detent
Ecosystem/03 of 08

MCP Tool Guard

Why it is in the ecosystem. Where we cannot instrument the venue (the Binance Agent OS class), we instrument the agent. Tool definitions are pinned by hash at approval; every call gets a verdict and a receipt, no venue permission needed.

pin and compare REALverdict REALtool DEMOwho pays: platforms and fleets, per agent

What it is

On a closed platform we cannot stand in front of the venue, so we stand in front of the agent. Every tool the agent sees is proxied through one MCP server. The definition is canonicalised and hashed when the owner approves it, and re-hashed on every call. A tool that changed after approval is not the tool that was approved, and check 07 says so before the call runs.

Try it

pin and compare REALverdict and receipt REALtool DEMO
tool definition · pay_invoice
DEMO
 {
   "name": "pay_invoice",
   "description": "Pay a supplier invoice from the treasury wallet. Amount in USDC.",
   "inputSchema": {
     "type": "object",
     "properties": {
       "invoice_id": {
         "type": "string",
         "description": "The invoice number, e.g. 2214."
       },
       "amount": {
         "type": "string",
         "description": "Amount in USDC."
       },
       "payee": {
         "type": "string",
         "description": "The supplier address on the mandate."
       }
     },
     "required": [
       "invoice_id",
       "amount",
       "payee"
     ]
   }
 }
pinned at approval
approve the tool to pin it
hash at call time
no hash yet
no pin yet. an unpinned tool is not_evaluated by check 07, which is not a pass.
3 · the call the agent is about to make
pay_invoice({
  invoice_id: "2214",
  amount: "120",
  payee: "0x7a1F…C4b3"
})

Wire it into a framework agent

install

One MCP server in front of the agent's tools. Every tool the agent sees is proxied, pinned and metered. Published on npm as detent-mcp, built on detent-sdk.

// claude_desktop_config.json · cursor · any mcp host
{
  "mcpServers": {
    "detent": {
      "command": "npx",
      "args": ["-y", "detent-mcp"],
      "env": { "DETENT_API_KEY": "dt_test_…" }
    }
  }
}

// nine tools: detent_check, detent_run_workflow, detent_list_workflows,
// detent_receipt, detent_verify_receipt, detent_stats, detent_health,
// detent_pin_tool, detent_check_tool
$ npm install detent-sdk      // the client and the offline verifier
what the guard enforces
  • pinDefinitions pinned by hashname, description and input schema, canonicalised and hashed at approval. the hash is in the receipt.
  • callA verdict per callevery invocation that can move value or change state goes through the seven checks in-process.
  • driftChange after approval escalatesa mutated definition is check 07's failure. STEP-UP by default; DENY where the change adds a value-moving parameter.
  • venueRuns where the venue will not let uson a closed platform the guard runs on the agent itself: receipts, caps and the kill switch without the venue's permission.
the aha: The tool I approved is not the tool that just tried to run, and the guard knew.
The On-chain LockNext · Agent Passport