Trust infrastructure for autonomous AI agents
Find an MCP server and review its automatic pre-check before connecting your account. Then discover useful agents with AI, approve their actions, and follow every run.
Already running an agent? Observe an MCP workflow. Recommended onboarding: run the customer-controlled adapter in passive observe mode, learn from counterfactual findings, then choose when to enforce.
Decision is plausible. Manager approval is still required.
trace_01JAA4…A91CFor MCP developers · Preview
Check protocol discovery, tool descriptions, and declared schemas. Get actionable findings with versioned spec guidance, without signing in. Publish your report to make those observations available in AgentAction discovery.
Anonymous metadata inspection. No credentials or tool execution. Runtime behavior remains untested.
01 / The gap
Know whether your agent chose the right action, whether it was allowed, and whether it achieved the job. AgentAction connects policies, approvals, and outcome evidence—without inspecting hidden chain-of-thought.
03 / The trust lifecycle
Before an agent acts, assess whether the decision is justified. When it acts, ensure the action is authorized. Afterward, preserve proof of what happened and evaluate the result.
The agent declares the goal, proposed action, and relevant context.
Decision evidence is checked for justification, uncertainty, and safer alternatives.
Identity, policy, approvals, and durable state return allow, deny, or challenge.
The provider verifies the exact-action authority and applies its own rules.
Receipts and verified observations record what was authorized and what occurred.
Immutable assessments feed assurance signals across runs, profiles, and versions.
intent → assessed → authorized → executed → evidenced → evaluated04 / The platform
Turn a job into an agent you can put to work. Start with a recipe, evaluate it against your intent, then bring decision assurance, action authorization, and ongoing visibility into every run.
Find servers by capability, review public authentication and tool risk signals, and build a supervised agent. Test it against your intent and track outcomes across runs.
Discover → inspect → connect → supervisePublic findings are not safety certification; authenticated tools may remain unseen. OAuth discovery is available; OAuth login is not yet supported.
Open My agentsAssess the declared basis for a consequential choice: policy factors, alternatives, assumptions, uncertainty, and supporting evidence.
Decision evidence → allow · deny · challengeUses normalized decision evidence—not private chain-of-thought or hidden model reasoning.
Gate the exact tool call against policy and prior state, then issue action-bound authority that providers can verify.
Tool call → policy → signed receiptDeploy locally today or connect the decision and evidence service behind a gateway.
05 / Deploy the boundary
Route model and tool traffic through company policy. Use the least expensive qualified model, stop unsafe or duplicate actions, and preserve evidence from selection through execution.
Explore the GatewaySelect an approved, cost-effective model for the task, risk, privacy boundary, and company policy.
Control models, providers, tools, destinations, sensitive data, budgets, and versioned system context.
Deduplicate consequential actions and replay the original provider result for an identical safe retry.
Correlate routing, authorization, approval, execution, replay, observation, and assessment evidence.
Action decisions, approvals, data-flow controls, safe replay, signed receipts, and MCP reference integration.
Production gateway packaging, risk-aware inference routing, managed company context, and broader protocol coverage.
06 / Trust model
Security facts come from authenticated systems and durable state, not from conversation text or agent-editable memory.
07 / Inspect the evidence
The read-only console keeps unlike intent-profile versions separate and makes failed, partial, indeterminate, and low-confidence outcomes visible instead of blending them into one score.
Inspect Fleet Overview, filter finalized Jobs, and open a deterministic evidence timeline without signing in. The demo is isolated from production services and contains no customer data.
The production operator console remains behind Cloudflare Access. Identity establishes the tenant boundary before the console can reach the private, read-only gateway service.
Available now: profile-scoped intent and outcome observability. Roadmap: richer OpenTelemetry correlation across runtime boundaries, retries, provider execution, observations, and assessments.
08 / Proof, not promises
AgentAction labels experimental work and roadmap items plainly. The public repository, runnable examples, fixtures, and tests are the source of truth.
Available now
Local and hosted checks for exact tool calls, approvals, amount caps, budgets, circuit breakers, sensitive-data movement, idempotency, and replay protection.
Available now
Signed, action-bound authorization receipts, public verification keys, provider middleware, contracts, fixtures, and negative conformance cases.
Available now
Linked execution receipts, immutable evidence snapshots, verified observations, versioned intent contracts, and outcome assessments.
Available now
Explore synthetic fleet rollups, finalized jobs, constraint outcomes, evidence confidence, and deterministic evidence timelines in the public read-only demo.
Open the public console demoRoadmap
Richer OpenTelemetry correlation across runs, boundary decisions, tool calls, retries, provider execution, observations, and assessment evidence.
Roadmap
Task-scoped capability state that can remove incompatible authority after protected events without silently expanding what an agent may do.
External proof target
Two independent providers passing the same public action-authorization cases without project-specific runtime coordination.
09 / Recommended onboarding
Available nowRun the customer-controlled MCP adapter beside an existing workflow. In observe mode, it forwards every MCP call unchanged while recording the counterfactual allow, deny, or challenge decision and actionable findings in process-local shadow state.
Run the observer quick startThis reference adapter is a quick onboarding and integration path, not yet a production-complete MCP gateway. When the findings look right, switch the same deployment from observe toenforce deliberately.
Need an in-process boundary instead? Embed the TypeScript guard
observe → enforce10 / One boundary, four entry points
Wrap consequential tool calls with a small authorization boundary inside an existing agent loop.
Apply consistent action policy before forwarding MCP tools/call or other privileged operations.
Verify action-specific enterprise authority before mutation, then apply provider business authorization.
Connect proposals, approvals, decisions, execution, observations, and assessments without trusting the model as the record of truth.
11 / Open standards posture
AgentAction reuses established identity, policy, transport, signing, and provenance work where it fits. The project contributes mappings, negative fixtures, reference verifiers, conformance cases, and narrowly scoped experimental profiles. Its community drafts are not adopted standards or external certifications.
Agent recipes
Choose a recipe built around real MCP servers. Adapt it to your needs, test it in your environment, and follow its outcomes in AgentAction.
Powered by Firecrawl
Compare pricing pages with saved evidence and report changes to prices, limits, and packaging.
View recipePowered by Intercom
Find repeated questions, check existing answers, and prepare sourced help article drafts for review.
View recipePowered by Sentry + Linear
Collect error evidence, check for existing work, and create one reviewed, actionable ticket.
View recipeEach starter includes setup guidance and synthetic test cases. Validate your agent with connected services before putting it to work.
12 / Enterprise transition blueprint
Do not decide whether an agent is simply “autonomous.” Decide which action classes it has earned the right to perform, under which conditions, and with what evidence.
Advance one bounded workflow at a time. Every stage changes the operating mode only after its exit evidence is available.
Define one bounded workflow, its owner, value, risk, consequential actions, and human baseline.
Is the job, owner, value, risk, and human baseline clear?
Test historical, edge, adversarial, and failure cases before the agent touches production traffic.
Does the agent meet quality and safety thresholds on representative cases?
Record counterfactual decisions on representative traffic without duplicating or changing side effects.
What would happen on real traffic if policy were enforced?
Bind approval and short-lived authority to the exact actor, job, tool, resource, and payload.
Can exact actions execute safely with approval and recovery controls?
Automate only earned action classes; keep exceptions, missing context, and high-impact work supervised.
Which actions can run autonomously without exceeding the risk envelope?
Referenced practitioner field guide · 9 pages
Includes the evidence stack, evaluation scorecard, 90-day launch plan, three applied workflow playbooks, and reference anchors.
Bring us one consequential agent workflow.
We will map where the workflow is today, what evidence it needs to advance, and how to reach supervised action without widening authority faster than the controls around it.
Define the bounded job, owners, consequential actions, risk tiers, constraints, and current human performance.
Specify representative cases, promotion thresholds, counterfactual decisions, traffic coverage, and required evidence.
Design exact approvals, action-bound authority, provider evidence, recovery controls, and a staged operating plan.