Agent Trust Firewall MCP Server

Evaluate a proposed action against evidence, source allowlists, data constraints and payment limits, returning ALLOW/BLOCK with reason codes. All enabled checks must pass: evidence cannot override an over-budget payment. Set action.type to payment to activate spending checks and pass its amount with remaining_budget; contract applies to data, not action. Use this gate before execution, trust_check_spend for budget alone, or trust_validate_data for structure alone. Enforce BLOCK and fail closed on errors. Source labels are unauthenticated; instruction scanning is a limited phrase heuristic. No action execution, wallet access, policy storage or decision history. Free, unauthenticated, stateless pilot: rules apply only to this call. Usage metadata is recorded; request bodies are not stored.

Compare a proposed spend with a remaining budget, transaction ceiling and merchant allowlist, returning ALLOW/BLOCK with reasons. Budget and ceiling are independent: amount=4, remaining_budget=10, per_transaction_limit=3 returns BLOCK; equality passes. Use one currency/unit, and update remaining_budget in your application after each actual purchase: this tool neither tracks cumulative spending nor converts currencies. Omitting allowed_merchants skips merchant checks; supplying it requires an exact merchant match, and [] blocks all merchants. Use trust_check_action to include evidence or data checks. Enforce BLOCK before paying; this tool never accesses a wallet or executes payment. Free, unauthenticated, stateless pilot: rules apply only to this call. Usage metadata is recorded; request bodies are not stored.

Audit and optionally clean up to 500 JSON rows, returning cleaned_rows, original zero-based issues and counts. Processing order is trim, primary-key deduplication, then required/range checks: keys " a " and "a" collide after trimming. Duplicate removal keeps the first row and skips later-row field checks; missing keys are retained and flagged. REVIEW persists even after repair, so inspect issues before use; [] returns ALLOW. Numeric strings are not converted or range-checked; use trust_validate_data for type enforcement. Only top-level strings are trimmed; inputs are not mutated. Free, unauthenticated, stateless pilot: rules apply only to this call. Usage metadata is recorded; request bodies are not stored.

Discover the deployed version, request/row limits, tool names, legacy call aliases and check-clean-recheck workflow before integrating. Pass {}: this inventory endpoint accepts no action, policy or filter arguments; use tools/list for callable schemas and trust_check_action for a verdict. The response explains enforcement and limitations, not stored policy or decision history: rules must accompany each check. Free and unauthenticated, with operational usage metadata recorded but no request-body storage. Re-read after a deployment to detect capability changes.

Validate JSON field presence, exact types, primitive enums and inclusive numeric bounds, returning ALLOW/BLOCK, field reasons and checked_fields. Combine required:true, type:"integer" and min:1 for a positive mandatory quantity: min alone neither requires a value nor rejects numeric strings. Missing, null or empty optional values skip the other constraints; 0 and false do not. For nested data, fields["order.total"] addresses a leaf; allow_extra:false compares top-level keys, so keep it true for dot-path rules. Use trust_clean_data for transformations or trust_check_action for evidence/spending checks. This validates structure, not facts or provenance. Free, unauthenticated, stateless pilot: rules apply only to this call. Usage metadata is recorded; request bodies are not stored.