Gate form factor · AI agents
MCP wrapper
DemoModel Context Protocol decides which tool an agent may call. ENI6MA Gate decides whether that call is allowed to change the world (once, for this request, bound to this endpoint).
The split of responsibility
The MCP wrapper puts proof in front of MCP tools: MCP selects which tool runs; the Gate decides whether the world is allowed to change.ValidatedDEMO-HACK news-client /mcp with five tools, one side-effecting.
MCP owns tool selection
The protocol surfaces tools, schemas, and which function the model invoked. That layer does not prove the request is one-shot or endpoint-bound.
Gate owns world-changing authority
Before a side-effecting tool runs, Gate demands a request-bound envelope, burns the nonce, and validates the proof. A stolen or relayed proof fails.
What the demo shows
DEMO-HACK news-client exposes /mcp with five tools; one is side-effecting. Gate sits in front of the mutation path.
- Read-only tools can stay light; side-effecting tools require a fresh envelope.
- endpoint_id binding means a proof minted for tool A cannot authorize tool B.
- Replay dies at burn-before-validate: same order as every other Gate form factor.
- Status is Demo: runnable today for evaluation, not a supported purchase SKU yet.
Check order on MCP tools
Recompute the request hash
The gate hashes the body it actually received and compares it to the envelope.
Rejects: A body that was altered after the proof was made.
Check endpoint and policy
The envelope names the endpoint and the policy it was made for; both must match this route.
Rejects: A valid proof relayed to a different endpoint.
Confirm the circuit is active
The handle is resolved against the registry and must be active. Deactivating a handle is how revocation happens.
Rejects: A proof from a revoked identity.
Check freshness
The envelope timestamp must fall inside the freshness window configured for the route.
Rejects: A captured envelope replayed after the window closed.
Burn the nonce
The nonce is spent here, before the proof is validated. Every submission spends it, including one that is about to fail validation.
Rejects: Any second use of the same envelope. This is where replay dies.
Validate the proof
Only now is the proof itself checked, against the local binary or the registry. Both modes are equivalent at the envelope layer.
Rejects: A forged or malformed proof.
Apply application policy
Ordinary authorization runs in the post-proof zone: arguments, limits, and business rules.
Rejects: A well-proved request asking for something it is not allowed to ask for.
Serve the request
The application does its work, and the response is bound back to the request that earned it.
Holds under the reference architecture.
Configuration surface
Per-endpoint policy
endpoint_id, policy_hash, method allow-list, TTL, and use count (scoped to the route being protected).
Freshness window
Tune how long an envelope remains valid for each route. Captured envelopes die when the window closes.
Fail-open vs fail-closed
Choose reject-when-Control-is-unreachable, or an explicit break-glass path for emergency access.
Audit mode
hash_only for compact evidence, or full capture when you need the complete request transcript.
Each protected route carries its own policy: endpoint_id, policy_hash, method allow-list, TTL, and use count.ShippingPer-route Gate configuration surface on proxy and SDK form factors.
Who this is for
- Teams shipping MCP servers that can mutate systems of record.
- Security architects who need proof that agent tool calls are one-shot.
- Buyers evaluating Gate for AI agent and MCP server protection first.
Demo badge means you can run it and attack it with Verify. Production purchase paths start with proxy or SDK middleware under Beta.