{
  "$schema_doc": "https://gtmstacker.com/registry/schema/entry.schema.json",
  "stability": "emerging",
  "generator": "agentic-media-registry",
  "generated_at": "2026-09-27T00:00:00Z",
  "id": "com.gtmstacker.registry/tool/provenance-gate",
  "type": "tool",
  "slug": "provenance-gate",
  "canonical_url": "https://gtmstacker.com/registry/tool/provenance-gate/",
  "title": "Provenance Gate",
  "description": "Provenance Gate is a deterministic authorization gateway that tracks where each tool-call value originated so an AI agent cannot act on untrusted data in side-effect operations. Open source: yes (Apache-2.0); self-hostable; pricing free. Early PoC; runs as a Claude Code plugin.",
  "category": "mcp-agents",
  "tags": [
    "mcp-agents",
    "agent-security",
    "prompt-injection",
    "authorization-gateway",
    "self-hostable",
    "python"
  ],
  "status": "active",
  "revision": 1,
  "content_hash": "4cd11903cbd93b8a0abdc4d9bc97403ac9893a43f884b089c5f77decc4c1ad6b",
  "date_published": "2026-09-27T00:00:00Z",
  "date_modified": "2026-09-27T00:00:00Z",
  "source": {
    "name": "Yehielamor · GitHub",
    "url": "https://github.com/Yehielamor/provenance-gate"
  },
  "license": "Apache-2.0",
  "one_liner": "Provenance Gate is a deterministic authorization gateway that tracks where each tool-call value came from to stop agents acting on untrusted data.",
  "open_source": "yes",
  "self_hostable": "yes",
  "pricing_model": "free",
  "who_its_for": "An engineer giving an AI agent real side-effect tools (send, delete, pay, post) who wants a deterministic guard on WHERE a control value came from — rather than relying on a prompt-injection classifier — and can run it as a Claude Code plugin in front of the agent's actions.",
  "aliases": [
    "provenance-gate",
    "provenance gate",
    "Yehielamor/provenance-gate"
  ],
  "alternatives": [
    "agent-governance-toolkit",
    "tripwire-agent-scanner"
  ],
  "secondary_categories": [
    "ai-infrastructure"
  ],
  "last_verified": "2026-09-27",
  "evidence": {
    "claim_type": "mixed",
    "source_id": "https://github.com/Yehielamor/provenance-gate",
    "note": "Apache-2.0 per repo; functional proof-of-concept (poc/gateway.py, poc/graph.py) with test harnesses, replay scripts and an end-to-end framework with live-model support; self-hostable as a Claude Code plugin. Author-reported AgentDojo v1.2.1 result: stops 99.3% of attacks while also blocking 28.9% of legitimate tasks. (WebFetch 2026-09-27, github.com/Yehielamor/provenance-gate)."
  },
  "caveats": "Verified from the repo (WebFetch 2026-09-27); no independent testing. The 99.3% attack-block / 28.9% legitimate-task-block figures are the AUTHOR'S OWN AgentDojo run (vendor-claim), not an independent benchmark — and the 28.9% false-positive rate is a real usability cost, not a footnote. Load-bearing: this is an early proof-of-concept (few stars), so the provenance-tracking approach is a demonstrated idea, not a hardened product.",
  "lead": "Provenance Gate is a deterministic authorization gateway that tracks where each tool-call value originated so an AI agent cannot act on untrusted data in side-effect operations. Open source: yes (Apache-2.0); self-hostable; pricing free. It is an early proof-of-concept that runs as a Claude Code plugin.",
  "chunks": [
    {
      "index": 0,
      "heading_path": [],
      "est_tokens": 76,
      "text": "Provenance Gate is a deterministic authorization gateway that tracks where each tool-call value originated so an AI agent cannot act on untrusted data in side-effect operations. Open source: yes (Apache-2.0); self-hostable; pricing free. It is an early proof-of-concept that runs as a Claude Code plugin."
    },
    {
      "index": 1,
      "heading_path": [
        null,
        "What it does"
      ],
      "est_tokens": 239,
      "text": "Provenance Gate is a deterministic authorization gateway that tracks where each tool-call value originated so an AI agent cannot act on untrusted data in side-effect operations. Open source: yes (Apache-2.0); self-hostable; pricing free. It is an early proof-of-concept that runs as a Claude Code plugin.\n\nProvenance Gate takes a different line from prompt-injection classifiers, which try to detect malicious text. Instead it tracks the provenance of the values an agent feeds into consequential tool calls — where did this recipient address, this amount, this command actually come from — and deterministically blocks the call when a control value traces back to untrusted input. The repository is a working proof-of-concept: a gateway and graph implementation, test harnesses, replay scripts, and an end-to-end framework that can run against live models, deployable as a Claude Code plugin. Open source: yes (Apache-2.0); self-hostable; pricing free."
    },
    {
      "index": 2,
      "heading_path": [
        null,
        "Provenance"
      ],
      "est_tokens": 249,
      "text": "blocks the call when a control value traces back to untrusted input. The repository is a working proof-of-concept: a gateway and graph implementation, test harnesses, replay scripts, and an end-to-end framework that can run against live models, deployable as a Claude Code plugin. Open source: yes (Apache-2.0); self-hostable; pricing free.\n\n- Apache-2.0 per repo; functional PoC (poc/gateway.py, poc/graph.py) with tests, replay scripts and a live-model end-to-end harness; self-hostable as a Claude Code plugin (WebFetch 2026-09-27).\n- Author-reported AgentDojo v1.2.1 result: 99.3% of attacks stopped, 28.9% of legitimate tasks also blocked. This is the author's own measurement (vendor-claim), stated here with its cost, not as independent validation.\n- Surfaced via studio discovery in the 2026-09-27 pass; part of a cluster of agent-guardrail drops this pass (see chimera).\n- Curated from the GTM Stacker signal registry (2026-09-27 pass); license/facts independently verified 2026-09-27."
    },
    {
      "index": 3,
      "heading_path": [
        null,
        "Why it matters for a GTM stack"
      ],
      "est_tokens": 282,
      "text": "This is the author's own measurement (vendor-claim), stated here with its cost, not as independent validation. - Surfaced via studio discovery in the 2026-09-27 pass; part of a cluster of agent-guardrail drops this pass (see chimera). - Curated from the GTM Stacker signal registry (2026-09-27 pass); license/facts independently verified 2026-09-27.\n\nOnce agents are allowed to send email, update the CRM, move money, or post, the failure that hurts is not a wrong answer — it is a correct-looking action taken on data an attacker planted. Provenance Gate targets that class directly: it gates the side-effect on the origin of the value, deterministically, instead of hoping a classifier spots the injection. Open source: yes (Apache-2.0); self-hostable; pricing free. The honest read: the approach is well-aimed and the author is refreshingly candid that stopping 99.3% of attacks currently also blocks 28.9% of legitimate work — a tradeoff you would need to tune before it fronts a real outbound or billing tool. At proof-of-concept maturity, treat it as an idea worth piloting on a low-stakes action, not a drop-in guardrail."
    }
  ],
  "alternates": {
    "markdown": "https://gtmstacker.com/registry/tool/provenance-gate/index.md",
    "html": "https://gtmstacker.com/registry/tool/provenance-gate/",
    "json": "https://gtmstacker.com/registry/tool/provenance-gate/index.json",
    "server_json": "https://gtmstacker.com/registry/tool/provenance-gate/server.json"
  },
  "jsonld": {
    "@context": "https://schema.org",
    "@graph": [
      {
        "@type": "WebSite",
        "@id": "https://gtmstacker.com/#website",
        "url": "https://gtmstacker.com/",
        "name": "GTM Stacker Agent Registry",
        "description": "A daily-updated, agent-native registry of open-source tool discoveries, tool updates, and curated news for the go-to-market / RevOps engineering niche. Machine-readable first: agents can discover, parse, page, and delta-sync it without scraping HTML.",
        "inLanguage": "en",
        "publisher": {
          "@id": "https://gtmstacker.com/#organization"
        }
      },
      {
        "@type": "Organization",
        "@id": "https://gtmstacker.com/#organization",
        "name": "GTM Stacker",
        "url": "https://gtmstacker.com",
        "description": "The growth-systems practice of Theo Popov: AI-native enrichment, outbound, content engines and internal tooling for startups and venture programs. Its agent-native media property, the GTM Stacker Agent Registry, maintains a daily-updated catalog of open-source go-to-market and RevOps tools that both people and AI engines can discover, compare, and cite.",
        "foundingDate": "2024-08",
        "knowsAbout": [
          "go-to-market engineering",
          "RevOps",
          "sales automation",
          "marketing operations",
          "open-source software",
          "AI agents"
        ],
        "founder": {
          "@type": "Person",
          "@id": "https://gtmstacker.com/#founder",
          "name": "Theo Popov",
          "jobTitle": "Growth Operations & GTM Systems",
          "url": "https://gtmstacker.com/about/",
          "sameAs": [
            "https://www.linkedin.com/in/theo-popov",
            "https://x.com/Theo_Popov",
            "https://github.com/theopopov"
          ],
          "worksFor": {
            "@id": "https://gtmstacker.com/#organization"
          }
        },
        "sameAs": [
          "https://www.linkedin.com/company/gtmstacker",
          "https://www.youtube.com/@gtmstacker",
          "https://www.instagram.com/gtmstacker/",
          "https://www.tiktok.com/@gtmstacker"
        ],
        "mainEntityOfPage": "https://gtmstacker.com/registry/about/"
      },
      {
        "@type": "SoftwareApplication",
        "@id": "https://gtmstacker.com/registry/tool/provenance-gate/#software",
        "name": "Provenance Gate",
        "identifier": "Yehielamor/provenance-gate",
        "description": "Provenance Gate is a deterministic authorization gateway that tracks where each tool-call value originated so an AI agent cannot act on untrusted data in side-effect operations. Open source: yes (Apache-2.0); self-hostable; pricing free. Early PoC; runs as a Claude Code plugin.",
        "applicationCategory": "DeveloperApplication",
        "url": "https://gtmstacker.com/registry/tool/provenance-gate/",
        "datePublished": "2026-09-27T00:00:00Z",
        "dateModified": "2026-09-27T00:00:00Z",
        "isPartOf": {
          "@id": "https://gtmstacker.com/#website"
        },
        "license": "https://spdx.org/licenses/Apache-2.0.html",
        "codeRepository": "https://github.com/Yehielamor/provenance-gate",
        "keywords": "mcp-agents, ai-infrastructure, agent-security, prompt-injection, authorization-gateway, self-hostable, python",
        "author": {
          "@type": "Organization",
          "name": "Yehielamor",
          "url": "https://github.com/Yehielamor",
          "sameAs": [
            "https://github.com/Yehielamor/provenance-gate"
          ]
        },
        "offers": {
          "@type": "Offer",
          "price": 0,
          "priceCurrency": "USD"
        },
        "isSimilarTo": [
          {
            "@type": "SoftwareApplication",
            "name": "Agent Governance Toolkit",
            "url": "https://gtmstacker.com/registry/tool/agent-governance-toolkit/",
            "applicationCategory": "DeveloperApplication",
            "offers": {
              "@type": "Offer",
              "price": 0,
              "priceCurrency": "USD"
            }
          },
          {
            "@type": "SoftwareApplication",
            "name": "Tripwire",
            "url": "https://gtmstacker.com/registry/tool/tripwire-agent-scanner/",
            "applicationCategory": "DeveloperApplication",
            "offers": {
              "@type": "Offer",
              "price": 0,
              "priceCurrency": "USD"
            }
          }
        ]
      },
      {
        "@type": "BreadcrumbList",
        "@id": "https://gtmstacker.com/registry/tool/provenance-gate/#breadcrumb",
        "itemListElement": [
          {
            "@type": "ListItem",
            "position": 1,
            "name": "GTM Stacker Registry",
            "item": "https://gtmstacker.com/registry/"
          },
          {
            "@type": "ListItem",
            "position": 2,
            "name": "MCP Agents",
            "item": "https://gtmstacker.com/registry/category/mcp-agents/"
          },
          {
            "@type": "ListItem",
            "position": 3,
            "name": "Provenance Gate",
            "item": "https://gtmstacker.com/registry/tool/provenance-gate/"
          }
        ]
      }
    ]
  },
  "tool": {
    "name": "Yehielamor/provenance-gate",
    "repository": {
      "url": "https://github.com/Yehielamor/provenance-gate",
      "source": "github"
    }
  }
}