AgenticRail Gate - sequence enforcement and verifiable audit receipts for AI agent compliance

nz.agenticrailPublished by agenticrail.nzOfficial publisherv1.3.0Updated Oct 24, 2026

Deterministic runtime enforcement of step order for AI agents: ALLOW/DENY before a step runs.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Remote MCP gate that lets an assistant get ALLOW or DENY for each step of an agent sequence before it runs, then verify a signed audit receipt.

What you can do
Evaluate a single agent step before it runs, receiving ALLOW or DENY plus the reason and remedy for a refusal, and sealing a signed receipt when allowed. Fetch a sequence's verification report and confirm whether its receipt chain is intact. Enforce a declared step order so steps cannot be skipped, replayed or run out of order.
When to use it
Use it when an agent must follow a fixed multi-step procedure and you want out-of-order or skipped steps refused before they execute, and want a tamper-evident audit trail of the run to hand to someone else.
Requirements
A Streamable HTTP MCP client pointed at the remote endpoint; no local package or runtime. No authentication is required: without an Authorization header the public demo key is used. A personal key can be supplied as an Authorization Bearer header. Network access to the endpoint.
Before you install
On the shared demo key the sequence_id is global and sealing is permanent, and the returned id is rewritten with a demo- prefix, so use the id from the response. A demo- sequence's report needs no key to read, so treat anything sent on it as public. The gate only enforces what you call it with; a denied step must not be executed.

Installation

In SourceWeft

  1. Open AgenticRail Gate - sequence enforcement and verifiable audit receipts for AI agent compliance in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/nz.agenticrail%2Fgate/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "agenticrail-gate-sequence-enforcement-an": {
      "type": "http",
      "url": "https://mcp.agenticrail.nz/"
    }
  }
}

README

agenticrail-mcp

A Model Context Protocol server that exposes the live AgenticRail enforcement gate to any MCP client as two tools.

AgenticRail is a deterministic enforcement layer for AI agents: it holds an agent to its declared step order, refuses replays and skipped steps, and seals each completed sequence with a signed receipt. This server is the MCP adapter in front of it.

In the words the problem usually gets asked in: it is a policy enforcement point for AI agent tool calls. It catches skipped steps and procedural hallucination (an agent reporting success on a step that never ran) by refusing the out-of-order step before it runs, and every decision, ALLOW or DENY, becomes a tamper-evident audit trail entry.

Endpoint: https://mcp.agenticrail.nz/ (Streamable HTTP, stateless) Protocol: 2026-07-28 — the revision that retired the initialize exchange and Mcp-Session-Id. This server was built stateless with neither, so it needed no migration. initialize is still answered for older clients. Registry: nz.agenticrail/gate on the official MCP registry

Tools

ToolWhat it doesCalls
evaluate_stepALLOW/DENY a single agent step before it runs; seals a signed receiptPOST https://api.agenticrail.nz/v1/evaluate
verify_receiptFetch a sequence's verification report; confirm the receipt chain is intactPOST https://report.agenticrail.nz/report

Call evaluate_step before running each step of a sequence, and do not run a step the gate DENYs.

A DENY tells you how to fix it

Every refusal carries its own remedy in the response envelope — unsigned, DENY-only, because it describes the sequence's state now rather than the decision that was made:

refusalwhat comes back
ACTION_NOT_ALLOWEDallowed_action_types — exactly what this step would have accepted
SEQUENCE_VIOLATIONnext_expected_step — the step the sequence is waiting for
STEP_ORDER_MISMATCHlocked_step_order — the order this sequence was locked to on its first call
UNKNOWN_STEPexpected_step_order + step_order_source (caller or msmd_spine)

action_type is an enum of exactly eight values, and each step accepts only a subset. The enum in the tool schema is a hint, not a control — it binds only a client that validates its own arguments, and an invented verb is by far the most common first refusal: READ, QUERY, TOOL_CALL, LOOKUP, EXECUTE and the like are not action types, however well they describe your step. The gate is the control. When it refuses, allowed_action_types comes back carrying the ones this step would have taken.

A refused call locks nothing. A denial is answered before the sequence store is written to, so the run is not spoiled: the call was wrong, not the sequence. Correct the field the denial names and send the step again. The lock is set only by actually sending a step_order on a call that is allowed; from then on that list is enforced and a different one is refused with STEP_ORDER_MISMATCH. Omitting step_order sets no lock at all — it means only that this call is judged against the built-in MSMD spine, whose step names are almost certainly not yours.

So if your process has its own step names, send step_order with those names and the gate will enforce your order instead. One step is a valid sequence.

Connect

In Claude Code:

bash
# zero config — uses the public demo keyclaude mcp add --transport http agenticrail https://mcp.agenticrail.nz/
# with your own keyclaude mcp add --transport http agenticrail https://mcp.agenticrail.nz/ \  --header "Authorization: Bearer <your-agenticrail-key>"

Any Streamable-HTTP MCP client works — point it at the URL.

Try it without installing anything

bash
BASE=https://mcp.agenticrail.nz/
curl -s -X POST "$BASE" -H 'content-type: application/json' \  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | jq .
# ⚠️ Use a sequence_id nobody else will pick. On the shared demo key the id is# GLOBAL and sealing is PERMANENT — a fixed one in an example works once for one# person on earth and returns SEALED_SEQUENCE for everyone after.SEQ="mcp-smoke-$(date +%s)-$RANDOM"
curl -s -X POST "$BASE" -H 'content-type: application/json' \  -d "{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/call\",\"params\":{        \"name\":\"evaluate_step\",        \"arguments\":{\"sequence_id\":\"$SEQ\",\"step\":\"intake\",                       \"action_type\":\"CHECK_STATE\"}}}" | jq .

With no Authorization header the public demo key is used and your sequence_id comes back rewritten to demo-mcp-<your id> — demo- marks the public lane, mcp- marks it as anonymous MCP traffic. Use the id returned in the response from then on; the one you sent will not resolve. This is intended, not a leak.

A demo- sequence's report needs no key to read, so treat anything you send on it as public.

Design — read before changing

  • Protocol adapter only. This worker holds no internal secrets and has no privileged path to the enforcement core. It calls the same public API an external caller uses, so the tool logic is decoupled from AgenticRail's internals and from the MCP transport version.
  • Service bindings, not fetch. mcp.agenticrail.nz is on the same zone as api. and report., so a plain fetch() would be a same-zone loopback (Cloudflare error 1002). The bindings hit the identical public handlers — they are not an internal bypass.
  • Stateless Streamable HTTP. No Mcp-Session-Id is issued or required; every POST is self-contained. The transport shell is handleRpc + the fetch handler — the only part a spec revision touches. The value-bearing calls (callEvaluate / callVerify) are plain HTTPS and don't change.
  • GET / serves the discovery card; every other GET path 404s. POST is left permissive on purpose so a client that appends a path to the endpoint URL still works.
  • A 404 on /.well-known/oauth-* is correct — it is how an MCP server says no auth required. agent.json, agent-card.json, x402 and ai-plugin.json are protocols this server does not implement; answering them would be a claim.

Deploy

bash
npx wrangler deploy

Links

Operated by TUARA KURI LIMITED (NZBN 9429053582867), Hokianga, Aotearoa New Zealand.

Source: README.md at commit 87a7de6

Tools

2

evaluate_step

Ask the AgenticRail gate to ALLOW or DENY a single step of an agent sequence BEFORE it runs, so a required step cannot be skipped or run out of order. A denied step must not be executed. You walk away holding a signed, hash-chained, tamper-evident audit trail of the run that you can hand to anyone, and they can verify it offline - no callback to us and no account with us. The gate is deterministic (same state+request -> same verdict) and enforces step order, replay protection, timestamp freshness and sealing. START HERE - send this, changing only CHANGE-ME to any unique string of your own, and it will be ALLOWED: {"sequence_id":"CHANGE-ME","step":"intake","action_type":"CHECK_STATE","step_order":["intake","settle"]}. Then send the same call with step 'settle' to close and seal it. Use the demo key by sending no Authorization header, or send Authorization: Bearer <your-key>. NOTE: an anonymous call has its sequence_id rewritten to 'demo-mcp-<your id>'. This is intended, not a leak: it scopes the run to the public demo lane and is how anonymous MCP traffic is identified. Always reuse the sequence_id RETURNED in the response for later steps and for verify_receipt -- the id you sent will not resolve. Typical use is gating the order of a regulated workflow the caller already runs: customer and third-party due diligence, verification of identity before a payment or business relationship, company registry, beneficial-ownership and sanctions screening, supplier and contractor onboarding. This tool performs none of those checks and holds no registry or watchlist data. It decides only whether the step you are about to run is allowed at this point in the order you declared.

Parameterssteprequirednonceactioninputsfunctionstep_orderaction_typerequiredsequence_idrequired

verify_receipt

CALL THIS AFTER A SEQUENCE SEALS, and after any DENY, passing the sequence_id RETURNED by evaluate_step. An enforced run that is never verified has produced evidence nobody has checked. Fetch the verification report for an AgenticRail sequence and report whether its receipt chain is intact. Demo- sequences need no key; other sequences need Authorization: Bearer <your-key>. Returns the verification_status (VERIFIED_INTACT / CHAIN_BROKEN / ...) plus the per-receipt signature, chain-hash, and archive-witness checks. This is the same evidence a third party can verify offline against the published Ed25519 keys - no need to trust AgenticRail.

Parameterssequence_idrequired

Version history

2
  1. v1.3.0LatestSep 27, 2026
  2. v1.2.0Sep 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts