Developer docs
Start with the action you want to control.
Choose a workflow, configure its approval path, and inspect the evidence it produces. Start in a test environment with one action and one clear acceptance criterion.
Open the first-workflow checklistChoose your setup guide.
Deploy Gate
Connect one repository, configure the protected path, and inspect its approval receipt.
Read the guideMCP Guard
Route a stdio server through tool-call policy, then test observe and enforce modes.
Read the guideFramework guides
Identify the execution path before choosing an adapter or custom integration.
Read the guideReceipt specification
Review the verification format and the evidence your integration must produce.
Read the guideMake the protected path explicit.
For GitHub, configure required checks, deployment rules, approvers, and bypass permissions. For MCP, route the client through the proxy and enable enforcement with the approval UI when needed. Direct credentials and alternate execution paths need separate controls.
Test the decision before rollout.
Trigger a request that requires approval. Test denial, approval of a fresh request, a changed action, and service failure. Confirm what the executor actually receives. Integration versions can differ in outage behavior, so test the configuration you intend to use.
Use the reference for your integration.
The setup guides link to the MCP Guard package and Deploy Gate Action source. They describe those specific execution paths. Native framework tools and custom API integrations need their own implementation and testing; a generic decorator example does not establish enforcement.
What should I keep as evidence?
Keep the request and decision identifiers, the exact action or commit, the policy, and the authorization time. For signed receipts, retain the signed artifact and issuer key and verify the signature. MCP Guard's local JSONL hashes alone do not provide independent signing. Authorization evidence also does not establish successful execution.