A2a Trustgate

io.github.jysweePublished by GitHub account jysweev1.5.17Updated Nov 2, 2026

A2A TrustGate: 4-gate firewall that screens every AI-agent action before it runs. 50 tools.

The publisher's own server: Vips

VerifiedSSEWeb executableCloud & InfrastructureDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A2A TrustGate screens AI-agent actions through a 4-gate firewall before they run and logs every decision to an exportable audit trail.

What you can do
  • Screen commands and actions through a four-gate firewall that returns allow, block or needs-review
  • Run named pipelines, scoped multi-agent workspaces and signed agent-to-agent channels
  • Manage network devices and sites with per-device policy, locks and a global killswitch
  • Register IP catalogues and licences, and bulk-import rights holders' repertoires
  • Review and export the audit trail as OCSF, CSV or JSON, and work the human approval queue
  • Register enterprise AI tools and create governed work orders with signed completion records
When to use it
For teams putting AI agents into regulated or high-risk production who need a control that blocks out-of-policy actions and produces evidence for auditors, regulators or frameworks such as the EU AI Act, SOC 2 or NIST AI RMF. Also useful for developers who want a scriptable pre-execution check in front of risky commands.
Requirements
Either the remote SSE endpoint with an Authorization bearer token, or the npm package a2a-trustgate run locally with npx or the a2a command. An A2A TrustGate API key in A2A_API_KEY or the Authorization header; without one the server starts in onboarding mode. A paid plan after the trial, and network access to the A2A API (A2A_URL, default a2ainfrastructure.com).
Before you install
The API key is a secret; keep it out of version control. Signup creates a tenant and requires a card for a 7-day trial that converts to a paid subscription (Starter $99/mo and up), and usage is metered per evaluation. The server can create, authorise and revoke licences, keys and work orders, lock devices and trigger a killswitch, so writes affect real systems. Screened actions and their context are sent to a third-party service.

Installation

In SourceWeft

  1. Open A2a Trustgate in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via SSE. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.jyswee%2Fa2a-trustgate/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "a2a-trustgate": {
      "type": "sse",
      "url": "https://mcp.a2ainfrastructure.com/sse"
    }
  }
}

README

a2a-trustgate

[npm version] [EU AI Act] [OCSF audit] [MCP]

Compliance for AI systems in production.

You put an AI agent in production. Now prove it's safe — to your auditor, your regulator, your board.

A2A TrustGate screens every action an agent takes before it runs, and writes the decision to an immutable, SIEM-ready audit trail. Not a policy document that says agents should behave — a control that stops the ones that don't, and the evidence to prove it.

  • Enforced, not promised. Every agent action passes a 4-gate firewall before it executes. Out-of-policy actions are blocked in milliseconds, not flagged after the fact.
  • An audit trail an auditor will accept. Every decision — allowed or blocked, with reasoning — lands in an append-only, OCSF-native log that drops straight into Splunk, Sentinel, Chronicle or Elastic.
  • Mapped to the frameworks you're measured against. Export the same evidence against EU AI Act, SOC 2, NIST AI RMF, HIPAA and academic-integrity controls — article by article, control by control.
  • Provable scope. Each agent may act only within the permissions it was granted. Deny-by-default, and every boundary is in the log.

Who it's for: compliance and risk teams putting AI into regulated production — financial services, healthcare, network operations, creative/IP rights, enterprise AI adoption, and research institutions. If someone can ask you "prove your AI is safe," this is the answer.

[a2a demo — screen an agent action in one command]

Agent proposes an action, the gate screens it, the decision lands in the audit trail — watch the full demo.

The audit trail an auditor will accept

Most "AI governance" is a PDF that describes intentions. A2A produces evidence. Every screened action becomes a genuine OCSF Detection Finding — the same schema your SOC already ingests — with a tamper-evident content hash and the full decision reasoning:

bash
a2a audit                          # recent decisions, allowed and blockeda2a audit export --format ocsf     # OCSF Detection Findings — straight into your SIEMa2a audit export --format csv      # hand a spreadsheet to an auditor
  • OCSF-native (schema 1.1.0). Not a bespoke JSON blob labelled "OCSF" — real Detection Findings that Splunk / Sentinel / Chronicle / Elastic parse without a custom connector.
  • Tamper-evident. Every record carries a content hash; the export is append-only. You can prove the log wasn't edited after the fact.
  • Framework-mapped exports. The same underlying events export against the control set you're being audited on:
FrameworkWhat you can hand over
EU AI ActArticle-by-article evidence of screening, logging and human oversight (Art. 12, 14, 26, 53)
SOC 2Control-mapped decision log (CC-series)
NIST AI RMFGOVERN / MAP / MEASURE / MANAGE evidence
HIPAASecurity & Privacy Rule access decisions
Academic integrity / QAAResearch-ethics and responsible-AI trail

EU AI Act deployer? Read the EU AI Act compliance reference — an article-by-article crosswalk (Art. 12 record-keeping, Art. 14 human oversight, Art. 26 deployer obligations) with citations to the official EUR-Lex text. The Regulation becomes generally applicable 2 August 2026.

Enforced before it runs — the 4-gate firewall

Compliance you can prove starts with a control that actually stops things. Every action passes four gates before it's allowed to execute:

  • Gate 1 — deterministic rules. Pattern and policy screening in milliseconds: destructive operations, secret exfiltration, injection signatures. No model call.
  • Gate 2 — self-evaluation. For anything Gate 1 can't clear outright: should this run, given the context and the tenant's policy?
  • Gate 3 — behavioral analysis. Abuse patterns across a run — bursts, probing, escalation — not just the single action in isolation.
  • Gate 4 — scope enforcement. Per-agent permissions: each agent may act only within the scope it was granted. Out-of-scope actions are denied by default.

The firewall only ever tightens a decision — allow → review → block. A safe action stays fast; a risky one is stopped and recorded with the reason.

For developers — screen an action in one command

The whole control is a CLI (and an MCP server). Wrapping a risky step is one line, and exit codes make it scriptable:

bash
a2a eval "rm -rf ./build"          # ✓ ALLOWED   (exit 0)a2a eval "rm -rf /"                # ✗ BLOCKED   (exit 1) — filesystem destruction patterna2a eval "command" --context ctx   # add decision context   (exit 2 = needs review)
CodeMeaning
0Allowed — safe to execute
1Blocked — do not execute
2Needs review — Gate 2 self-evaluation required

Works with: Claude Code · Cursor · Cline · Windsurf · Aider · Codex · any MCP client.

Install

bash
npm install -g a2a-trustgate

The npm package is a2a-trustgate; the command is a2a.

Quick Start

bash
# Create a tenant (agent-first — human activates the key)a2a signup my-company --local
# Screen a command — exit 0 = allowed, 1 = blocked, 2 = needs reviewa2a eval "rm -rf ./build"# ✓ ALLOWED
a2a eval "rm -rf /"# ✗ BLOCKED: filesystem destruction pattern
# See plan, usage, limitsa2a status
# Full referencea2a --help

Your key is issued immediately but returns 402 until you start your 7-day free trial ($0 today) — a2a signup prints the activation link. Cancel before day 7 and you're never charged.

The eval call has a few knobs, and it's scriptable — wrap any risky step:

bash
a2a eval "command" --gate2 self    # self-evaluate (default)a2a eval "command" --gate2 skip    # Gate 1 only (fast path)a2a eval "command" --pipeline ID   # route through a named pipeline
if a2a eval "rm -rf ./build" --json 2>/dev/null; then  rm -rf ./buildfi

Built for six kinds of team

A2A screens the same way for everyone and produces the same audit trail — but the surface each team touches, and the framework they're measured against, is different. Pick yours.

Network operations — a gate in front of every device

Your agents run commands against routers, switches, and sites. A2A registers each device, enforces a per-device policy, and gives you a killswitch that stops every agent at once.

bash
a2a device add --name core-rtr-1 --host 10.0.0.1 --vendor ciscoa2a device policy DEVICE-ID --mode strict --require-approval --max 5a2a device lock DEVICE-ID           # freeze a single devicea2a killswitch                      # freeze every agent, everywherea2a device import --file hosts.csv  # bulk onboard (name,host,vendor,model,role,siteCode)
Agent screens a commandHuman sees the device-lock
[network-ops terminal cast][network-ops dashboard]

Watch the full clip: network-ops →

AI agents — agent-to-agent, screened and signed

Multi-agent systems where one agent's output is another's input. A2A gives them scoped workspaces and HMAC-signed channels, so a rogue or injected message can't cross a boundary you didn't grant.

bash
a2a workspace create "research-swarm"a2a workspace WS-ID add-agent --name planner --role experta2a workspace WS-ID enforce --agent planner "command"   # screen an agent's actiona2a channel create ops-busa2a channel CH-ID send "interface frozen — you're clear to build"  # HMAC-signed
Agent-to-agent evaluateHuman sees the block + audit
[ai-agents terminal cast][ai-agents dashboard]

Watch the full clip: ai-agents →

Regulated industries — an immutable, exportable audit trail

Every decision — allowed or blocked, with reasoning — lands in an append-only log you can export for an auditor. OCSF-native Detection Findings, EU AI Act aligned.

bash
a2a audit                          # recent decisionsa2a audit export --format ocsf     # OCSF Detection Findings → your SIEMa2a audit export --format csv      # hand to an auditor (csv/json)a2a approvals                      # human-in-the-loop queuea2a approve TASK-IDa2a reject TASK-ID "out of policy" # reason recorded in the trail
Command screenedHuman exports the audit
[regulated terminal cast][regulated dashboard]

Watch the full clip: regulated →

Creative & IP owners — licence before access

Register your catalogue, mint scoped licences, and every agent that reaches for an asset is checked against a rights log. Access is granted by licence, not by scraping.

bash
a2a catalogue create "The Back Catalogue"a2a catalogue licence create --catalogue CAT-ID --email [email protected] --scope reada2a catalogue access-log           # who reached for what, and whether it was licenseda2a catalogue content-sources
Agent requests an assetHuman sees the rights-log
[creative terminal cast][creative dashboard]

Watch the full clip: creative →

IP aggregators & distributors — onboard an entire catalogue in one command

Represent many rights holders? A distributor or aggregator holds one provider key and onboards every artist's repertoire in bulk — each work stamped with an ownerRef (the artist's stable id in your system) so reads and writes are hard-scoped per rights holder. The same integration works for one artist or a million.

Export your catalogue as CSV (CD Baby, DistroKid and most distributors already do), then:

bash
# One-time: get a provider key from your A2A partner account, thenexport A2A_API_KEY=a2a_provider_xxxxxxxx
# Preview the column mapping before writing anythinga2a ip-aggregator import repertoire.csv --dry-run
# Bulk-import the whole repertoire (idempotent — safe to re-run)a2a ip-aggregator import repertoire.csv
a2a ip-aggregator owners                          # every rights holder + work counta2a ip-aggregator works --owner-ref crosswinds    # one artist's registered worksa2a ip-aggregator opt-out --owner-ref crosswinds --all   # bulk AI/TDM opt-out (EU AI Act Art. 53)a2a ip-aggregator portal-link --owner-ref crosswinds     # white-label artist portal — drop the artist in, no second logina2a ip-aggregator access-log --owner-ref crosswinds      # the provable trail, per artist
# The licensee side (the AI company that wants to use the catalogue):a2a ip-aggregator catalogue                              # the licensable catalogue (opted-out works excluded)a2a ip-aggregator licensee-link --licensee-ref acme-ai   # white-label licensee portal — browse + request a scoped licence

A CD Baby-style CSV maps automatically — headers like Artist ID, Artist, Track Title, ISRC, TDM Opt-Out are recognised (override any column with --owner-ref-col / --isrc-col / --title-col):

csv
Artist ID,Artist,Track Title,ISRC,TDM Opt-Outcrosswinds,Crosswinds,All Good Things,USCGH1915861,truemidnight_owls,Midnight Owls,Neon Rain,GBK4Y2100017,false

portal-link mints a short-lived signed handoff URL, so you can embed a white-label rights portal straight into your own product — your brand, no A2A login, per-artist isolated. This is the drop-in pattern behind BandSaaS; the same one an aggregator embeds for its whole roster. licensee-link mints the mirror portal for an AI company (a licenseeRef) to browse the licensable catalogue and request scoped licences — the artist approves in their own portal, which issues a revocable licence. Both sides stay inside your product.

Licensee keys — the machine half

licensee-link drops a human into the portal. A licensee key is the credential the licensee's own agents authenticate with, so its usage is attributed to the licensee rather than borrowing the rights holder's key:

bash
a2a ip-aggregator licensee-key mint --licensee-ref acme-ai --name "Acme AI"a2a ip-aggregator licensee-key lista2a ip-aggregator licensee-key revoke <id>      # dies immediately
a2a ip-aggregator usage                          # metered usage, by event

The key is hashed at rest and shown once. It carries no subscription of its own — your partner account being active is the entitlement, so it dies with it — and it may only POST /v1/evaluate with a licence key. Nothing else. That restriction is what makes it safe to hand to an outside company.

Because the licensee authenticates as itself, the access log records the consuming party alongside the rights holder:

ALLOW  2026-08-07T10:14:02  owner=crosswinds  licensee=acme-ai  summarise  All Good ThingsDENY   2026-08-07T10:14:09  owner=crosswinds  licensee=acme-ai  reproduce  All Good Things  (Scope exceeded)

Every evaluation — allowed and denied — meters back to you, the sponsoring partner, at your per-partner rate. A provable block is the product, so it costs the same evaluation.

Work orders — govern the authority, not just the action

The gates prove every action was screened. A work order proves the layer above: who authorised this work, under what authority, toward what outcome — and binds it to a signed, tamper-evident completion record. This is the enterprise governance layer, sitting directly on top of the 4-gate firewall.

bash
# A named human raises a governed directive with RACI + a scope granta2a work-order create --ref WO-2026-0142 --title "Summarise Q3 catalogue" \  --directive "Summarise tracks in the Q3 batch for the licensing review" \  --accountable [email protected] --authority "licensing-review-ticket-88" \  --domain creative --scope "read,summarise.*"
# --domain applies your sector's profile: network-ops (change request), regulated# (work order / Art 4 decision record — authority required), creative (usage# authorisation), enterprise-ai (approved use), university (research protocol —# ethics ref required), ai-agents (mission). Add sector context with --meta# key=value, e.g. --meta grantRef=EPSRC-42 or --meta aiTools=copilot,chatgpt
a2a work-order authorise WO-...     # human sign-off: DRAFT → AUTHORISED (Art. 14)a2a work-order attach WO-... TASK   # attach the gated tasks that fulfil ita2a work-order complete WO-... --outcome "42 tracks summarised, 0 blocked"a2a work-order verify WO-...        # re-derive the hashes — proves nothing was altereda2a work-order precedent "summarise catalogue for licensing"   # what was authorised before

Once authorised, the work order's scope grant becomes the ceiling of what the job may do — an action outside it is blocked at evaluation time, even if the agent's own role would allow it. The completion record is signed with a key only A2A can reproduce, so an auditor (or the accountable human) can re-verify the whole chain — directive → actions → gate verdicts → outcome — and detect any later tampering.

Enterprise AI — govern the tools your staff already use

ChatGPT, Claude, Copilot are already in your building. Register each tool, screen what it's asked to do, and get one audit trail across all of them.

bash
a2a ai-tools add "ChatGPT" --type chatbota2a ai-tools                       # every registered toola2a ai-tools update 0 --status paused
Tool action screenedHuman sees approval + audit
[enterprise-ai terminal cast][enterprise-ai dashboard]

Watch the full clip: enterprise-ai →

Universities — research governance without the friction

Approvals, scope enforcement, and an exportable trail that maps to research-ethics and UKRI responsible-AI requirements. One URL for a researcher to connect, governance for the board.

bash
a2a eval "command" --context "grant-XYZ research pipeline"a2a approvals                      # ethics/governance queuea2a audit export --format csv      # for the board or the funder
Research action screenedHuman sees governance + audit
[university terminal cast][university dashboard]

Watch the full clip: university →

Drop it into your framework

Generate a ready-made wrapper for the SDK you already use — the screen call is one line:

bash
a2a generate node        # a2a-safety.jsa2a generate python      # a2a_safety.pya2a generate anthropic   # tool_use wrappera2a generate openai      # tool_call wrapper

MCP Server

Prefer tools over a CLI? a2a ships an MCP server. Point Claude Code (or any MCP client) at it and your agent gets 49 native tools: evaluate, pipelines, workspaces, channels, devices, sites, catalogues, audit, approvals, admin. The whole platform.

bash
claude mcp add a2a -- a2a mcp-serve

For clients that use a JSON config (Cline, Cursor, Windsurf), pass your API key via the A2A_API_KEY environment variable. The MCP server runs outside your project directory, so it will not pick up .a2a/config.json:

json
{  "mcpServers": {    "a2a": {      "command": "a2a",      "args": ["mcp-serve"],      "env": { "A2A_API_KEY": "a2a_your_key_here" }    }  }}

No key yet? Start it without one: the server boots in onboarding mode and can guide signup, then add the key and restart.

Remote MCP — zero install

No CLI at all? Claude Web, Claude Desktop, Raycast, or any hosted MCP client can connect straight to our remote server. Same 49 tools, same API key, nothing to install:

URL:  https://mcp.a2ainfrastructure.com/sseAuth: Authorization: Bearer YOUR_API_KEY

Setup guide: MCP quickstart.

Features

  • Evaluate — screen any command through the 4-gate firewall, allow / block / needs-review, in milliseconds
  • Pipelines — named screening routes with their own policy and task history
  • Workspaces — scoped multi-agent enforcement, one agent's action screened against the tenant policy
  • Channels — HMAC-signed agent-to-agent messaging, contract-scoped
  • Devices & sites — per-device policy, lock, bulk CSV import, and a global killswitch (network-ops)
  • Catalogues & licences — register IP, mint scoped licences, access-log every reach (creative / IP owners)
  • IP aggregator — one provider key, bulk-import many rights holders' repertoires (CSV), per-artist ownerRef isolation + white-label portal links (distributors / aggregators)
  • AI tools registry — govern ChatGPT / Claude / Copilot behind one audit trail (enterprise-ai)
  • Approvals — human-in-the-loop queue, approve/reject with reason recorded
  • Audit trail — immutable, OCSF-native Detection Findings, EU AI Act aligned, exportable as OCSF / CSV / JSON
  • MCP server — 49 tools, local (a2a mcp-serve) or fully remote (mcp.a2ainfrastructure.com)
  • Framework wrappers — one-line generate for Node, Python, Anthropic, OpenAI

Pricing: every plan starts with a 7-day free trial — card required, $0 today, cancel any time before day 7 and you're never charged. The full 4-gate firewall, behavioral analysis and OCSF-shaped audit are on every plan; higher tiers add volume, webhooks, custom rules, dedicated sandboxes and SSO.

PlanPriceScreenings / moOverage per 1k
Starter$99/mo5,000$1.00
Pro$299/mo100,000$0.25
EnterpriseCustom — priced per accountUnlimitedAgreed per account

Verified education & research: Institutional $79/mo. Full pricing →.

Authentication

API key resolution (first match wins):

  1. --key flag
  2. A2A_API_KEY environment variable
  3. ./.a2a/config.json (project-local)
  4. ~/.a2a/config.json (global)
bash
a2a login            # store globally (~/.a2a/)a2a login --local    # store per-project (./.a2a/) — add .a2a/ to .gitignorea2a config           # show which config is active

Platform operators — a2a admin

Self-hosted or platform-operator deployments get a full ops suite behind a separate superadmin key (A2A_SA_KEY / --sa-key — never a tenant API key): tenant lifecycle (tenant-create --theme --password --verify, tenant-key mint), partner management (partner-embed with incremental --frame-add/--frame-remove, brand config, secret rotation), cross-tenant IP ops (catalogues, catalogue-restamp, catalogue-restore, licences, licence-revoke, access-log), deck shares, partner provisions/usage, and billing ops (subscriptions, invoices). Run a2a admin help for the full list.

Agent Integration

Add to your CLAUDE.md, .cursorrules, .clinerules, .windsurfrules, or AGENTS.md:

## A2A TrustGateThis project screens agent actions through A2A before they execute.Use the `a2a` CLI. Config is in .a2a/config.json (auto-loaded).If not configured: a2a login --local --key YOUR_KEY
Before running any risky command, screen it:  a2a eval "the command" --json   # exit 0 = run it, 1 = do not, 2 = needs review

Why this exists

An agent that can act is an agent that can act wrongly — and by the time you read the log, it's done. I wanted a gate in front of the action, not a report after it: deterministic where it can be, self-evaluating where it can't, and audited either way. It's early and I'm iterating fast — if something's rough or missing, tell us.

Documentation

Licence

Proprietary — Tyga.Cloud Ltd. See LICENSE.

Source: README.md at commit cdad3af

Tools

2

a2a_get_started

Explains what A2A TrustGate is and how to activate this MCP server (no API key on this session yet).

Takes no parameters.

a2a_signup

Create a new A2A TrustGate tenant and get an API key (shown once), unlocking all safety tools in this session immediately. Agent-first: only a short tenant slug is required — no email or password. A human must then add a card (secure Stripe checkout) at the returned paymentUrl to activate; /v1 calls return 402 until activated.

ParametersagenttenantIdrequireddescription

Version history

1
  1. v1.5.17LatestSep 16, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.

Other Vipsallowed integrations

Vips

com.vipsallowedOfficial publisher

VIPsAllowed's MCP server lets an assistant run a creator business: post content, manage subscribers, send paid DMs, track earnings and payouts.

SSEWeb executable
Finance2 toolsOct 24, 2026

Computegpu

Published by GitHub account jyswee

Lets an assistant rent cloud GPUs: browse the live catalogue, deploy, stop, resume and destroy instances, with per-second billing.

Streamable HTTPWeb executable
Cloud & Infrastructure2 toolsOct 28, 2026

Weselltours

Published by GitHub account jyswee

A local MCP server for the WeSellTours travel platform that lets an assistant manage hotels, tours and bookings, track bugs and features, and query travel AI.

STDIODesktop only
Location & LifestyleNot validated yetOct 25, 2026

Taufunctions

Published by GitHub account jyswee

TauFunctions lets an assistant create, deploy, invoke and monitor serverless functions on the TauFunctions platform, locally via npm or as a remote endpoint.

Streamable HTTPWeb executable
Cloud & Infrastructure2 toolsOct 24, 2026

Sslwebsites

Published by GitHub account jyswee

A local MCP server that lets a coding agent issue, renew, revoke, download and monitor SSL/TLS certificates through the SSLWebsites service.

STDIODesktop only
Cloud & InfrastructureNot validated yetOct 24, 2026