Lifeline

An MCP gateway agents can't kill: it refuses tool calls that would cut the agent's own connection and ships the change hands-off through GitLab.

Comment

Inspiration

We run AI agents against production machines through a relay. One day an agent was asked to apply a fix and "restarted the relay to pick it up". The relay was the agent's own connection. The restart cut it, nothing was left to bring the relay back, and production was down for 19 minutes. The agent did exactly what a person would do at a terminal; it just could not see that it was sawing off the branch it sat on.

What it does

Lifeline is an MCP gateway that knows what it depends on. Every tool call is read against its self-dependency graph (process and group, port, Cloud Run service and revision, code, runtime, policy, credentials, host). A call that would cut that lifeline is refused with a receipt, and the change the agent wanted is shipped by GitLab with no person in the loop: intake → mender flow → merge request → verify, scan, incident replay, trust gate → GitLab Duo Code Review → merge armed on the checked SHA → Cloud Run canary with a live agent session counting dropped calls → the new revision must refuse the incident again → release. Failure rolls back, opens an incident and starts the medic flow.

Verify it in two minutes (clean run, 18 Oct 2026, UTC)

  • 04:21 an agent asks the production gateway to edit its own code and restart; refused, receipt ll-991b2ab17a54
  • 04:47 intake files issue #10 and starts the mender flow
  • 04:48 the mender opens MR !4 with a test; its pipeline runs tests, the incident replay, four scans and the trust gate
  • 04:51 GitLab Duo Code Review: nothing to comment on; approved
  • 05:06 merged on the checked commit by the flow's service account
  • 05:15 canary 10 → 50 → 100 %: 64 live calls, 0 dropped; release v0.13.0-lifeline.49

How we built it

  • Guard: deterministic parser + graph in Python inside the fork (no model in the decision path), 208 tests, including the bypasses found while red-teaming the parser.
  • GitLab Duo Agent Platform: two custom flows in the AI Catalog (mender, medic), AGENTS.md, agent-config.yml, review instructions, Flows API from CI with an environment-scoped steward token.
  • GitLab CI: lint/types/tests, incident replay, SAST, secret detection, dependency and container scanning, wheel to the package registry, image to the container registry, trust gate, merge arming, canary deploy, release, monitor, intake, medic.
  • Google Cloud: Cloud Run (staging + production, canary by revision tags), Artifact Registry, Cloud Storage receipt queue, keyless Workload Identity Federation; the runtime service account can only create receipt objects.

Challenges

Flows cannot merge, release or start other flows, and bots cannot fire triggers, so CI closes the loop. Participants cannot create trigger tokens or project tokens, which led to the better design: the gateway holds no GitLab credential. The runs before the clean one found real problems, and the guards caught them: a production canary rolled itself back because the witness counted a timeout on its own follow-up lookup as a dropped call; the medic flow diagnosed it and, since the witness is a gate it may not edit, asked for a person (#9). The README lists every manual step we took and why.

Accomplishments

The incident is replayed on every pipeline against real processes, and the job fails unless the unguarded gateway actually dies and Lifeline refuses the same call. The deployed revision has to refuse it again before it gets traffic. A live agent session calls through the gateway during the rollout, and a single dropped call fails the deploy and rolls it back.

What we learned

Agents need the same seat belt people get from experience: know what you are standing on. The pipeline needs it too, so agents may not edit their own gates.

What's next

Ship the guard as a library for other MCP servers and relays; learn the graph from service manifests; add a network rule set (firewalls, ports).

Built With

Share this project:

Updates

Submission history