Verifiable MCP accountability gateway
Govern what AI agents may do. Prove what they did.
Magenta Canon is a chain of custody for AI actions: a private control layer that gates agent tool calls before they execute, captures evidence for allowed and blocked actions alike, and makes that evidence independently checkable.
Magenta Canon is active. Evaluation access is private — via a controlled portal and a design-partner process.
The problem
AI agents are moving from chat to action
Agents can call tools, touch data, change systems, and trigger workflows. When an agent takes a real action, two questions get hard fast: was it authorized, and can you prove what was allowed, blocked, and why?
Most teams cannot answer that today. The system that acts is also the system that writes the log — so the record can't be trusted on its own.
What it does
A control layer in front of agent actions
- Default-deny action gate — MCP
tools/callrequests are checked against delegated authority before they run; unauthorized actions are stopped. Other MCP methods pass through ungated, and we say so rather than implying every agent action is governed. - Policy-bound execution — only delegated, in-scope actions proceed.
- Identity-aware decisions — each decision is bound to the acting principal.
- Evidence for allowed and blocked actions — both outcomes are recorded, not just successes.
- Tamper-evident receipts for governed decisions — records are independently checkable; alteration is detectable.
- Review packets — forwardable evidence for security and compliance teams.
Who it's for
Built for the people accountable for agent risk
For CISOs & governance leads
Provable accountability for agent actions — what was allowed, what was blocked, and why — with tamper-evident evidence and audit-ready review packets. Reduce the risk of an agent taking an unauthorized, high-consequence action.
For platform & security engineers
A control layer in front of agent/tool execution with identity-aware, policy-bound decisions. Evaluate privately in the portal, review captured decisions and evidence, and compare blocked-call receipts against a downstream tool log to prove blocked calls never reached the tool. Magenta verifies the authorization path; downstream responses and results are evidence only when separately captured by an integration.
Understand it visually
Authorize what's allowed, block what isn't, record proof of both
Private evaluation
Evaluate Magenta Canon with us
Access is currently private. Authorized users review policy decisions, captured evidence, and evaluation materials inside a controlled portal — no public package dependency required.
- Invite-only portal for evaluation and evidence review.
- Design-partner onboarding tailored to your agent/tool workflows.
- Forwardable evaluation packets for internal security and compliance review.
Portal sign-in is for authorized users only.
Where we are today
Proven today. Building now. Next.
Three states, never blurred. Nothing moves a column ahead of its evidence.
Proven today
Gate-first accountability gateway on the MCP tools/call method class, with operator-delegated capability grants and hard ceilings evaluated default-deny. Allowed calls proceed; blocked calls never reach the downstream tool, and the tool's own log corroborates their absence. Allow and block alike become signed, hash-chained receipts on a transparency log, checkable by a standalone verifier that shares no code with the server — and a tampered bundle fails. Under a bounded assignment the stdio gateway enforces per-run authority — expiry, revocation, run binding, explicit tool denial — plus a restrict-only operator-policy overlay. An append-only external STH mirror detects history rewrite, equivocation, and rollback once a tree head is mirrored, though that protection depends on the mirror being held by someone other than the operator. Organization scoping exists in the Human Plane at the application layer. Durable Postgres and file evidence ledgers are self-host, selector-gated, and exercised by CI. Committed Human-Plane migrations and a provider-neutral PostgreSQL row-level-security isolation substrate are merged and exercised by CI, alongside adversarial cross-tenant isolation and schema-parity proofs. A provider-neutral identity boundary is also merged and CI-exercised: an opaque, permanent Magenta user identifier, a provider-agnostic identity adapter, and verified-email invitation authority. A per-request corridor is merged and CI-exercised too: the nine converted read routes and thirteen converted tenant-scoped mutations run their storage calls inside one transaction carrying the tenant principal, with the organization-family audit written in that same transaction; PR-1…PR-5 themselves did not convert the two first-fact routes — their conversion is Wave 2B PR-6, whose state is declared under Building now. None of that is activation — carrying the principal is not enforcing a policy, no shipped code applies the migration or switches the application to a non-owner role, and this project has selected and activated no production identity provider.
Building now
Work under active development that this page does not represent as proven — not production-active, not available to run, and not to be relied upon. This column takes no position on whether any lane's branch has merged; each lane's declared lane lifecycle in public/claims-register.json records that. Track B, Wave 2B PR-6 — the first-fact database primitives, the corridor conversion of the two first-fact routes (organization creation and invitation acceptance), and one temporal model of verified-email authority — proceeds at the lane lifecycle declared there (lane_lifecycle.wave_2b_pr6): whether it is under review, complete in a reviewed revision, or landed is recorded by that declaration, not by this static page. The Wave-1 isolation substrate, the Wave-2A identity boundary and the Wave-2B per-request corridor (PR-1…PR-5) have all merged and sit under Proven today.
Next
Runtime row-level-security activation on the live request path, behind a runtime mode and startup admission (Track B, Wave 2B PR-7); retirement of ordinary direct member addition once invitation acceptance is the seated path (Track B, Wave 2B PR-8); production identity-provider selection and activation; hosted multi-tenant operation and a managed customer control plane; subscription, entitlements, and billing as a commercial-access boundary; managed KMS/HSM key custody; and assignment enforcement on the HTTP transport, a wired human-approval path, and a hosted, independently operated third-party mirror service. None of this is built.
Not claimed: no SOC 2, HIPAA, PCI, or ISO certification; not broad AI safety or model alignment; not hosted production SaaS; not durable production evidence storage in the default deployment; no public npm or npx distribution. Any future billing would gate commercial access and would never grant an agent authority to execute an action.
Package status: public npm package access is paused pending IP/licensing review. Do not rely on prior public npm packages for production use.