A security gateway for AI agents: a transparent MCP proxy that enforces policy, DLP, and audit on every tool call and result.
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"mcp-tollbooth","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
<p align="center"> <img src="https://raw.githubusercontent.com/Realgagenichols/tollbooth/main/assets/header.svg" alt="tollbooth — a firewall + DLP + audit layer for AI agent tool traffic" width="860"> </p> <p align="center"> <a href="#"><img alt="Python 3.12+" src="https://img.shields.io/badge/python-3.12%2B-3776AB?logo=python&logoColor=white"></a> <a href="#"><img alt="Built on MCP" src="https://img.shields.io/badge/built%20on-MCP-58A6FF"></a> <a href="#development"><img alt="674 tests" src="https://img.shields.io/badge/tests-674%20passing-3FB950"></a> <a href="#design-decisions-that-matter"><img alt="Fail-closed by default" src="https://img.shields.io/badge/default-fail--closed-F85149"></a> <a href="https://github.com/Realgagenichols/tollbooth/blob/main/LICENSE"><img alt="MIT license" src="https://img.shields.io/badge/license-MIT-8957E5"></a> </p> <p align="center"> <b>tollbooth</b> sits between any MCP client and the servers it talks to, and enforces security policy, data-loss prevention, and a tamper-evident audit trail on <i>every</i> tool call and result that crosses the boundary. </p> --- Your AI agent's tool traffic — filesystem writes, shell exec, web fetches, API calls — flows **unmediated** today. There is no control point to deny a dangerous call, stop a secret from leaking out through a tool argument, redact a credential before it lands in the model's context, or produce a compliance-grade record of what the agent actually did. tollbooth is that control point. It's a transparent [MCP](https://modelcontextprotocol.io) proxy: your client points at one server (tollbooth), tollbooth wraps the real upstream servers, and the gateway config file *is* the security boundary. ## Caught in the act A single config turns an unmediated agent into a governed one. The recording below is **real `tollbooth` output** — every frame is the live policy + DLP engine answering actual Claude Code hook events (reproduce it yourself with `vhs demo/demo.t…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.