Skip to main content
Free local Gate Starter · MCP alpha

See every declared action. Prepare one boundary before it becomes real.

Point EMILIA Scan at the MCP tools your agent is configured to call. After one exact runtime install, the Gate Starter command maps that declared surface, prepares a reviewable guard for one tool, and runs bounded refusal checks. No account, upload, or telemetry.

STEP 0 · INSTALL THE EXACT LOCAL RUNTIME
npm install --save-exact @emilia-protocol/mcp-guard@0.6.0
CREATE THE STARTER AND RUN ITS LOCAL CHECK
npx @emilia-protocol/scan@0.5.0 protect ./tools.json --action sendWire --apply --verify

Replace sendWire with one exact name from your declared MCP surface. The command does not launch the configured server or call the selected tool. Package installation may contact npm; Scan and the generated verifier make no remote request.

One useful path

Map → Choose → Prepare → Activate

The first three steps happen on your machine. Production activation is a separate engineering step because generated files cannot prove that every real execution path is controlled.

  1. 01LOCAL

    Map

    Read the actions declared in your MCP tool list and preserve the scanner's blind spots.

  2. 02OWNER

    Choose

    Name one consequential tool. Classification is a proposal until the owner reviews it.

  3. 03SCAFFOLD

    Prepare

    Write a manifest, guard scaffold, integration guide, and bounded local refusal check.

  4. 04PRODUCTION

    Activate

    Connect Gate to the real credential-owning path under a customer mandate and verify refusal.

No tools file required

Try the whole local path on a built-in sample.

After the same exact runtime install, this uses a synthetic tool list and writes only local scaffold files. It is a fast way to inspect the shape before pointing the command at your own declaration.

npx @emilia-protocol/scan@0.5.0 protect --sample --action sendWire --apply --verify

What you get

Action map
The declared MCP surface, proposed consequence classes, and explicit blind spots.
Selected boundary
A generated wrapper for the exact tool name you selected, not a blanket security claim.
Integration files
A manifest, guard module, setup verifier, and instructions written to a local directory.
RR-1 check
Synthetic missing, exact-match, mutation, and replay cases exercised without calling the real tool.
AFTER YOU INSPECT THE BYTES
Record review as a second, explicit action.

Read the generated Authority Map and manifest first. Then this separate command revalidates the existing pack and creates an owner-only handoff. It does not activate Gate.

npx @emilia-protocol/scan@0.5.0 protect ./tools.json --action sendWire --reviewed \
  --crossing-profile ccs-wang-draft08-v13
The honest boundary

A passing local check is not production protection.

RR-1 exercises the generated wrapper against synthetic evidence. It does not prove a production authority source, complete mediation, correct policy, durable replay defense, or a protected deployment.

Customer mandate
Mission, limits, evidence rules, expiry, trust roots, and exception path are owned by the customer.
Owning connector
Every covered call reaches Gate beside the credential-owning executor. Alternate paths remain exclusions until mediated.
Durable state
Pinned keys and policy, shared one-use consumption, provenance, and failure handling survive process restarts.
Verified refusal
Missing, stale, exhausted, invalid, or mismatched authority is shown to refuse provider entry on the covered path.
Fixed protected-workflow pilot

Make this one boundary real.

In the 90-day, $25K pilot, we scope one consequential workflow, connect Gate beside its owning executor, install the customer mandate, and verify refusal before production entry.

Gate Starter exit codes and limits
0Requested preview, generation, local check, or reviewed handoff completed
1Input, runtime, filesystem, safety, or local verification was refused
2A required value is missing, or OpenAPI protection is not available
64An option or selected-action contract is invalid

Exit 0 means only that the requested local CLI operation completed. It is never a clean bill of health: Scan cannot see runtime-registered tools or value-dependent risk, and no local command proves complete operation coverage or production mediation.