Capgate — runtime authority boundary for autonomous AI agents: the agent proposes, the harness authorizes, the executor acts. Deny-by-default policy, non-transitive delegation, tamper-evident audit, M
View on GitHub ↗Authority management for autonomous software agents.
The agent proposes. The harness authorizes. The executor acts.
Capgate is a runtime enforcement boundary that sits underneath your existing agent stack. Every consequential action an agent takes — a tool call, a message to another agent, a request that another agent act — is a structured proposal that passes through one deterministic, deny-by-default policy engine before anything executes. Every decision is written to a tamper-evident audit trail.
It is not an agent framework, a prompt library, or a model wrapper. It does not ask the model to follow rules; it makes unauthorized actions structurally unable to reach a tool.
- The boundary, under attack — a compromised agent, contained - Inspect — the local UI (screenshots) - The contract · The API · Delegation - What is actually enforced · MCP - Audit trail · Tests · Status - Design: DESIGN.md (the five invariants) · Workload identity · Isolation runtime · State & multi-host · docs/threat-model.md · Roadmap · SECURITY.md
Run a compromised agent — one that ignores the SDK and tries every route around the harness — inside the reference isolated runtime:
or, with all checks evaluated automatically:
What this runtime enforces, precisely: the agent process cannot open a socket to anything except the harness API, and it cannot read the tool credentials, permit signing key or token keyring. Its own credential is a short-lived signed token; tampered, forged, expired, revoked and over-long tokens are rejected. The direct tool calls now fail at the network (0 = no connection),
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/jersonboydmilan--Capgate.html)
The execution safety layer for AI agents.
TeodorMCP/universal-connector-mcpUniversal MCP server: connect any OpenAPI/Swagger, GraphQL, gRPC or SOAP API to AI agents. Security-first, local, token-efficient. Any API. One server.
wangke-112/agent-safe-toolsAsk your AI coding agent, in natural language, to search production logs or inspect a database — safely. Two drop-in MCP servers (MySQL, SSH logs) keep safety red lines in code: read-only by default,
HUA503/mcprismFast single-binary security scanner for MCP (Model Context Protocol) servers — config audit, live capability enumeration, tool-poisoning detection & risk grading. Zero deps, fully offline — trivy for
bybit-exchange/kaasTurn scattered notes, docs and transcripts into a queryable Markdown wiki — an LLM knowledge-base compiler with MCP access, no embeddings, self-hosted.
PyModel/jev-judge-mcpTyped judgment tools for MCP agents. TypeSafe's Jev model as verify, screen, find, classify, rerank, decide, compare, extract, review, gate, and score: the model judges, policy decides auto, review, o
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.