Early release

Let your agent act. Keep the right to say no.

Trust Gateway sits between an AI agent and the things it can change. Before the agent acts, it asks. The gateway checks the owner's grant, works out how hard the action is to undo, and answers allow, hold or deny. Every answer is a signed receipt anyone can verify.

Try it live API and MCP docs

What is real today: the API, the MCP connector, the policy engine, approvals and Ed25519 signed, hash chained receipts, all running on this site. What is not: user accounts, phone push approvals, and payments of any kind. The demo uses synthetic actions only.

How it decides

1. Scoped grant

The owner lists exactly which actions the agent may take, with amount limits and an expiry. Anything not listed is denied.

2. Reversibility check

The server classifies each action as easy to undo, hard to undo, or irreversible. The agent can make the class stricter, never looser. Unknown actions count as irreversible.

3. Allow, hold or deny

Small and reversible: allow. Over the owner's threshold, or irreversible: hold until the owner approves that exact action, once. Outside the grant or over its limit: deny.

4. Signed receipt

Every answer is signed with Ed25519 and chained to the one before. Change one decision or drop one receipt and verification fails.

Try it

Step 1. The owner makes a grant

Grant lasts 60 minutes. It allows file reads, emails, purchases, deletes and transfers up to $500, each with the rules below.

Purchases: hard limit ($)

Purchases: hold above ($)

No grant yet.

Step 2. The agent asks before acting

Step 3. Check the receipts

Receipts

Receipts appear here.

Add it to your stack

Any agent that can call HTTP or MCP can use it. Point your MCP client at /mcp, or call POST /api/v1/check before each side effect. The gateway owns the permission path. It does not run your agent's actions.

curl -s -X POST /api/v1/check -H 'content-type: application/json' -d '{"grant_id":"gr_...","action":"purchase","target":"shop.example","amount":60}'

Limits you should know

Early release on a free tier. Grants are stored for 3 days, then deleted. If the free write quota runs out, the API returns a clear 503 until 00:00 UTC.
The agent's grant id is its credential, and the owner token is shown once. There are no accounts or SSO yet.
Classifying how hard an action is to undo uses a fixed action list plus your limits. It does not read the action's content. Unlisted actions are held or denied.
This is a checkpoint the agent has to call. It cannot stop an agent that ignores it. Pair it with credentials that only the gateway's callers hold.