# AgenticRail Gate - sequence enforcement and verifiable audit receipts for AI agent compliance > Deterministic runtime enforcement of step order for AI agents: ALLOW/DENY before a step runs. - name: nz.agenticrail/gate - version: 1.3.0 - connection class: unknown (unknown) - trust: 74/100 - quality: 76/100 (good) - owner: not claimed - descriptor: https://api.protogrid.dev/v1/servers/nz.agenticrail%2Fgate - tools: https://api.protogrid.dev/v1/servers/nz.agenticrail%2Fgate/tools **Not classified yet.** The remote endpoints have not been probed successfully, or the listing has nothing to connect to. ## Connection (mcpServers) ```json { "mcpServers": { "gate": { "type": "http", "url": "https://mcp.agenticrail.nz/" } } } ``` ## Trust - hygiene: 100 - liveness: 27 - freshness: 100 - provenance: 85 - drivers: +repository +dns-namespace +website -unreachable(1 failures) +updated-24d-ago - Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. ## Quality 76/100 (good) ### protocol: 75 (weight 25) - warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28 - n/a `protocol.stateless`: only applies to 2026-07-28 servers - pass `protocol.transport`: streamable HTTP - n/a `protocol.list_ttl`: only applies to 2026-07-28 servers ### authorization: n/a (weight 15) - n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth - n/a `auth.secret_in_url`: no templated URL ### tool hygiene: 64 (weight 30) - pass `tools.descriptions`: every tool has a description - warn `tools.description_length`: 1 tools have descriptions over 1,024 characters, which crowds the context - pass `tools.schemas`: every tool has an object input schema - fail `tools.annotations`: no tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones - fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: evaluate_step (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); verify_receipt (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) - pass `tools.token_cost`: about 1,583 tokens to load every tool - pass `tools.api_dump`: tools are not a one-to-one API dump ### stability: 100 (weight 15) - pass `stability.changes`: 4 tool changes in 30 days - pass `stability.rug_pull`: no tool changed its meaning under the same name ### dependencies: n/a (weight 15) - n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package - tools: 2, about 1,583 tokens to load them all - tool set hash: e0f971478ddd5f50ffafbbdafd51ad42 - tools last changed: 2026-10-05T01:37:29.982Z - badge: [![protogrid quality](https://protogrid.dev/badge/nz.agenticrail/gate.svg)](https://protogrid.dev/servers/nz.agenticrail/gate) - Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. ### Tool changes - 2026-10-05 `verify_receipt` changed (description) - before: CALL THIS AFTER A SEQUENCE SEALS, and after any DENY, passing the sequence_id RETURNED by evaluate_step. An enforced run that is never verified has produced evidence nobody has checked. Fetch the verification report for an AgenticRail sequence and report whether its receipt chain is intact. Demo- sequences need no key; other sequences need Authorization: Bearer . Returns the verification_status (VERIFIED_INTACT / CHAIN_BROKEN / ...) plus the per-receipt signature, chain-hash, and archive-copy checks. This is the same evidence a third party can verify offline against the published Ed25519 keys - no need to trust AgenticRail. - after: CALL THIS AFTER A SEQUENCE SEALS, and after any DENY, passing the sequence_id RETURNED by evaluate_step. An enforced run that is never verified has produced evidence nobody has checked. Fetch the verification report for an AgenticRail sequence and report whether its receipt chain is intact. Demo- sequences need no key; other sequences need Authorization: Bearer . Returns the verification_status (VERIFIED_INTACT / CHAIN_BROKEN / ...) plus the per-receipt signature, chain-hash, and archive-witness checks. This is the same evidence a third party can verify offline against the published Ed25519 keys - no need to trust AgenticRail. - 2026-10-04 `evaluate_step` changed (inputSchema) - 2026-09-26 `verify_receipt` changed (description) - before: CALL THIS AFTER A SEQUENCE SEALS, and after any DENY, passing the sequence_id RETURNED by evaluate_step. An enforced run that is never verified has produced evidence nobody has checked. Fetch the verification report for an AgenticRail sequence and report whether its receipt chain is intact. Demo- sequences need no key; other sequences need Authorization: Bearer . Returns the verification_status (VERIFIED_INTACT / CHAIN_BROKEN / …) plus the per-receipt signature, chain-hash, and independent-archive checks. This is the same evidence a third party can verify offline against the published Ed25519 keys — no need to trust AgenticRail. - after: CALL THIS AFTER A SEQUENCE SEALS, and after any DENY, passing the sequence_id RETURNED by evaluate_step. An enforced run that is never verified has produced evidence nobody has checked. Fetch the verification report for an AgenticRail sequence and report whether its receipt chain is intact. Demo- sequences need no key; other sequences need Authorization: Bearer . Returns the verification_status (VERIFIED_INTACT / CHAIN_BROKEN / ...) plus the per-receipt signature, chain-hash, and archive-copy checks. This is the same evidence a third party can verify offline against the published Ed25519 keys - no need to trust AgenticRail. - 2026-09-26 `evaluate_step` changed (description) - before: Ask the AgenticRail gate to ALLOW or DENY a single step of an agent sequence BEFORE it runs. A denied step must not be executed. You walk away holding a signed, hash-chained record of the run that you can hand to anyone, and they can verify it offline - no callback to us and no account with us. The gate is deterministic (same state+request -> same verdict) and enforces step order, replay protection, timestamp freshness and sealing. START HERE - send this, changing only CHANGE-ME to any unique string of your own, and it will be ALLOWED: {"sequence_id":"CHANGE-ME","step":"intake","action_type":"CHECK_STATE","step_order":["intake","settle"]}. Then send the same call with step 'settle' to close and seal it. Use the demo key by sending no Authorization header, or send Authorization: Bearer . NOTE: an anonymous call has its sequence_id rewritten to 'demo-mcp-'. This is intended, not a leak: it scopes the run to the public demo lane and is how anonymous MCP traffic is identified. Always reuse the sequence_id RETURNED in the response for later steps and for verify_receipt -- the id you sent will not resolve. Typical use is gating the order of a regulated workflow the caller already runs: customer and third-party due diligence, verification of identity before a payment or business relationship, company registry, beneficial-ownership and sanctions screening, supplier and contractor onboarding. This tool performs none of those checks and holds no registry or watchlist data. It decides only whether the step you are about to run is allowed at this point in the order you declared. - after: Ask the AgenticRail gate to ALLOW or DENY a single step of an agent sequence BEFORE it runs, so a required step cannot be skipped or run out of order. A denied step must not be executed. You walk away holding a signed, hash-chained, tamper-evident audit trail of the run that you can hand to anyone, and they can verify it offline - no callback to us and no account with us. The gate is deterministic (same state+request -> same verdict) and enforces step order, replay protection, timestamp freshness and sealing. START HERE - send this, changing only CHANGE-ME to any unique string of your own, and it will be ALLOWED: {"sequence_id":"CHANGE-ME","step":"intake","action_type":"CHECK_STATE","step_order":["intake","settle"]}. Then send the same call with step 'settle' to close and seal it. Use the demo key by sending no Authorization header, or send Authorization: Bearer . NOTE: an anonymous call has its sequence_id rewritten to 'demo-mcp-'. This is intended, not a leak: it scopes the run to the public demo lane and is how anonymous MCP traffic is identified. Always reuse the sequence_id RETURNED in the response for later steps and for verify_receipt -- the id you sent will not resolve. Typical use is gating the order of a regulated workflow the caller already runs: customer and third-party due diligence, verification of identity before a payment or business relationship, company registry, beneficial-ownership and sanctions screening, supplier and contractor onboarding. This tool performs none of those checks and holds no registry or watchlist data. It decides only whether the step you are about to run is allowed at this point in the order you declared. Full history: https://api.protogrid.dev/v1/servers/nz.agenticrail%2Fgate/changes ## Remotes - https://mcp.agenticrail.nz/ (streamable-http, auth none, reachable false, uptime30d 0.9285714) ## Packages _none_ ## Tools (2) - `evaluate_step`: Ask the AgenticRail gate to ALLOW or DENY a single step of an agent sequence BEFORE it runs, so a required step cannot be skipped or run out of order. A denied step must not be executed. You walk away holding a signed, hash-chained, tamper-evident audit trail of the run that you can hand to anyone, and they can verify it offline - no callback to us and no account with us. The gate is deterministic (same state+request -> same verdict) and enforces step order, replay protection, timestamp freshness and sealing. START HERE - send this, changing only CHANGE-ME to any unique string of your own, and it will be ALLOWED: {"sequence_id":"CHANGE-ME","step":"intake","action_type":"CHECK_STATE","step_order":["intake","settle"]}. Then send the same call with step 'settle' to close and seal it. Use the demo key by sending no Authorization header, or send Authorization: Bearer . NOTE: an anonymous call has its sequence_id rewritten to 'demo-mcp-'. This is intended, not a leak: it scopes the run to the public demo lane and is how anonymous MCP traffic is identified. Always reuse the sequence_id RETURNED in the response for later steps and for verify_receipt -- the id you sent will not resolve. Typical use is gating the order of a regulated workflow the caller already runs: customer and third-party due diligence, verification of identity before a payment or business relationship, company registry, beneficial-ownership and sanctions screening, supplier and contractor onboarding. This tool performs none of those checks and holds no registry or watchlist data. It decides only whether the step you are about to run is allowed at this point in the order you declared. - `verify_receipt`: CALL THIS AFTER A SEQUENCE SEALS, and after any DENY, passing the sequence_id RETURNED by evaluate_step. An enforced run that is never verified has produced evidence nobody has checked. Fetch the verification report for an AgenticRail sequence and report whether its receipt chain is intact. Demo- sequences need no key; other sequences need Authorization: Bearer . Returns the verification_status (VERIFIED_INTACT / CHAIN_BROKEN / ...) plus the per-receipt signature, chain-hash, and archive-witness checks. This is the same evidence a third party can verify offline against the published Ed25519 keys - no need to trust AgenticRail.