# Agent Trust Firewall

> Free pre-action policy checks and data cleaning for autonomous AI agents.

- name: io.github.Benji18sport/agent-trust-firewall
- version: 1.5.0
- connection class: R0 (autonomous)
- trust: 93/100
- quality: 86/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.Benji18sport%2Fagent-trust-firewall
- tools: https://api.protogrid.dev/v1/servers/io.github.Benji18sport%2Fagent-trust-firewall/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "agent-trust-firewall": {
      "type": "http",
      "url": "https://agent-trust-firewall.andrea-vignoni.workers.dev/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 97
- freshness: 100
- provenance: 80
- drivers: +repository +namespace-matches-repo +reachable +uptime-93% +updated-8d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 86/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 5 of 5 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 2,910 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 75 (weight 15)

- warn `stability.changes`: 9 tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 5, about 2,910 tokens to load them all
- tool set hash: 16e15286258a78d05090d3a3d0a114d5
- tools last changed: 2026-11-01T01:08:15.240Z
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.Benji18sport/agent-trust-firewall.svg)](https://protogrid.dev/servers/io.github.Benji18sport/agent-trust-firewall)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-11-01 `data_clean` removed
  - Data Cleaner — deterministic advisory policy or data processing. Free pilot. Caller must enforce BLOCK.
- 2026-11-01 `trust_firewall` removed
  - Agent Trust Firewall — deterministic advisory policy or data processing. Free pilot. Caller must enforce BLOCK.
- 2026-11-01 `trust_spend_guard` removed
  - Agent Trust Spend Guard — deterministic advisory policy or data processing. Free pilot. Caller must enforce BLOCK.
- 2026-11-01 `trust_validate` removed
  - Agent Trust Validate — deterministic advisory policy or data processing. Free pilot. Caller must enforce BLOCK.
- 2026-11-01 `trust_get_capabilities` added
  - Discover the deployed version, request/row limits, tool names, legacy call aliases and check-clean-recheck workflow before integrating. Pass {}: this inventory endpoint accepts no action, policy or filter arguments; use tools/list for callable schemas and trust_check_action for a verdict. The response explains enforcement and limitations, not stored policy or decision history: rules must accompany each check. Free and unauthenticated, with operational usage metadata recorded but no request-body storage. Re-read after a deployment to detect capability changes.
- 2026-11-01 `trust_clean_data` added
  - Audit and optionally clean up to 500 JSON rows, returning cleaned_rows, original zero-based issues and counts. Processing order is trim, primary-key deduplication, then required/range checks: keys " a " and "a" collide after trimming. Duplicate removal keeps the first row and skips later-row field checks; missing keys are retained and flagged. REVIEW persists even after repair, so inspect issues before use; [] returns ALLOW. Numeric strings are not converted or range-checked; use trust_validate_data for type enforcement. Only top-level strings are trimmed; inputs are not mutated. Free, unauthenticated, stateless pilot: rules apply only to this call. Usage metadata is recorded; request bodies are not stored.
- 2026-11-01 `trust_validate_data` added
  - Validate JSON field presence, exact types, primitive enums and inclusive numeric bounds, returning ALLOW/BLOCK, field reasons and checked_fields. Combine required:true, type:"integer" and min:1 for a positive mandatory quantity: min alone neither requires a value nor rejects numeric strings. Missing, null or empty optional values skip the other constraints; 0 and false do not. For nested data, fields["order.total"] addresses a leaf; allow_extra:false compares top-level keys, so keep it true for dot-path rules. Use trust_clean_data for transformations or trust_check_action for evidence/spending checks. This validates structure, not facts or provenance. Free, unauthenticated, stateless pilot: rules apply only to this call. Usage metadata is recorded; request bodies are not stored.
- 2026-11-01 `trust_check_spend` added
  - Compare a proposed spend with a remaining budget, transaction ceiling and merchant allowlist, returning ALLOW/BLOCK with reasons. Budget and ceiling are independent: amount=4, remaining_budget=10, per_transaction_limit=3 returns BLOCK; equality passes. Use one currency/unit, and update remaining_budget in your application after each actual purchase: this tool neither tracks cumulative spending nor converts currencies. Omitting allowed_merchants skips merchant checks; supplying it requires an exact merchant match, and [] blocks all merchants. Use trust_check_action to include evidence or data checks. Enforce BLOCK before paying; this tool never accesses a wallet or executes payment. Free, unauthenticated, stateless pilot: rules apply only to this call. Usage metadata is recorded; request bodies are not stored.
- 2026-11-01 `trust_check_action` added
  - Evaluate a proposed action against evidence, source allowlists, data constraints and payment limits, returning ALLOW/BLOCK with reason codes. All enabled checks must pass: evidence cannot override an over-budget payment. Set action.type to payment to activate spending checks and pass its amount with remaining_budget; contract applies to data, not action. Use this gate before execution, trust_check_spend for budget alone, or trust_validate_data for structure alone. Enforce BLOCK and fail closed on errors. Source labels are unauthenticated; instruction scanning is a limited phrase heuristic. No action execution, wallet access, policy storage or decision history. Free, unauthenticated, stateless pilot: rules apply only to this call. Usage metadata is recorded; request bodies are not stored.

Full history: https://api.protogrid.dev/v1/servers/io.github.Benji18sport%2Fagent-trust-firewall/changes

## Remotes

- https://agent-trust-firewall.andrea-vignoni.workers.dev/mcp (streamable-http, auth none, reachable true, uptime30d 0.93333334)

## Packages

_none_

## Tools (5)

- `trust_check_action`: Evaluate a proposed action against evidence, source allowlists, data constraints and payment limits, returning ALLOW/BLOCK with reason codes. All enabled checks must pass: evidence cannot override an over-budget payment. Set action.type to payment to activate spending checks and pass its amount with remaining_budget; contract applies to data, not action. Use this gate before execution, trust_check_spend for budget alone, or trust_validate_data for structure alone. Enforce BLOCK and fail closed on errors. Source labels are unauthenticated; instruction scanning is a limited phrase heuristic. No action execution, wallet access, policy storage or decision history. Free, unauthenticated, stateless pilot: rules apply only to this call. Usage metadata is recorded; request bodies are not stored.
- `trust_check_spend`: Compare a proposed spend with a remaining budget, transaction ceiling and merchant allowlist, returning ALLOW/BLOCK with reasons. Budget and ceiling are independent: amount=4, remaining_budget=10, per_transaction_limit=3 returns BLOCK; equality passes. Use one currency/unit, and update remaining_budget in your application after each actual purchase: this tool neither tracks cumulative spending nor converts currencies. Omitting allowed_merchants skips merchant checks; supplying it requires an exact merchant match, and [] blocks all merchants. Use trust_check_action to include evidence or data checks. Enforce BLOCK before paying; this tool never accesses a wallet or executes payment. Free, unauthenticated, stateless pilot: rules apply only to this call. Usage metadata is recorded; request bodies are not stored.
- `trust_clean_data`: Audit and optionally clean up to 500 JSON rows, returning cleaned_rows, original zero-based issues and counts. Processing order is trim, primary-key deduplication, then required/range checks: keys " a " and "a" collide after trimming. Duplicate removal keeps the first row and skips later-row field checks; missing keys are retained and flagged. REVIEW persists even after repair, so inspect issues before use; [] returns ALLOW. Numeric strings are not converted or range-checked; use trust_validate_data for type enforcement. Only top-level strings are trimmed; inputs are not mutated. Free, unauthenticated, stateless pilot: rules apply only to this call. Usage metadata is recorded; request bodies are not stored.
- `trust_get_capabilities`: Discover the deployed version, request/row limits, tool names, legacy call aliases and check-clean-recheck workflow before integrating. Pass {}: this inventory endpoint accepts no action, policy or filter arguments; use tools/list for callable schemas and trust_check_action for a verdict. The response explains enforcement and limitations, not stored policy or decision history: rules must accompany each check. Free and unauthenticated, with operational usage metadata recorded but no request-body storage. Re-read after a deployment to detect capability changes.
- `trust_validate_data`: Validate JSON field presence, exact types, primitive enums and inclusive numeric bounds, returning ALLOW/BLOCK, field reasons and checked_fields. Combine required:true, type:"integer" and min:1 for a positive mandatory quantity: min alone neither requires a value nor rejects numeric strings. Missing, null or empty optional values skip the other constraints; 0 and false do not. For nested data, fields["order.total"] addresses a leaf; allow_extra:false compares top-level keys, so keep it true for dot-path rules. Use trust_clean_data for transformations or trust_check_action for evidence/spending checks. This validates structure, not facts or provenance. Free, unauthenticated, stateless pilot: rules apply only to this call. Usage metadata is recorded; request bodies are not stored.