Trust model
Claims inform review. Controls grant authority. Evidence records the read.
null.select keeps static metadata, runtime enforcement, upstream response validation, and audit evidence separate.
Core principle
The model can request. It cannot authorize itself.
The production gateway derives organization, principal, client, scopes, environment, and release from a validated connected session or automation credential. Deterministic policy rechecks organization, source, environment, tool, principal, credential, grant, and usage state before dispatch. Client-supplied tenant identity and MCP-token passthrough to upstream APIs are forbidden.
Identity and authority are re-evaluated for every request.
Four evidence boundaries
A complete story without pretending to own every truth.
Definitions are review evidence
Names, descriptions, schemas, and annotations explain the advertised capability. They are useful, but an untrusted server can be incomplete or dishonest.
The gateway owns enforcement
Credential validation, release verification, policy, destination limits, dispatch, output validation, and redaction happen outside the model.
The ledger owns causal history
One hash-linked record connects the request, principal, immutable release, decision, bounded read, validated output, and delivered response without storing secrets or raw payloads.
The output contract owns the response shape
The gateway returns only validated structured content after the upstream response satisfies the reviewed tool contract. Unreviewed metadata and free-form content are not relayed.
Static assessment
What advertised tool metadata can—and cannot—show.
Observable
- Tool names, breadth, and confusable collisions
- Descriptions and instruction-like metadata
- Input and output schema posture
- Credential-like and destination-like inputs
- Standard behavior annotations and contradictions
Not observable
- Server implementation or runtime side effects
- Authentication and tenant derivation
- Authorization and approval enforcement
- Secret storage and outbound network controls
- Audit completeness and outcome verification
A clean static report is not a certification. Missing runtime evidence stays visible as not observable.
Runtime control path
The managed gateway narrows authority before dispatch.
Authenticate
Validate the short-lived OAuth access token or expiring automation credential and resolve its server-side organization, principal, client, environment, and exact tool authority.
Authorize
Resolve and verify the environment's immutable signed release, require the exact tool scope, evaluate the exact digest-bound environment policy profile, and apply current organization, source, environment, tool, principal, and credential controls. Incompatible releases cannot be activated.
Constrain
Validate input, dispatch only through the release's reviewed route, reject redirects and non-public addresses, and bound time and size.
Record
Hash-link receipt, release, validation, policy, dispatch facts, output digest, and response delivery; verified detail resolves the immutable activation authority, environment revision, source revision, and candidate evidence. Exact server-side filters and stable cursors locate retained executions without weakening tenant or environment grants.
Read-only evidence
The caller receives evidence it can correlate with the stored chain.
Request received
Record the authenticated principal, client, tool name, and a digest of the arguments.
Policy allowed
Record the release digest, required scope, and deterministic decision reason before dispatch.
Read completed
Record the fixed destination, response status class, byte count, and duration.
Response delivered
Record the output digest and return the execution identifier, release digest, and audit-chain tip.
Managed tools are read-only; their recorded business-effect state is not applicable.
An authorized member can package one verified execution as a bounded ZIP. Its script-free HTML summary and complete JSON chain are bound by a canonical Ed25519-signed manifest. The open-source CLI verifies the packet offline against retained public keys. Raw arguments, prompts, outputs, upstream bodies, and secrets remain excluded; the packet does not claim to certify effects beyond the gateway boundary.
Production scope
A hosted static assessor and a hosted read-only enforcement boundary.
Free assessment
Bounded review of one public endpoint observation or submitted MCP tool definitions, with deterministic findings and explicit runtime coverage gaps. Endpoint mode calls no tool and retains neither the URL nor definitions.
Managed MCP
Stateless MCP 2026-07-28 over HTTPS with browser-authorized, revocable OAuth sessions or separate expiring automation credentials, organization-scoped named environments, database-enforced member grants for all or selected environments, versioned first-party read-only profiles, authorization-filtered tool discovery, and safe errors.
Reviewed sources
Operator-reviewed public HTTPS MCP sources with explicit anonymous, environment-shared bearer, or per-member OAuth authority. Personal OAuth grants are encrypted, exact-member, exact-environment, and exact-source; refresh is serialized and automation fails closed. Source history retains immutable scheduled or immediate observation evidence, explicit accept-or-dismiss decisions, revision digests, semantic change history, positive and negative candidate evidence, signed releases spanning up to five exact source revisions, separate activation or rollback, validated structured output, and linked audit evidence.
Start with the visible surface
Run the free MCP assessment.
See actionable findings and explicit unknowns before choosing what deserves production enforcement.