Metadata-Version: 2.4
Name: cwn-llama-index-trust-gate
Version: 0.3.0
Summary: LlamaIndex tools for the Trust Gate MCP server: signed receipts, a read-only-allowlist decision gate, an egress marker check and an exit drill.
Author-email: Cyber Warrior Network <apps@cyberwarriornetwork.com>
License: Apache-2.0
Project-URL: Homepage, https://github.com/CWNApps/llama-index-trust-gate
Project-URL: Trust Gate, https://trust-gate-mcp.onrender.com
Project-URL: Smithery, https://smithery.ai/servers/apps/cwn-trust-gate
Project-URL: Source, https://github.com/CWNApps/llama-index-trust-gate
Keywords: llama-index,llamaindex,mcp,trust-gate,post-quantum,agent,receipt
Classifier: Development Status :: 4 - Beta
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security :: Cryptography
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: llama-index-core>=0.11
Requires-Dist: httpx>=0.27
Provides-Extra: test
Requires-Dist: pytest>=7; extra == "test"
Dynamic: license-file

# llama-index-trust-gate

LlamaIndex tools for **Trust Gate**: signed receipts for agent actions, a read-only-allowlist decision gate, an egress marker check and an exit drill.

Receipts are signed by the hosted MCP server (no local signing key) with Ed25519, plus ML-DSA-65 when the server has a post-quantum backend. A receipt's integrity can be checked offline. To know **which key signed it**, verify with `expected_kid` (the kid of the server you trust): without that, anyone can generate keys and sign a receipt that verifies. The server defaults to PQ-required verify (a receipt with no verified post-quantum signature is rejected); set TRUST_GATE_REQUIRE_PQ=false on your own deployment to allow Ed25519-only receipts.

## Install

```bash
pip install cwn-llama-index-trust-gate
```

## Usage

```python
from llama_index.core.agent import ReActAgent
from llama_index_trust_gate import mint_action_receipt_tool, verify_receipt_tool

agent = ReActAgent.from_tools(
    [mint_action_receipt_tool(), verify_receipt_tool()],
    llm=...,
)
```

## Tools

| Factory | Name | Purpose |
|---|---|---|
| `mint_action_receipt_tool()` | `trust_gate_mint_action_receipt` | Mint a signed receipt (Ed25519, plus ML-DSA-65 when the server has a post-quantum backend) for a consequential agent action. |
| `verify_receipt_tool()` | `trust_gate_verify_receipt` | Verify a receipt offline. Pass `expected_kid` to pin the signer; the result reports `signer_pinned`. |
| `gate_decision_tool()` | `trust_gate_gate_decision` | Two-phase gate (server 0.3.0 or later). PREVIEW returns a verdict (ALLOW, DENY, ESCALATE); COMMIT signs a receipt and returns a permit, GRANTED only for ALLOW. It judges names against a read-only allowlist and does not observe or block anything. |
| `check_egress_tool()` | `trust_gate_check_egress` | Check data for sensitivity markers (NO_MARKERS_FOUND / INTERNAL / CONFIDENTIAL / RESTRICTED) before it leaves. It flags and cannot block. |
| `run_exit_drill_tool()` | `trust_gate_run_exit_drill` | Vendor exit-readiness drill: checks the local signing key and whether a local model endpoint is configured. It signs a receipt, which creates the signing key on first use. |

## Configuration

```bash
export TRUST_GATE_URL="https://trust-gate-mcp.onrender.com"  # default; override for self-hosted
```

## Compatibility

This release is written for Trust Gate MCP server 0.3.0 or later. Versions before 0.3.0 of the server's `gate_decision` returned GRANTED for every input: treat any GRANTED permit from a server older than 0.3.0 as not evidence. See the [security advisory](https://github.com/CWNApps/trust-gate-mcp/security/advisories/GHSA-gxfp-4vvx-wjc8).

Passing `expected_kid` to a server older than 0.3.0 raises an error: those servers ignore the argument and would otherwise return `ok` without checking the signer.

## Telemetry

One fire-and-forget `GET /x?via=llamaindex&kind=api` per tool call. No PII, no cookies, never blocks the tool.

## Related

* **langchain-trust-gate** -- same tools, LangChain shape
* **crewai-trust-gate** -- same tools, CrewAI shape
* **Trust Gate MCP** -- the hosted server: <https://trust-gate-mcp.onrender.com>

## License

Apache-2.0.
