Asimov dual-gate firewall for AI agents: screen every action before it executes. 49 tools.

🛠️ Key Features

Name: io.github.jyswee/a2a-trustgate
Description: Asimov dual-gate firewall for AI agents: screen every action before it executes.
Tools: 49 tools included
Topics: agent, ai-safety, audit, cli, compliance, crewai, cursor, eu-ai-act, firewall, guardrails, langchain, llm, mcp, nist, openai, windsurf

🚀 Use Cases

Agent action screening prior to execution
AI safety and compliance auditing
Guardrail enforcement for tool usage in LLM workflows

⚡ Developer Benefits

Clear MCP-aligned governance for tool invocation
Integrates with LangChain and LLMS for controlled workflows
Supports auditability and compliance with safety standards

⚠️ Limitations

Source data indicates 49 tools; scalability and real-world performance may vary
Specific implementation details and configuration are not provided in the source excerpt

a2a-trustgate

A safety, compliance, and audit layer for AI agents — screen every action through a dual-gate firewall before it executes. As easy as git.

git commits your code. a2a screens your agents.

Your agent can run commands, hit APIs, touch devices, spend money. One bad tool call — a rm -rf, a prompt-injected instruction, an unlicensed asset — and it's already happened. A2A puts a gate in front of the action: every command your agent proposes is screened against a deterministic rule gate and a self-evaluation gate, allowed or blocked in milliseconds, and written to an immutable audit trail. Your agent runs it itself — one install, no human relaying approvals.

Works with: Claude Code · Cursor · Cline · Windsurf · Aider · Codex · any MCP client

a2a demo — screen an agent action in one command

Agent proposes a command, the gate screens it, the human sees it in the dashboard — watch the full demo.

Install

bash

npm install -g a2a-trustgate

The npm package is a2a-trustgate; the command is a2a.

Quick Start

bash

# Create a tenant (agent-first — human activates)
a2a signup my-company --local

# Screen a command — exit 0 = allowed, 1 = blocked, 2 = needs review
a2a eval "rm -rf ./build"
# ✓ ALLOWED

a2a eval "rm -rf /"
# ✗ BLOCKED: filesystem destruction pattern

# See plan, usage, limits
a2a status

# Full reference
a2a --help

How it works — the Asimov dual-gate

Every action passes two gates before it's allowed to run:

Gate 1 — deterministic rules. Pattern and policy screening in milliseconds: destructive filesystem ops, secret exfiltration, injection signatures, scope violations. Fast, no model call.
Gate 2 — self-evaluation. For anything Gate 1 can't clear outright, the agent's own reasoning is turned back on the action: should this run, given the context and the tenant's policy?

bash

a2a eval "command" --gate2 self    # self-evaluate (default)
a2a eval "command" --gate2 skip    # Gate 1 only (fast path)
a2a eval "command" --context ctx   # add decision context
a2a eval "command" --pipeline ID   # route through a named pipeline

Exit codes make it scriptable — wrap any risky step:

bash

if a2a eval "rm -rf ./build" --json 2>/dev/null; then
  rm -rf ./build
fi

Code	Meaning
0	Allowed — safe to execute
1	Blocked — do not execute
2	Needs review — Gate 2 self-evaluation required

Built for six kinds of team

A2A screens the same way for everyone, but the surface each team touches is different. Pick yours.

Network operations — a gate in front of every device

Your agents run commands against routers, switches, and sites. A2A registers each device, enforces a per-device policy, and gives you a killswitch that stops every agent at once.

bash

a2a device add --name core-rtr-1 --host 10.0.0.1 --vendor cisco
a2a device policy DEVICE-ID --mode strict --require-approval --max 5
a2a device lock DEVICE-ID           # freeze a single device
a2a killswitch                      # freeze every agent, everywhere
a2a device import --file hosts.csv  # bulk onboard (name,host,vendor,model,role,siteCode)

Agent screens a command	Human sees the device-lock
network-ops terminal cast	see it in the dashboard →

AI agents — agent-to-agent, screened and signed

Multi-agent systems where one agent's output is another's input. A2A gives them scoped workspaces and HMAC-signed channels, so a rogue or injected message can't cross a boundary you didn't grant.

bash

a2a workspace create "research-swarm"
a2a workspace WS-ID add-agent --name planner --role expert
a2a workspace WS-ID enforce --agent planner "command"   # screen an agent's action
a2a channel create ops-bus
a2a channel CH-ID send "interface frozen — you're clear to build"  # HMAC-signed

Agent-to-agent evaluate	Human sees the block + audit
ai-agents terminal cast	see it in the dashboard →

Regulated industries — an immutable, exportable audit trail

Every decision — allowed or blocked, with reasoning — lands in an append-only log you can export for an auditor. OCSF-shaped, EU AI Act aligned.

bash

a2a audit                          # recent decisions
a2a audit export --format csv      # hand to an auditor (csv/json)
a2a approvals                      # human-in-the-loop queue
a2a approve TASK-ID
a2a reject TASK-ID "out of policy" # reason recorded in the trail

Command screened	Human exports the audit
regulated terminal cast	see it in the dashboard →

Creative & IP owners — licence before access

Register your catalogue, mint scoped licences, and every agent that reaches for an asset is checked against a rights log. Access is granted by licence, not by scraping.

bash

a2a catalogue create "The Back Catalogue"
a2a catalogue licence create --catalogue CAT-ID --email studio@label.com --scope read
a2a catalogue access-log           # who reached for what, and whether it was licensed
a2a catalogue content-sources

Agent requests an asset	Human sees the rights-log
creative terminal cast	see it in the dashboard →

Enterprise AI — govern the tools your staff already use

ChatGPT, Claude, Copilot are already in your building. Register each tool, screen what it's asked to do, and get one audit trail across all of them.

bash

a2a ai-tools add "ChatGPT" --type chatbot
a2a ai-tools                       # every registered tool
a2a ai-tools update 0 --status paused

Tool action screened	Human sees approval + audit
enterprise-ai terminal cast	see it in the dashboard →

Universities — research governance without the friction

Approvals, scope enforcement, and an exportable trail that maps to research-ethics and UKRI responsible-AI requirements. One URL for a researcher to connect, governance for the board.

bash

a2a eval "command" --context "grant-XYZ research pipeline"
a2a approvals                      # ethics/governance queue
a2a audit export --format csv      # for the board or the funder

Research action screened	Human sees governance + audit
university terminal cast	see it in the dashboard →

Drop it into your framework

Generate a ready-made wrapper for the SDK you already use — the screen call is one line:

bash

a2a generate node        # a2a-safety.js
a2a generate python      # a2a_safety.py
a2a generate anthropic   # tool_use wrapper
a2a generate openai      # tool_call wrapper

MCP Server

Prefer tools over a CLI? a2a ships an MCP server. Point Claude Code (or any MCP client) at it and your agent gets 49 native tools: evaluate, pipelines, workspaces, channels, devices, sites, catalogues, audit, approvals, admin. The whole platform.

bash

claude mcp add a2a -- a2a mcp-serve

For clients that use a JSON config (Cline, Cursor, Windsurf), pass your API key via the A2A_API_KEY environment variable. The MCP server runs outside your project directory, so it will not pick up .a2a/config.json:

json

{
  "mcpServers": {
    "a2a": {
      "command": "a2a",
      "args": ["mcp-serve"],
      "env": { "A2A_API_KEY": "a2a_your_key_here" }
    }
  }
}

No key yet? Start it without one: the server boots in onboarding mode and can guide signup, then add the key and restart.

Remote MCP — zero install

No CLI at all? Claude Web, Claude Desktop, Raycast, or any hosted MCP client can connect straight to our remote server. Same 49 tools, same API key, nothing to install:

code

URL:  https://mcp.a2ainfrastructure.com/sse
Auth: Authorization: Bearer YOUR_API_KEY

Setup guide: MCP quickstart.

Features

Evaluate — screen any command through the Asimov dual-gate, allow / block / needs-review, in milliseconds
Pipelines — named screening routes with their own policy and task history
Workspaces — scoped multi-agent enforcement, one agent's action screened against the tenant policy
Channels — HMAC-signed agent-to-agent messaging, contract-scoped
Devices & sites — per-device policy, lock, bulk CSV import, and a global killswitch (network-ops)
Catalogues & licences — register IP, mint scoped licences, access-log every reach (creative / IP owners)
AI tools registry — govern ChatGPT / Claude / Copilot behind one audit trail (enterprise-ai)
Approvals — human-in-the-loop queue, approve/reject with reason recorded
Audit trail — immutable, OCSF-shaped, EU AI Act aligned, exportable as CSV or JSON
MCP server — 49 tools, local (a2a mcp-serve) or fully remote (mcp.a2ainfrastructure.com)
Framework wrappers — one-line generate for Node, Python, Anthropic, OpenAI

Pricing: free Starter tier (Gate 1, 500 tasks/mo). Pro adds the dual-gate firewall + OCSF audit; Enterprise adds custom rules + dedicated sandboxes. Details.

Authentication

API key resolution (first match wins):

--key flag
A2A_API_KEY environment variable
./.a2a/config.json (project-local)
~/.a2a/config.json (global)

bash

a2a login            # store globally (~/.a2a/)
a2a login --local    # store per-project (./.a2a/) — add .a2a/ to .gitignore
a2a config           # show which config is active

Agent Integration

Add to your CLAUDE.md, .cursorrules, .clinerules, .windsurfrules, or AGENTS.md:

code

## A2A TrustGate
This project screens agent actions through A2A before they execute.
Use the `a2a` CLI. Config is in .a2a/config.json (auto-loaded).
If not configured: a2a login --local --key YOUR_KEY

Before running any risky command, screen it:
  a2a eval "the command" --json   # exit 0 = run it, 1 = do not, 2 = needs review

Why this exists

An agent that can act is an agent that can act wrongly — and by the time you read the log, it's done. I wanted a gate in front of the action, not a report after it: deterministic where it can be, self-evaluating where it can't, and audited either way. It's early and I'm iterating fast — if something's rough or missing, tell us.

Documentation

Licence

Proprietary — Tyga.Cloud Ltd. See LICENSE.

tenantId	string	required	Short tenant slug, 3-64 chars, lowercase alphanumeric + hyphens (e.g. "my-agent")
agent	string	optional	Agent/label creating the tenant (optional, e.g. "claude-code")
description	string	optional	What this tenant is for (optional)

A2a Trustgate

🛠️ Key Features

🚀 Use Cases

⚡ Developer Benefits

⚠️ Limitations

Topics

a2a_get_started

a2a_signup

a2a-trustgate

Install

Quick Start

How it works — the Asimov dual-gate

Built for six kinds of team

Network operations — a gate in front of every device

AI agents — agent-to-agent, screened and signed

Regulated industries — an immutable, exportable audit trail

Creative & IP owners — licence before access

Enterprise AI — govern the tools your staff already use

Universities — research governance without the friction

Drop it into your framework

MCP Server

Remote MCP — zero install

Features

Authentication

Agent Integration

Why this exists

Documentation

Licence

Install

Configuration