🛂 Tollgate

The governance gate for AI agents that move money. The LLM is an untrusted component — it proposes; deterministic code disposes. Every tool call crosses one enforcement point, or it never happens.
GitHubpip install tollgate-gatewayThreat model
pip install tollgate-gateway && python -m tollgate demo-web → open http://127.0.0.1:8765 · approve the $4,200 transfer in your browser · no API key needed

One gate, 16 rings default-deny, fail-closed, measured

unknown tool→rate limit→circuit breaker→integrity fingerprint→read cache→accountability registry→blacklist→budget reserve (atomic)→field-semantics contract→injection fence + canaries→financial guardrails→adaptive risk score→policy rules→signed approval→execution→hash-chained audit

Denial reasons flow back to the model so it can adapt. Anything not explicitly allowed is denied.

Money gets a lifecycle, not a flag

ReserveAtomic budget hold (BEGIN IMMEDIATE) — concurrent agents can never overspend on a stale balance.
ApproveEd25519/HMAC signatures, per-approver keys, four-eyes above thresholds, non-repudiable verification.
Hold24h escrow window. Execution ≠ settlement.
Recoverfreeze → clawback → payee blacklist. Fraud reversed in two operator-signed steps, every one chain-logged.

Proof, not vibes

32/32injection corpus blocked
0/8benign false positives
300fuzz cases · 4 invariants hold
189tests · CI green on 8 matrix cells
0mandatory dependencies

One invariant is enforced by fuzzing: actual executions ≡ audited executions. Policy hot-reloads land in the hash chain themselves — changes to the law are auditable too.

Plug it into any agent

Ships as an MCP server (stdio JSON-RPC 2.0, zero deps). Point Claude Desktop, Cursor or your own agent at it and every tool call is governed — callers write no security code.