FLINT AgentGate

FLINT AgentGate gives enterprises a verified agent identity registry, a screened MCP tool registry, and real-time gateway controls for authorization, monitoring, and revocation.

Comment

Inspiration

WebMCP gives agents a direct way to discover and use browser capabilities. That improves the experience over asking an agent to interpret a visual interface, but enterprises still need to answer four questions before a capability becomes available: Which agent is acting? Who authorized it? Which exact tool version may it use? Why was this request allowed or blocked?

FLINT AgentGate began with a simple requirement from a CISO colleague: an agent should receive a tool only when its current identity, principal authority, approved tool version, and request context agree.

We built AgentGate Community as a public reference implementation that builders can clone, inspect, and challenge without an account or API key. It also reports what it can observe. Connected surfaces, attribution confidence, and known blind spots stay visible throughout the demo.

What it does

AgentGate connects tool assessment, agent identity, semantic authority, runtime policy, and signed evidence in one browser session.

  1. Assess one exact tool version. A builder submits publisher metadata, capabilities, destinations, data classes, behavior annotations, JSON Schema, and tool instructions. A bounded deterministic scanner checks the declaration for prompt injection, destructive behavior, excessive access, ambiguous schemas, unrestricted outbound access, missing controls, and toxic combinations. AgentGate computes a canonical SHA-256 artifact digest without fetching or executing the submitted tool.

  2. Issue a Community Tool Passport. A passing artifact receives a locally signed credential bound to its exact version, digest, and assessment. The credential uses an ephemeral ECDSA P-256 key and is labeled community-self-attested. It proves local payload integrity for the demo. It is not a FLINT Stamp or a claim that FLINT verified the publisher.

  3. Bind identity and semantic authority. The Identity Registry keeps 4 records separate:

    • CAN: What the agent build claims it can do.
    • MAY: What the named principal authorizes.
    • TOOL: What the assessed tool version permits.
    • MAY NOW: The narrow assignment that survives the current intersection.

  4. Govern the capability through WebMCP. AgentGate feature-detects document.modelContext.registerTool(...) and registers only a currently eligible capability. Browsers without native WebMCP receive a labeled operator fallback that calls the same Trust Provider and policy evaluator. Every invocation rechecks identity, passport integrity, assignment, action, resource, destination, data class, side effects, purpose, expiry, and revocation.

  5. Produce signed decision evidence. An aligned request returns ALLOW. Purpose drift, stale authority, revocation, or another policy failure returns BLOCK. Each decision produces a signed, version-bound record with a plain-language reason, technical reason codes, policy fingerprints, and copy or JSON download controls.

The overview adds a moving fleet visualization. Operators can inspect an agent's identity state, tool, scope, and mandate while viewing coverage only for named, connected demo surfaces.

Why WebMCP

WebMCP turns authorized capability into a structured agent experience.

A human operator defines the agent, principal, mandate, and permitted resources. The agent discovers only the tool that survives those controls. The Gateway evaluates the request before execution, and the operator receives evidence tied to the exact versions that governed the decision.

This creates a workflow that was difficult to maintain with visual automation or static tool configuration. The human sets authority in one place. The agent receives a machine-readable capability instead of guessing through a UI. The security team can reconstruct what happened without correlating unrelated logs.

WebMCP provides the capability surface. AgentGate makes exposure conditional based on current authorization.

How we built it

AgentGate Community is a browser-session React and TypeScript application built with Vite. Zod validates versioned agentgate.v0 contracts at each boundary. JSON Schema describes tool inputs. The Web Crypto API generates ephemeral ECDSA P-256 keys and verifies signed credentials. Canonical serialization produces stable SHA-256 artifact and policy fingerprints.

A replaceable ScannerAdapter normalizes deterministic findings into a stable assessment contract. A separate TrustProvider owns assessment, credential issuance, identity resolution, assignment, runtime decisions, revocation, and evidence. This keeps the public contracts stable if an organization later replaces the local provider with a managed trust service.

The native WebMCP adapter and visible browser fallback call the same evaluator. Identity, authority, tool version, and assignment are resolved again at invocation time instead of being trusted from an earlier screen transition.

We studied the public Snyk Agent Scan and Visa Vulnerability Agentic Harness projects for risk categories, staged evidence, and deterministic gates. Their code is not vendored into this repository.

OpenAI Codex served as an engineering and product partner. We used it to challenge the authorization model, trace policy paths, implement the React and TypeScript application, write tests, run security and novice-usability reviews, improve the documentation, and produce the demo assets. The application does not use an LLM to override authorization decisions.

Challenges

Keeping the assurance boundary honest

A local signature can reveal later changes, but it cannot establish organizational trust. We encoded that distinction in the credential schema, verification result, interface copy, tests, and README.

Preventing capability from becoming permission

Builder declarations are untrusted inputs. Agent capability, principal authority, tool semantics, and assignment remain separate versioned records. Directional subset checks reject an assignment that expands an upstream envelope.

Adding semantic intent safely

Purpose drift needs more than exact string matching. AgentGate allows semantic analysis to escalate a deterministic ALLOW to REVIEW or BLOCK. It cannot convert a deterministic denial into ALLOW, and a provider error fails closed.

Supporting an emerging browser standard

Native WebMCP availability varies by client. The product identifies the active surface and preserves one policy path across native registration and the operator fallback.

Making agent identity understandable

The model is advanced, so we tested the workflow as a novice. We added a guided safe path, prefilled examples, prerequisite states, plain-language verdicts, a glossary, a How it works view, transient fleet inspectors, and visible next actions.

What we learned

Conditional tool exposure should be an output of authorization. Every authority-bearing record needs an issuer, version, status, validity window, and relationship to the evidence used at decision time.

We also learned that explicit limits improve security evidence. Named observation surfaces and visible blind spots give an operator something concrete to evaluate.

The final lesson was about user experience. A correct policy decision still needs a readable explanation, a portable record, and a clear next action.

Accomplishments

AgentGate demonstrates the complete path from exact-version assessment through Tool Passport issuance, identity registration, semantic authority, assignment, conditional WebMCP exposure, ALLOW, signed evidence, mandate-drift BLOCK, authority revision, revocation, and risky-tool rejection.

The repository is MIT licensed and runs without a FLINT account, database, scanner credential, or production signing key. The release gate passes its source scan, TypeScript validation, production build, dependency audit with 0 production vulnerabilities, and 57 automated tests covering contracts, scanner failures, signature tampering, authority expansion, stale assignments, semantic drift, browser fallback behavior, evidence integrity, and revocation.

What's next

AgentGate Community will remain the cloneable reference implementation.

FLINT Command will provide managed organizational identity, FLINT-controlled Stamp issuance, continuous discovery and reassessment, centralized monitoring, evidence retention, enterprise policy administration, response controls, and network intelligence. The public contracts and deterministic enforcement mechanics give builders an integration path while managed trust remains an enterprise service.

Try FLINT AgentGate

View the public repository

Built With

Share this project:

Updates