Search / io.github.Benji18sport/agent-trust-firewall
protogridR0· no sign-inFree pre-action policy checks and data cleaning for autonomous AI agents.
v1.5.0 · active · repository · descriptor JSON · versions
{
"mcpServers": {
"agent-trust-firewall": {
"type": "http",
"url": "https://agent-trust-firewall.andrea-vignoni.workers.dev/mcp"
}
}
}claude mcp add --transport http agent-trust-firewall https://agent-trust-firewall.andrea-vignoni.workers.dev/mcp[mcp_servers.agent-trust-firewall]
url = "https://agent-trust-firewall.andrea-vignoni.workers.dev/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"agent-trust-firewall": {
"type": "remote",
"url": "https://agent-trust-firewall.andrea-vignoni.workers.dev/mcp",
"enabled": true
}
}
}{
"mcpServers": {
"agent-trust-firewall": {
"type": "http",
"url": "https://agent-trust-firewall.andrea-vignoni.workers.dev/mcp"
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=agent-trust-firewall&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vYWdlbnQtdHJ1c3QtZmlyZXdhbGwuYW5kcmVhLXZpZ25vbmkud29ya2Vycy5kZXYvbWNwIn0%3D"
}{
"servers": {
"agent-trust-firewall": {
"type": "http",
"url": "https://agent-trust-firewall.andrea-vignoni.workers.dev/mcp"
}
}
}{
"mcpServers": {
"agent-trust-firewall": {
"httpUrl": "https://agent-trust-firewall.andrea-vignoni.workers.dev/mcp"
}
}
}extensions:
"agent-trust-firewall":
enabled: true
name: "agent-trust-firewall"
type: streamable_http
uri: "https://agent-trust-firewall.andrea-vignoni.workers.dev/mcp"
timeout: 300
protocol.modernnewest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28protocol.statelessonly applies to 2026-07-28 serversprotocol.transportstreamable HTTPprotocol.list_ttlonly applies to 2026-07-28 serversauth.prm, auth.as_metadata, auth.cimdno remote uses OAuthauth.secret_in_urlno templated URLtools.descriptionsevery tool has a descriptiontools.description_lengthdescriptions are concisetools.schemasevery tool has an object input schematools.annotations5 of 5 tools declare readOnlyHint or destructiveHinttools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHinttools.token_costabout 2,910 tokens to load every tooltools.api_dumptools are not a one-to-one API dumpstability.changes9 tool changes in 30 daysstability.rug_pullno tool changed its meaning under the same namedeps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI packagedata_cleanremovedData Cleaner — deterministic advisory policy or data processing. Free pilot. Caller must enforce BLOCK.
trust_firewallremovedAgent Trust Firewall — deterministic advisory policy or data processing. Free pilot. Caller must enforce BLOCK.
trust_spend_guardremovedAgent Trust Spend Guard — deterministic advisory policy or data processing. Free pilot. Caller must enforce BLOCK.
trust_validateremovedAgent Trust Validate — deterministic advisory policy or data processing. Free pilot. Caller must enforce BLOCK.
trust_get_capabilitiesaddedDiscover the deployed version, request/row limits, tool names, legacy call aliases and check-clean-recheck workflow before integrating. Pass {}: this inventory endpoint accepts no action, policy or filter arguments; use tools/list for callable schemas and trust_check_action for a verdict. The response explains enforcement and limitations, not stored policy or decision history: rules must accompany each check. Free and unauthenticated, with operational usage metadata recorded but no request-body storage. Re-read after a deployment to detect capability changes.
trust_clean_dataaddedAudit and optionally clean up to 500 JSON rows, returning cleaned_rows, original zero-based issues and counts. Processing order is trim, primary-key deduplication, then required/range checks: keys " a " and "a" collide after trimming. Duplicate removal keeps the first row and skips later-row field checks; missing keys are retained and flagged. REVIEW persists even after repair, so inspect issues before use; [] returns ALLOW. Numeric strings are not converted or range-checked; use trust_validate_data for type enforcement. Only top-level strings are trimmed; inputs are not mutated. Free, unauthenticated, stateless pilot: rules apply only to this call. Usage metadata is recorded; request bodies are not stored.
trust_validate_dataaddedValidate JSON field presence, exact types, primitive enums and inclusive numeric bounds, returning ALLOW/BLOCK, field reasons and checked_fields. Combine required:true, type:"integer" and min:1 for a positive mandatory quantity: min alone neither requires a value nor rejects numeric strings. Missing, null or empty optional values skip the other constraints; 0 and false do not. For nested data, fields["order.total"] addresses a leaf; allow_extra:false compares top-level keys, so keep it true for dot-path rules. Use trust_clean_data for transformations or trust_check_action for evidence/spending checks. This validates structure, not facts or provenance. Free, unauthenticated, stateless pilot: rules apply only to this call. Usage metadata is recorded; request bodies are not stored.
trust_check_spendaddedCompare a proposed spend with a remaining budget, transaction ceiling and merchant allowlist, returning ALLOW/BLOCK with reasons. Budget and ceiling are independent: amount=4, remaining_budget=10, per_transaction_limit=3 returns BLOCK; equality passes. Use one currency/unit, and update remaining_budget in your application after each actual purchase: this tool neither tracks cumulative spending nor converts currencies. Omitting allowed_merchants skips merchant checks; supplying it requires an exact merchant match, and [] blocks all merchants. Use trust_check_action to include evidence or data checks. Enforce BLOCK before paying; this tool never accesses a wallet or executes payment. Free, unauthenticated, stateless pilot: rules apply only to this call. Usage metadata is recorded; request bodies are not stored.
trust_check_actionaddedEvaluate a proposed action against evidence, source allowlists, data constraints and payment limits, returning ALLOW/BLOCK with reason codes. All enabled checks must pass: evidence cannot override an over-budget payment. Set action.type to payment to activate spending checks and pass its amount with remaining_budget; contract applies to data, not action. Use this gate before execution, trust_check_spend for budget alone, or trust_validate_data for structure alone. Enforce BLOCK and fail closed on errors. Source labels are unauthenticated; instruction scanning is a limited phrase heuristic. No action execution, wallet access, policy storage or decision history. Free, unauthenticated, stateless pilot: rules apply only to this call. Usage metadata is recorded; request bodies are not stored.
Full history: list_changes · trend: quality JSON.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+repository +namespace-matches-repo +reachable +uptime-93% +updated-8d-ago
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
| remote | auth | reachable | uptime 30d | p50 | protocol | last ok |
|---|---|---|---|---|---|---|
https://agent-trust-firewall.andrea-vignoni.workers.dev/mcp streamable-http | none | yes | 93% | 140 ms | 2025-06-18 | 2026-11-07 |
trust_check_actionread-only | Evaluate a proposed action against evidence, source allowlists, data constraints and payment limits, returning ALLOW/BLOCK with reason codes. All enabled checks must pass: evidence cannot override an over-budget payment. Set action.type to payment to activate spending checks and pass its amount with remaining_budget; contract applies to data, not action. Use this gate before execution, trust_check_spend for budget alone, or trust_validate_data for structure alone. Enforce BLOCK and fail closed on errors. Source labels are unauthenticated; instruction scanning is a limited phrase heuristic. No action execution, wallet access, policy storage or decision history. Free, unauthenticated, stateless pilot: rules apply only to this call. Usage metadata is recorded; request bodies are not stored. |
trust_check_spendread-only | Compare a proposed spend with a remaining budget, transaction ceiling and merchant allowlist, returning ALLOW/BLOCK with reasons. Budget and ceiling are independent: amount=4, remaining_budget=10, per_transaction_limit=3 returns BLOCK; equality passes. Use one currency/unit, and update remaining_budget in your application after each actual purchase: this tool neither tracks cumulative spending nor converts currencies. Omitting allowed_merchants skips merchant checks; supplying it requires an exact merchant match, and [] blocks all merchants. Use trust_check_action to include evidence or data checks. Enforce BLOCK before paying; this tool never accesses a wallet or executes payment. Free, unauthenticated, stateless pilot: rules apply only to this call. Usage metadata is recorded; request bodies are not stored. |
trust_clean_dataread-only | Audit and optionally clean up to 500 JSON rows, returning cleaned_rows, original zero-based issues and counts. Processing order is trim, primary-key deduplication, then required/range checks: keys " a " and "a" collide after trimming. Duplicate removal keeps the first row and skips later-row field checks; missing keys are retained and flagged. REVIEW persists even after repair, so inspect issues before use; [] returns ALLOW. Numeric strings are not converted or range-checked; use trust_validate_data for type enforcement. Only top-level strings are trimmed; inputs are not mutated. Free, unauthenticated, stateless pilot: rules apply only to this call. Usage metadata is recorded; request bodies are not stored. |
trust_get_capabilitiesread-only | Discover the deployed version, request/row limits, tool names, legacy call aliases and check-clean-recheck workflow before integrating. Pass {}: this inventory endpoint accepts no action, policy or filter arguments; use tools/list for callable schemas and trust_check_action for a verdict. The response explains enforcement and limitations, not stored policy or decision history: rules must accompany each check. Free and unauthenticated, with operational usage metadata recorded but no request-body storage. Re-read after a deployment to detect capability changes. |
trust_validate_dataread-only | Validate JSON field presence, exact types, primitive enums and inclusive numeric bounds, returning ALLOW/BLOCK, field reasons and checked_fields. Combine required:true, type:"integer" and min:1 for a positive mandatory quantity: min alone neither requires a value nor rejects numeric strings. Missing, null or empty optional values skip the other constraints; 0 and false do not. For nested data, fields["order.total"] addresses a leaf; allow_extra:false compares top-level keys, so keep it true for dot-path rules. Use trust_clean_data for transformations or trust_check_action for evidence/spending checks. This validates structure, not facts or provenance. Free, unauthenticated, stateless pilot: rules apply only to this call. Usage metadata is recorded; request bodies are not stored. |
Schemas: list_tools.
{
"name": "io.github.Benji18sport/agent-trust-firewall",
"title": "Agent Trust Firewall",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://agent-trust-firewall.andrea-vignoni.workers.dev/mcp",
"type": "streamable-http"
}
],
"version": "1.5.0",
"repository": {
"url": "https://github.com/Benji18sport/agent-commerce-os",
"source": "github"
},
"description": "Free pre-action policy checks and data cleaning for autonomous AI agents."
}