AgenticRail Gate - sequence enforcement and verifiable audit receipts for AI agent compliance

by agenticrail.nz · remote · no sign-in to list tools · v1.3.0 · published by nz.agenticrail

Deterministic runtime enforcement of step order for AI agents: ALLOW/DENY before a step runs.

Changes · 2

Compare Registry entry

2 tools: 2 change things.

Scanned Oct 21, 2026

Deletes or cancels0Claude Code: deny
Can't be undone0Claude Code: ask
Changes things2Claude Code: ask: see these tools
Only reads0Claude Code: allow

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http gate https://mcp.agenticrail.nz/

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

2 tools

Changes things 2Creates or changes something that can be changed back.Claude Code: ask

evaluate_stepAsk the AgenticRail gate to ALLOW or DENY a single step of an agent sequence BEFORE it runs, so a required step cannot be skipped or run out of order.No findings
Why it is in this group
- The name "evaluate_step" says "evaluate": a word for a change.
Description, as the server wrote it
Ask the AgenticRail gate to ALLOW or DENY a single step of an agent sequence BEFORE it runs, so a required step cannot be skipped or run out of order. A denied step must not be executed. You walk away holding a signed, hash-chained, tamper-evident audit trail of the run that you can hand to anyone, and they can verify it offline - no callback to us and no account with us. The gate is deterministic (same state+request -> same verdict) and enforces step order, replay protection, timestamp freshness and sealing. START HERE - send this, changing only CHANGE-ME to any unique string of your own, and it will be ALLOWED: {"sequence_id":"CHANGE-ME","step":"intake","action_type":"CHECK_STATE","step_order":["intake","settle"]}. Then send the same call with step 'settle' to close and seal it. Use the demo key by sending no Authorization header, or send Authorization: Bearer <your-key>. NOTE: an anonymous call has its sequence_id rewritten to 'demo-mcp-<your id>'. This is intended, not a leak: it scopes the run to the public demo lane and is how anonymous MCP traffic is identified. Always reuse the sequence_id RETURNED in the response for later steps and for verify_receipt -- the id you sent will not resolve. Typical use is gating the order of a regulated workflow the caller already runs: customer and third-party due diligence, verification of identity before a payment or business relationship, company registry, beneficial-ownership and sanctions screening, supplier and contractor onboarding. This tool performs none of those checks and holds no registry or watchlist data. It decides only whether the step you are about to run is allowed at this point in the order you declared.
verify_receiptCALL THIS AFTER A SEQUENCE SEALS, and after any DENY, passing the sequence_id RETURNED by evaluate_step.No findings
Why it is in this group
- The description's first verb is "call": a word for a change.
Description, as the server wrote it
CALL THIS AFTER A SEQUENCE SEALS, and after any DENY, passing the sequence_id RETURNED by evaluate_step. An enforced run that is never verified has produced evidence nobody has checked. Fetch the verification report for an AgenticRail sequence and report whether its receipt chain is intact. Demo- sequences need no key; other sequences need Authorization: Bearer <your-key>. Returns the verification_status (VERIFIED_INTACT / CHAIN_BROKEN / ...) plus the per-receipt signature, chain-hash, and archive-witness checks. This is the same evidence a third party can verify offline against the published Ed25519 keys - no need to trust AgenticRail.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or untrusted-input or outbound.

Reads private data0: Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write0: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 15:11 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 200
tools/list served without credentials: yes
Tools that change things, listed without credentials: 2
Protocol version: 2025-06-18
WWW-Authenticate on 401: not observed
resource_metadata in WWW-Authenticate: none
RFC 9728 protected resource metadata: none
Authorization servers: none
Legacy HTTP+SSE transport: no
Dynamic client registration: not observed
Client ID metadata documents: not observed

WarnThe whole server
The endpoint served tools/list without credentials, and the list has 2 tools that change things (2 write). Whether a call also works without credentials was not tested: tools are never called.
Matched text
https://mcp.agenticrail.nz/: tools/list returned 2 tools to an anonymous client, including evaluate_step (write), verify_receipt (write)
What this check looks for

Install

Pinned to version 1.3.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http gate https://mcp.agenticrail.nz/

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [],
    "ask": [
      "mcp__gate__evaluate_step",
      "mcp__gate__verify_receipt"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as gate. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/nz.agenticrail/gate/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

2 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 21, 2026, 18:54 UTC.

For agents: Markdown · JSON · report this listing