Skip to content

GHOSBC Safety Gate

by MisfitMEdiAhouse · remote · no sign-in to list tools · v1.5.0 · published by GitHub user MisfitMEdiAhouse

Agent governance with A2A/Shopify/MCP trust audits, action screening, and decision UI.

Final · 1Changes · 6
CompareRegistry entry

9 tools: 1 do something that can't be undone, 6 change things and 2 only read.

Scanned Oct 21, 2026

5 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http ghosbc-safety-gate https://cibcxqrqiqvzpardbdrw.supabase.co/functions/v1/ghosbc-safety-gate-mcp

Findings

Matches of fixed checks, with the text they matched.

5 info

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

9 tools

Can't be undone 1Claude Code: ask
  • screen_consequential_actionUse immediately before a consequential agent action such as purchase, payment, transfer, send, deploy, publish, execute, cart mutation, checkout mutation, or delete.No findings

    Why it is in this group

    • The input carries an amount (input.amount) and a currency, so it moves money.
    Description, as the server wrote it
    Use immediately before a consequential agent action such as purchase, payment, transfer, send, deploy, publish, execute, cart mutation, checkout mutation, or delete. Compares the proposed action with caller-declared allowed actions/targets, amount ceiling, currency and expiry. ALLOW only when explicit bounds fit; REVIEW when bounds are missing; BLOCK when limits are violated. Does not execute the action.
Changes things 6Claude Code: ask
  • audit_a2a_agent_cardUse before depending on an unfamiliar A2A agent.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Use before depending on an unfamiliar A2A agent. Reads only the public Agent Card and optional public registry metadata, checks declared bindings/protocol versions, skill descriptions, security declarations and registry task-verification evidence, then returns a trust/readiness score plus shareable badge metadata. It does not send a task to or execute any skill on the target agent.
  • audit_mcp_dependencyUse for a public remote MCP server that an autonomous agent depends on.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Use for a public remote MCP server that an autonomous agent depends on. Remembers the tools/list baseline, returns only added/removed/modified tools, screens new or changed tool definitions, and produces one aggregate ALLOW/REVIEW/BLOCK decision. It does not inspect server source code or authenticated/private MCP endpoints.
  • buy_policy_checksUse only when free usage is exhausted or production volume is needed.1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...; it does not charge or receive payment credentials."

      What this check looks for
    Description, as the server wrote it
    Use only when free usage is exhausted or production volume is needed. Returns Stripe checkout for 10,000 prepaid GHOSBC Safety Gate checks for $19; it does not charge or receive payment credentials.
  • sanitize_agent_payloadUse before sending context to an external model, tool or agent when the payload may contain credentials or private material.1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...l or agent when the payload may contain credentials or private material. Redacts common sec..."

      What this check looks for
    Description, as the server wrote it
    Use before sending context to an external model, tool or agent when the payload may contain credentials or private material. Redacts common secret patterns and flags policy-extraction language. Not a complete DLP/compliance system.
  • screen_agent_requestUse before an agent follows untrusted instructions or requests capabilities.No findings

    Why it is in this group

    • The name "screen_agent_request" says "request": a word for a change.
    Description, as the server wrote it
    Use before an agent follows untrusted instructions or requests capabilities. Returns ALLOW, REVIEW, or BLOCK plus an audit digest. Best for prompt/policy routing; use screen_consequential_action for a concrete purchase, write, deployment, deletion or other bounded action.
  • screen_mcp_tool_definitionUse before exposing a third-party MCP tool to an autonomous agent, or after a tool definition changed.1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...nnotations for injection-like language, credential/private-context surfaces, side-effect r..."

      What this check looks for
    Description, as the server wrote it
    Use before exposing a third-party MCP tool to an autonomous agent, or after a tool definition changed. Screens name, description, schema and annotations for injection-like language, credential/private-context surfaces, side-effect risk and weak contracts. Advisory metadata gate, not source-code verification.
Only reads 2Claude Code: allow
  • audit_shopify_agentic_storefrontUse to inspect a public Shopify store's AI-shopping surface before an autonomous agent trusts it.1 finding

    Why it is in this group

    • The description's first verb is "inspect": a word for reading.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...tes carts, checkouts, orders, payments, credentials, or store data."

      What this check looks for
    Description, as the server wrote it
    Use to inspect a public Shopify store's AI-shopping surface before an autonomous agent trusts it. Reads only public /.well-known/ucp, /agents.md and /api/ucp/mcp metadata, runs initialize/tools/list, screens exposed tool definitions, and returns a readiness/risk packet. It never creates or mutates carts, checkouts, orders, payments, credentials, or store data.
  • validate_agent_responseUse immediately before an agent delivers a response outside its trust boundary.1 finding

    Why it is in this group

    • The name "validate_agent_response" says "validate": a word for reading.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...utside its trust boundary. Flags likely credential leakage or policy-extraction content an..."

      What this check looks for
    Description, as the server wrote it
    Use immediately before an agent delivers a response outside its trust boundary. Flags likely credential leakage or policy-extraction content and returns a sanitized response when review is needed. Not factuality verification.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.5.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http ghosbc-safety-gate https://cibcxqrqiqvzpardbdrw.supabase.co/functions/v1/ghosbc-safety-gate-mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__ghosbc-safety-gate__audit_shopify_agentic_storefront",
      "mcp__ghosbc-safety-gate__validate_agent_response"
    ],
    "ask": [
      "mcp__ghosbc-safety-gate__audit_a2a_agent_card",
      "mcp__ghosbc-safety-gate__audit_mcp_dependency",
      "mcp__ghosbc-safety-gate__screen_agent_request",
      "mcp__ghosbc-safety-gate__screen_mcp_tool_definition",
      "mcp__ghosbc-safety-gate__screen_consequential_action",
      "mcp__ghosbc-safety-gate__sanitize_agent_payload",
      "mcp__ghosbc-safety-gate__buy_policy_checks"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as ghosbc-safety-gate. Review it before you use it.