# Provenance gate

A deterministic authorization gateway that sits between an AI agent and its tools, tracing where each parameter of a side-effect call came from, and blocking the call or asking a human when the source does not check out.

Provenance gate is a Python authorization gateway, released under the Apache-2.0 license, that sits between an AI agent and its tools. For every side-effect call it traces where each control value came from, such as the user, untrusted content like email, files or web pages, or the model itself, and it never reads tool output to judge whether it looks malicious.

It allows a call to proceed, or stops it for a human with the reason attached, for example that a recipient came from a document rather than from the user and has never been paid before. It also ships as a Claude Code plugin that asks before an outbound call, such as an MCP write tool, WebFetch, curl, gh or git push, when the recipient or URL came from tool output instead of from the user.

The project reports results from replaying the gateway against the AgentDojo benchmark's user tasks and hijacked attack pairs, and analyzes several real incidents structurally to see whether control-value provenance alone would have stopped them.

Website: https://github.com/Yehielamor/provenance-gate