# dk.humanified/values-firewall

> EU AI Act Art-14 runtime oversight: allow / flag / gate-to-human on an agent action, with receipt.

- name: dk.humanified/values-firewall
- version: 1.0.0
- connection class: unknown (unknown)
- trust: 47/100 flags: no-repository, unreachable
- quality: 69/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/dk.humanified%2Fvalues-firewall
- tools: https://api.protogrid.dev/v1/servers/dk.humanified%2Fvalues-firewall/tools

**Not classified yet.** The remote endpoints have not been probed successfully, or the listing has nothing to connect to.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "values-firewall": {
      "type": "http",
      "url": "https://vf.humanified.dk/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 0
- freshness: 85
- provenance: 45
- drivers: +dns-namespace -unreachable(13 failures) ~updated-76d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 69/100 (needs work)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 64 (weight 30)

- pass `tools.descriptions`: every tool has a description
- warn `tools.description_length`: 1 tools have descriptions over 1,024 characters, which crowds the context
- pass `tools.schemas`: every tool has an object input schema
- fail `tools.annotations`: no tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: check_action (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); check_action_deterministic (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_charter (readOnlyHint, destructiveHint, idempotentHint, openWorldHint)
- pass `tools.token_cost`: about 805 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`: tool history not recorded yet

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 3, about 805 tokens to load them all
- badge: [![protogrid quality](https://protogrid.dev/badge/dk.humanified/values-firewall.svg)](https://protogrid.dev/servers/dk.humanified/values-firewall)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Remotes

- https://vf.humanified.dk/mcp (streamable-http, auth none, reachable false, uptime30d 0)

## Packages

_none_

## Tools (3)

- `check_action`: Kerne-gaten (to-lags evaluering): Lag A (deterministisk hard-rule/outward-match, ingen
LLM) + Lag B (Sonnet vurderer mod charterets NL-principper via LiteLLM :4000, citerer
principle_id + reasoning — INGEN egen alvorligheds-dom) → most-restrictive-wins aggregeret,
auditerbar receipt: {action, deterministic_flags[], values_assessment[],
values_assessment_unavailable, unrecognized_principle_citations, principles_evaluated,
recommendation, requires_human, charter_name, scope_note}.

`recommendation` ∈ {allow, flag, gate_to_human} — ALDRIG approved/denied/true/false.
ADVISORY: anbefaler, blokerer/eksekverer/autoriserer ALDRIG (never-decide-for-you).
FAIL-SAFE: Lag B utilgængelig -> Lag A kører stadig, values_assessment_unavailable=true,
recommendation løftet til MINDST 'flag' (aldrig stille 'allow'). Read-only — skriver
INTET, ingen side-effekter.

PUBLIC_DEMO-mode: vurderet mod det OFFENTLIGE Art-14-demo-charter (ikke din org — se
scope_note). Rate-limitet (default 5/min + 30/time, ÉN global demo-bucket). Over grænsen
returneres `{error:"rate_limited", retry_after_s, scope_note}` — ALDRIG et
recommendation-formet svar. Bogholderi-fejl i rate-limiteren -> deny (fail-safe).

RED-TEAM-FIX (minimal-indgreb): tomt/whitespace-only `action` valideres FØR rate-limiteren
forbruger en kvote-token — en ugyldig-input-loop kan ellers stille dræne demoens kvote uden
at nogensinde levere en receipt (rå ValueError fra firewall.check_action's fail-loud-guard
ville ellers både forbruge kvote OG propagere ubehandlet til transport-laget, hvilket
bryder "check_action leverer ALTID en receipt/struktureret fejl"-disciplinen). Uden for
PUBLIC_DEMO uændret: fw.check_action's egen ValueError-fail-loud gælder stadig (bindende,
testet i test_values_firewall.py).
- `check_action_deterministic`: KUN Lag A — ingen LLM-kald overhovedet (billig, ren mekanisk, spejler consistency-gates
check_triple). Samme receipt-form som check_action, men values_assessment er altid tom,
values_assessment_unavailable altid false, og scope_note siger eksplicit
'values_layer_consulted:false'. Read-only.

PUBLIC_DEMO-mode: ÅBEN, GRATIS — ALDRIG rate-begrænset (spec §2, ingen LLM-kost). Vurderet
mod det offentlige Art-14-demo-charter; scope_note får demo-disclosuren appended.
- `list_charter`: Transparens: hvilke regler/principper håndhæver DENNE firewall lige nu — navn/version/
hard_rules/outward_patterns/principles. Values-locked (arvet): firewall'en håndhæver KUN
dette deklarerede charter, opfinder aldrig regler/principper udenfor det.

PUBLIC_DEMO-mode: ÅBEN, GRATIS — ALDRIG rate-begrænset. Viser det OFFENTLIGE Art-14-demo-
charter (6 principper, 4 hard_rules, 14 outward_patterns) — ikke noget kunde-/fleet-/
TIER-1-charter. Får et `scope_note`-felt med demo-disclosuren tilføjet (fraværende i
default-mode — additiv, ingen bestående felter ændres).