# Provenance Gate

> Updated 2026-09-27 · type: tool · category: mcp-agents · status: active · rev 1

Provenance Gate is a deterministic authorization gateway that tracks where each tool-call value came from to stop agents acting on untrusted data.

- Open source: yes (Apache-2.0)
- Self-hostable: yes
- Pricing model: free
- Best for: An engineer giving an AI agent real side-effect tools (send, delete, pay, post) who wants a deterministic guard on WHERE a control value came from — rather than relying on a prompt-injection classifier — and can run it as a Claude Code plugin in front of the agent's actions.
- Last verified: 2026-09-27

- **Canonical:** https://gtmstacker.com/registry/tool/provenance-gate/
- **Source:** [Yehielamor · GitHub](https://github.com/Yehielamor/provenance-gate)
- **Tags:** mcp-agents, agent-security, prompt-injection, authorization-gateway, self-hostable, python
- **Repository:** https://github.com/Yehielamor/provenance-gate

## Is Provenance Gate open source?

Yes, Provenance Gate is open source under the Apache-2.0 license.

## How much does Provenance Gate cost?

Provenance Gate is free to use.

## Can I self-host Provenance Gate?

Yes, Provenance Gate can be self-hosted (the source is available under the Apache-2.0 license).

## Alternatives & related

- [Agent Governance Toolkit](https://gtmstacker.com/registry/tool/agent-governance-toolkit/)
- [Tripwire](https://gtmstacker.com/registry/tool/tripwire-agent-scanner/)


---

Provenance Gate is a deterministic authorization gateway that tracks where each tool-call value originated so an AI agent cannot act on untrusted data in side-effect operations. Open source: yes (Apache-2.0); self-hostable; pricing free. It is an early proof-of-concept that runs as a Claude Code plugin.

## What it does

Provenance Gate takes a different line from prompt-injection classifiers, which try to detect malicious text. Instead it tracks the provenance of the values an agent feeds into consequential tool calls — where did this recipient address, this amount, this command actually come from — and deterministically blocks the call when a control value traces back to untrusted input. The repository is a working proof-of-concept: a gateway and graph implementation, test harnesses, replay scripts, and an end-to-end framework that can run against live models, deployable as a Claude Code plugin. Open source: yes (Apache-2.0); self-hostable; pricing free.

## Provenance

- Apache-2.0 per repo; functional PoC (poc/gateway.py, poc/graph.py) with tests, replay scripts and a live-model end-to-end harness; self-hostable as a Claude Code plugin (WebFetch 2026-09-27).
- Author-reported AgentDojo v1.2.1 result: 99.3% of attacks stopped, 28.9% of legitimate tasks also blocked. This is the author's own measurement (vendor-claim), stated here with its cost, not as independent validation.
- Surfaced via studio discovery in the 2026-09-27 pass; part of a cluster of agent-guardrail drops this pass (see chimera).
- Curated from the GTM Stacker signal registry (2026-09-27 pass); license/facts independently verified 2026-09-27.

## Why it matters for a GTM stack

Once agents are allowed to send email, update the CRM, move money, or post, the failure that hurts is not a wrong answer — it is a correct-looking action taken on data an attacker planted. Provenance Gate targets that class directly: it gates the side-effect on the origin of the value, deterministically, instead of hoping a classifier spots the injection. Open source: yes (Apache-2.0); self-hostable; pricing free. The honest read: the approach is well-aimed and the author is refreshingly candid that stopping 99.3% of attacks currently also blocks 28.9% of legitimate work — a tradeoff you would need to tune before it fronts a real outbound or billing tool. At proof-of-concept maturity, treat it as an idea worth piloting on a low-stakes action, not a drop-in guardrail.