain, CPAR/CCPB, optional ZK backends)

Related MCP server: attest-mcp-server

Docs

Install

cd /home/martyn/repos/ceco
poetry install
# or: pip install -e ".[dev]"

Quick start (payment example)

export CECO_GATE_CONFIG=examples/gate_config.payment.yaml
export CECO_GATE_INTERNAL_MODE=inprocess

# stdio MCP (Cursor / Claude Desktop spawn this)
poetry run ceco-gate-mcp

# or persistent SSE daemon for multi-turn agents
poetry run ceco-gate-daemon
curl http://127.0.0.1:14780/health

Point an MCP client at stdio ceco-gate-mcp, or at http://127.0.0.1:14780/sse for the daemon.

Entry points

Script

Module

ceco-gate-mcp

ceco.gate_mcp_server:main

ceco-gate-daemon

ceco.gate_daemon:main

ceco-internal-mcp

ceco.internal_mcp_server:main

Tests

poetry run pytest tests/ -q

Provenance

Source: /home/martyn/repos/ceco-offline branch development commit 484bb16. Feature branches feat/gate-daemon, feat/machine-cache, and feat/transition-index are already merged into that tip. Local uncommitted edits in ceco-offline that removed the machine cache / transition index were not carried over.

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityMaintained
ResponsivenessSyncing

Resources

Related MCP Connectors

Related MCP Servers

  • Nobulex MCP Compliance Server

    arian-gogani
    A
    license
    A
    quality
    C
    maintenance
    Provides covenant rule enforcement, hash-chained audit logs, and integrity verification for MCP-compatible agents. It enables users to define granular permission rules and maintain a tamper-evident audit trail of all actions.
    4
    11 npm
    1
    MIT

  • attest-mcp-server

    chudah1
    A
    license
    A
    quality
    D
    maintenance
    An MCP server that exposes tools for issuing scoped agent credentials, delegating narrower child credentials, handling approvals, revoking task trees, and retrieving audit trails and evidence packets.
    14
    1
    Apache 2.0

  • QuantaOptima

    jdhart81
    A
    license
    A
    quality
    B
    maintenance
    MCP server that provides cryptographic audit trails for AI agent actions, making every action tamper-evident via HMAC-SHA256 signed hash chains.
    10
    Apache 2.0

  • agent-audit-trail

    dtjohnson83
    A
    license
    Not graded
    quality
    C
    maintenance
    MCP server providing immutable audit logging, policy enforcement, and compliance reporting for AI agent workflows, enabling regulatory compliance and chain integrity verification.
    MIT