Skip to content

MCP Verification Gate: check an MCP server or an A2A agent before you connect or delegate

by ogasurfproject-jpg · remote · no sign-in to list tools · v0.4.20 · published by GitHub user ogasurfproject-jpg

Check an A2A agent before you delegate, or an MCP server's measured conduct. Free, no key.

Changes · 4
CompareRegistry entry

6 tools: 4 change things and 2 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http hs-verify-gate https://gate.horizonshield.dev/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warnpreflight_agent

    The server marks "preflight_agent" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "call": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

6 tools

Changes things 4Claude Code: ask
  • check_conformanceMeasure a public MCP endpoint against five conditions: it speaks MCP, it publishes an A2A agent card, it declares who pays it, identical input returns identical output, and the ver…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Measure a public MCP endpoint against five conditions: it speaks MCP, it publishes an A2A agent card, it declares who pays it, identical input returns identical output, and the verdict itself can be recomputed by anyone. Free, no key. Conformance and disclosure only; this says nothing about whether any figure the checked server returns is correct. By default no tool on the checked server is called, so determinism comes back as not measured rather than guessed. It is measured when the owner has published /.well-known/mcp-conduct.json with allow_tool_call true.

    Annotations the server declares

    • title: Check an MCP server for conformance and disclosure
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • is_verifiedA single machine-first answer for an agent deciding whether to trust an MCP endpoint BEFORE it connects.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    A single machine-first answer for an agent deciding whether to trust an MCP endpoint BEFORE it connects. Returns verified (true only when the latest scheduled measurement passed every measured condition; null otherwise, never false), a state enum saying which case it is, measured_at, and a record_sha256 with a recompute_url so you can check the verdict without trusting this gate. Reads the stored register only: it contacts nothing and measures nothing. Absent and pending are reported honestly and are NOT negative verdicts. For a fresh measurement rather than the stored one, use check_conformance.

    Annotations the server declares

    • title: One glance: is this MCP server verified, with proof
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • preflight_agentCall this before handing work to an A2A agent you have not used before.1 finding

    Why it is in this group

    • The description's first verb is "call": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "preflight_agent" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "call": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Call this before handing work to an A2A agent you have not used before. Fetches the agent's public card (https://<agent>/.well-known/agent-card.json, one request), reports whether it declares the A2A Conduct Extension, who it says pays it (the compensation declaration, as declared and not verified), whether the card carries a signature, the endpoints it asks to be measured on, and this register's stored reading for each (verified is true only when the latest scheduled measurement passed; null otherwise, never false), plus where to file your own witness walk. Measures nothing new and returns counts and pointers, never a score. An agent that does not declare the extension is reported as such, which is not a negative verdict.

    Annotations the server declares

    • title: Before delegating: check an A2A agent's card, who pays it, and its register reading
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • verify_verdictTake a verdict this gate issued and recompute its record_sha256 independently.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Take a verdict this gate issued and recompute its record_sha256 independently. Removes record_sha256 and recompute_note, serialises the remainder in key order, and hashes it. Returns whether the verdict was altered after it was issued. You do not have to trust the party that issued the verdict, including this one.

    Annotations the server declares

    • title: Recompute a verdict hash without trusting the issuer
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 2Claude Code: allow
  • get_conditionsReturn the five conditions this gate measures, what it explicitly does not verify, and the tier definitions.No findings

    Why it is in this group

    • The name "get_conditions" says "get": a word for reading.
    Description, as the server wrote it
    Return the five conditions this gate measures, what it explicitly does not verify, and the tier definitions. Takes no arguments and returns identical output every time. Read this before running a check so you know what a verdict does and does not claim.

    Annotations the server declares

    • title: Get the conformance conditions
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • lookup_serverReturns one record (not a list).No findings

    Why it is in this group

    • The name "lookup_server" says "lookup": a word for reading.
    Description, as the server wrote it
    Returns one record (not a list). Look up what this register already holds about an MCP endpoint: whether it is watched, how often it is re-measured, how many measurements exist, when the first and latest were taken, and the latest verdict with the record_sha256 you can recompute yourself. Reads stored measurements only. It contacts nothing and measures nothing, so use check_conformance for a fresh reading. An endpoint that is absent is reported as absent and that is NOT a negative verdict: it means nobody has measured it here, not that it failed.

    Annotations the server declares

    • title: Look up an MCP server on this register
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.4.20. Values in angle brackets are yours to fill in.

claude mcp add --transport http hs-verify-gate https://gate.horizonshield.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__hs-verify-gate__get_conditions",
      "mcp__hs-verify-gate__lookup_server"
    ],
    "ask": [
      "mcp__hs-verify-gate__check_conformance",
      "mcp__hs-verify-gate__verify_verdict",
      "mcp__hs-verify-gate__is_verified",
      "mcp__hs-verify-gate__preflight_agent"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as hs-verify-gate. Review it before you use it.