Sunaiva Gate — Agent Rule Enforcement

io.sunaivacorePublished by sunaivacore.ioOfficial publisherv2.0.4Updated Oct 27, 2026

MCP enforcement layer that intercepts AI agent actions and blocks rule violations before execution.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A rule-enforcement gate that lets an assistant validate proposed actions against policy rules, log bypasses, and manage custom rules and audit logs.

What you can do
  • Validate proposed actions against active rules and get allowed/blocked results with violations
  • Record intentional rule bypasses with a justification
  • Review recent gate decisions in the audit log
  • List active rules and available preset bundles, and apply presets
  • Create, update, delete and list custom detection rules
  • Set, list and reset per-rule enforcement modes (shadow, advisory, enforce)
When to use it
Useful when an agent's actions need a policy checkpoint before execution, or when a team wants a shared, auditable record of blocked actions, bypasses and custom detection rules.
Requirements
Runs as a remote endpoint or locally via the npm package with npx. The free tier needs no key; Pro features require the SUNAIVA_GATE_API_KEY secret. Optional variables: SUNAIVA_GATE_DRY_RUN and DISABLE_SUNAIVA_GATE.
Before you install
DISABLE_SUNAIVA_GATE set to 1 lets all actions through unconditionally, removing enforcement. Several tools are listed as planned and return NOT_IMPLEMENTED on the remote endpoint. Rule, preset and mode tools write to backend state and require a Pro API key. Category and preset filters on rule listing are accepted but not applied.

Installation

In SourceWeft

  1. Open Sunaiva Gate — Agent Rule Enforcement in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.sunaivacore%2Fgate/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "sunaiva-gate-agent-rule-enforcement": {
      "type": "http",
      "url": "https://mcp.sunaivacore.io/"
    }
  }
}

Tools

16

validate_action

Check if a proposed action passes all active validation rules. Returns allowed/blocked with rule violations.

Parametersactionrequiredcontext

log_bypass

Record an intentional rule bypass with justification. Cannot bypass constitutional rules.

Parametersreasonrequiredrule_idrequired

get_rules

List active validation rules — the customer's TRUE enforced set (constitutional + recommended-default metadata on dev tier, all 69 premium rules on pro+). `category`/`preset` filter args are accepted but not applied server-side.

Parameterspresetcategory

update_rules

[Planned — not yet implemented on the remote endpoint, returns NOT_IMPLEMENTED] Enable/disable is not backed by any route in this API; use set_rule_mode (shadow/advisory/enforce) instead, or the local `npx @sunaiva/gate` package.

Parametersenabledisable

get_audit_log

View recent gate decisions — blocks, warnings, passes, and bypasses.

Parameterslimitrule_id

ship_confidence_check

[Planned — not yet implemented on the remote endpoint, returns NOT_IMPLEMENTED] Ship Confidence Gate (Rule 42) dual-tier authorization is not yet built in this backend.

Parameterslabelartifact_idrequiredcommand_preview

audit_verify

[Planned — not yet implemented on the remote endpoint, returns NOT_IMPLEMENTED] Forward-linked hash-chain / ed25519 audit-log verification is not yet built in this backend.

Takes no parameters.

set_rule_mode

Set enforcement mode (shadow/advisory/enforce) for a specific rule. Requires API key (Pro+).

Parametersmoderequiredrule_idrequiredagent_id

get_rule_modes

List all enforcement-mode overrides configured for the authenticated customer. Requires an account (Dev+).

Takes no parameters.

reset_rule_mode

Remove a mode override for a rule, reverting it to its default enforcement mode. Requires API key (Pro+).

Parametersrule_idrequired

add_custom_rule

Create a custom detection rule in the backend. Requires API key (Pro+).

Parametersnamerequiredtierseverityrequireddescriptionrequireddetection_patternrequired

update_custom_rule

Update an existing custom rule. Requires API key (Pro+).

Parametersidrequirednametierseveritydescriptiondetection_pattern

delete_custom_rule

Delete a custom rule. Requires API key (Pro+).

Parametersidrequired

list_custom_rules

List all custom rules for the authenticated customer. Requires API key (Pro+).

Takes no parameters.

list_presets

List available rule preset bundles. Requires API key (Dev+).

Takes no parameters.

apply_preset

Apply a preset bundle, activating all its included rules. Requires API key (Pro+).

Parameterspreset_idrequired

Version history

1
  1. v2.0.4LatestSep 16, 2026

Score

75% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • License10 pts

    Declare a license in the repository or the registry entry.