{
  "schema": "agentomy.adapter-profiles/v1",
  "about": "What each shipped Agentomy adapter governs, stated exactly. Governance coverage is not integration coverage: an adapter brings an agent into the layer and governs a specific set of operations in a specific way; this file says which, and binds every statement to the source that implements it (source_refs). Rendered from the canonical record on every change; the commit gate fails if a binding no longer resolves.",
  "dimensions": {
    "pre_execution_enforcement": "Whether the adapter can stop an action before it runs, mechanically, without relying on the agent's cooperation.",
    "adjudicated_operations": "Which operations the adapter decides on. Everything else passes through and is stated as passing through.",
    "arguments_inspected": "What of an action's arguments the adapter reads and what of them leaves the host.",
    "response_inspection": "Whether the adapter reads or alters what comes back from the governed system.",
    "discovery_governance": "Whether the adapter narrows what an agent can discover (tool lists, resources, prompts), as distinct from what it can do.",
    "fail_closed": "What happens when a decision cannot be obtained: the action is refused, with a reason an operator can tell from a policy refusal.",
    "evidence_trail": "Where the record of each decision lands and whether it is tamper-evident.",
    "control_plane_contract": "Exactly what the adapter sends to the Agentomy control plane, over which operation, and what it never sends.",
    "degradation": "What the adapter does when the control plane is unreachable, and whether it says so.",
    "host_changes": "What must change on the governed system for the adapter to work."
  },
  "adapters": {
    "agentomy-mcp-gateway": {
      "name": "Agentomy MCP Gateway",
      "kind": "interposing proxy",
      "package": {
        "registry": "npm",
        "name": "agentomy-mcp-gateway",
        "run": "npx agentomy-mcp-gateway -- <mcp-server> <flags>"
      },
      "source": "https://github.com/getagentomy/mcp-gateway",
      "license": "Apache-2.0",
      "transport": "stdio",
      "position": "Between the agent and any stdio MCP server. The server is not patched, forked or reconfigured and does not learn it is governed.",
      "profile": {
        "pre_execution_enforcement": {
          "value": true,
          "statement": "Every tools/call is adjudicated before it is forwarded. A refused call is answered to the agent as a JSON-RPC error (code -32000, data.governed = true) and never reaches the server, so the side effect does not happen. A refused notification (no id) is dropped, not answered, because answering a notification would corrupt the stream.",
          "source_refs": [
            {
              "path": "cli/mcp-gateway/lib/proxy.js",
              "symbol": "handleClientMessage"
            },
            {
              "path": "cli/mcp-gateway/lib/proxy.js",
              "symbol": "respondDenied"
            },
            {
              "path": "cli/mcp-gateway/lib/proxy.js",
              "literal": "POLICY_DENIED_CODE"
            }
          ]
        },
        "adjudicated_operations": {
          "value": [
            "tools/call"
          ],
          "statement": "tools/call is decided. Every other JSON-RPC method passes through unchanged: the gateway governs what an agent does, not the protocol around it.",
          "source_refs": [
            {
              "path": "cli/mcp-gateway/lib/proxy.js",
              "literal": "msg.method !== 'tools/call'"
            }
          ]
        },
        "arguments_inspected": {
          "value": "key names only",
          "statement": "The tool name and the names of its argument keys travel to the control plane as metadata (tool, argKeys). Argument values never leave the host.",
          "source_refs": [
            {
              "path": "cli/mcp-gateway/lib/decide.js",
              "literal": "argKeys: args ? Object.keys(args) : []"
            }
          ]
        },
        "response_inspection": {
          "value": false,
          "statement": "Responses from the server pass through untouched. The gateway decides actions; it does not read or rewrite results.",
          "source_refs": [
            {
              "path": "cli/mcp-gateway/lib/proxy.js",
              "literal": "traffic passes through untouched"
            }
          ]
        },
        "discovery_governance": {
          "value": false,
          "statement": "tools/list, resources and prompts pass through. What an agent may discover is not narrowed; what it may do is decided. Narrowing discovery while leaving action ungoverned would be theatre in the wrong place.",
          "source_refs": [
            {
              "path": "cli/mcp-gateway/lib/proxy.js",
              "literal": "Narrowing what an agent may DISCOVER"
            }
          ]
        },
        "fail_closed": {
          "value": true,
          "statement": "A call is allowed only when the control plane says so explicitly. Unreachable, timed out, non-2xx, a body that is not JSON or lacks the boolean authorized field: each denies with its own reason, so an operator can tell an outage from a policy refusal.",
          "deny_reasons": [
            "governance_unreachable",
            "governance_timeout",
            "governance_malformed_response",
            "governance_http_error",
            "agent_halted",
            "policy_denied"
          ],
          "source_refs": [
            {
              "path": "cli/mcp-gateway/lib/decide.js",
              "symbol": "DENY_REASON"
            },
            {
              "path": "cli/mcp-gateway/lib/decide.js",
              "literal": "typeof body.authorized !== 'boolean'"
            }
          ]
        },
        "evidence_trail": {
          "value": "control-plane audit record per decision",
          "statement": "Each decision is a call to the control plane, which records it in the tamper-evident audit trail with the tool's identity. Denials are also written to the gateway's stderr on the host. The gateway keeps no local log of its own.",
          "source_refs": [
            {
              "path": "cli/mcp-gateway/bin/mcp-gateway.mjs",
              "literal": "mcp-gateway: denied ("
            }
          ]
        },
        "control_plane_contract": {
          "value": {
            "operation": "POST /api/claw/authorize",
            "body_fields": [
              "agentId",
              "action",
              "scope",
              "metadata.tool",
              "metadata.argKeys",
              "metadata.via"
            ],
            "action": "execute",
            "scope": "mcp",
            "authentication": "Bearer token from AGENTOMY_API_KEY",
            "timeout_ms_default": 5000,
            "never_sent": [
              "argument values",
              "server responses",
              "prompt or conversation content"
            ]
          },
          "statement": "One authorization call per tool call, carrying the agent identity, the governance action class (execute) and scope (mcp), and the tool name and argument key names as metadata. Nothing else leaves the host.",
          "source_refs": [
            {
              "path": "cli/mcp-gateway/lib/decide.js",
              "literal": "/api/claw/authorize"
            },
            {
              "path": "cli/mcp-gateway/lib/decide.js",
              "literal": "action: 'execute'"
            },
            {
              "path": "cli/mcp-gateway/lib/decide.js",
              "literal": "scope: 'mcp'"
            },
            {
              "path": "cli/mcp-gateway/lib/decide.js",
              "literal": "via: 'mcp-gateway'"
            }
          ]
        },
        "degradation": {
          "value": "refuse",
          "statement": "When no decision can be obtained the call is refused, with the reason named. Governance that opens the moment it loses its connection is not governance.",
          "source_refs": [
            {
              "path": "cli/mcp-gateway/lib/decide.js",
              "literal": "Anything else, including \"we could not ask\", is false"
            }
          ]
        },
        "host_changes": {
          "value": "one configuration line per agent",
          "statement": "In the agent's MCP configuration the server is launched through the gateway instead of directly. Nothing on the server changes.",
          "source_refs": [
            {
              "path": "cli/mcp-gateway/bin/mcp-gateway.mjs",
              "literal": "AGENTOMY_ENDPOINT"
            }
          ]
        },
        "configuration": {
          "value": [
            "AGENTOMY_ENDPOINT (required)",
            "AGENTOMY_API_KEY",
            "AGENTOMY_AGENT_ID (default: mcp-gateway)",
            "AGENTOMY_TIMEOUT_MS (default: 5000)"
          ],
          "statement": "Four environment variables. A missing endpoint is refused at start, once, rather than as a stream of denials that would read as policy refusals.",
          "source_refs": [
            {
              "path": "cli/mcp-gateway/lib/decide.js",
              "literal": "endpoint is required (set AGENTOMY_ENDPOINT)"
            }
          ]
        }
      }
    },
    "agentomy-agent": {
      "name": "Agentomy Agent",
      "kind": "governance peer (instruction layer plus in-process session record)",
      "package": {
        "registry": "pypi",
        "name": "agentomy-agent",
        "run": "pip install agentomy-agent && agentomy-agent init"
      },
      "source": "https://github.com/getagentomy",
      "license": "MIT",
      "transport": "in-session (system instructions) and, in connected mode, the Agentomy MCP server",
      "position": "Deployed as its own agent beside the agents it governs, with its own identity. Standalone mode needs no infrastructure; connected mode reaches the Agentomy infrastructure through MCP tools.",
      "profile": {
        "pre_execution_enforcement": {
          "value": "instruction-layer in standalone mode; mechanical through the infrastructure in connected mode",
          "statement": "In standalone mode the peer governs by instruction: the session is directed to refuse, flag and classify, and the package records every flag in an in-process audit chain. It does not intercept another agent's tool calls. Mechanical pre-execution enforcement is the infrastructure's, reached in connected mode through the agentomy_authorize tool.",
          "source_refs": [
            {
              "path": "sdk/python/agentomy-agent/agentomy_agent/governance.py",
              "symbol": "GovernanceSession"
            },
            {
              "path": "sdk/python/agentomy-agent/agentomy_agent/agent.md",
              "literal": "**agentomy_authorize**"
            }
          ]
        },
        "adjudicated_operations": {
          "value": [],
          "statement": "None mechanically in standalone mode. In connected mode the infrastructure adjudicates the actions the session submits through agentomy_authorize.",
          "source_refs": [
            {
              "path": "sdk/python/agentomy-agent/agentomy_agent/agent.md",
              "literal": "**agentomy_authorize**"
            }
          ]
        },
        "arguments_inspected": {
          "value": "none intercepted",
          "statement": "The package intercepts no arguments. The session reads what it is shown in the conversation.",
          "source_refs": [
            {
              "path": "sdk/python/agentomy-agent/agentomy_agent/governance.py",
              "symbol": "record_flag"
            }
          ]
        },
        "response_inspection": {
          "value": "instruction-layer output classification",
          "statement": "The session classifies its own outputs and refuses by policy (output classification and refusal policy in the agent file). No mechanical inspection of other agents' responses.",
          "source_refs": [
            {
              "path": "sdk/python/agentomy-agent/agentomy_agent/agent.md",
              "literal": "OUTPUT CLASSIFICATION AND REFUSAL POLICY"
            }
          ]
        },
        "discovery_governance": {
          "value": false,
          "statement": "Not in scope for a governance peer.",
          "source_refs": [
            {
              "path": "sdk/python/agentomy-agent/agentomy_agent/governance.py",
              "symbol": "GovernanceSession"
            }
          ]
        },
        "fail_closed": {
          "value": "declared degradation",
          "statement": "When the infrastructure cannot be reached in connected mode the session states that it is continuing in standalone mode and which dimensions that leaves unassessed. The mode is never silent: the score names it.",
          "source_refs": [
            {
              "path": "sdk/python/agentomy-agent/agentomy_agent/agent.md",
              "literal": "Fall through to standalone mode. State standalone mode."
            },
            {
              "path": "sdk/python/agentomy-agent/agentomy_agent/governance.py",
              "literal": "\"mode\": \"connected\" if self.connected else \"standalone\""
            }
          ]
        },
        "evidence_trail": {
          "value": "hash-chained in-process audit trail (standalone); the platform's tamper-evident audit trail (connected)",
          "statement": "Every flag and every confirmed clean action is appended to a SHA-256 hash chain inside the session; the chain and its head hash are exportable and verifiable with verify_audit_chain. In connected mode flags are also persisted through agentomy_log to the platform's audit trail.",
          "source_refs": [
            {
              "path": "sdk/python/agentomy-agent/agentomy_agent/governance.py",
              "symbol": "verify_audit_chain"
            },
            {
              "path": "sdk/python/agentomy-agent/agentomy_agent/governance.py",
              "symbol": "audit_chain"
            },
            {
              "path": "sdk/python/agentomy-agent/agentomy_agent/agent.md",
              "literal": "**agentomy_log**"
            }
          ]
        },
        "control_plane_contract": {
          "value": {
            "standalone": "no network calls; an optional health probe (GET /api/health) when connectivity is checked",
            "connected": "MCP tools of the Agentomy server: agentomy_authorize, agentomy_log, agentomy_status, agentomy_drift_score, agentomy_exposure_profile, agentomy_shadow_summary",
            "never_sent": [
              "conversation content beyond the flag records the session chooses to log"
            ]
          },
          "statement": "Standalone mode sends nothing. Connected mode speaks to the infrastructure only through its MCP tools; what each tool carries is defined by the platform's MCP server.",
          "source_refs": [
            {
              "path": "sdk/python/agentomy-agent/agentomy_agent/cli.py",
              "symbol": "_check_infra"
            },
            {
              "path": "sdk/python/agentomy-agent/agentomy_agent/agent.md",
              "literal": "**agentomy_status**"
            }
          ]
        },
        "degradation": {
          "value": "continue in standalone mode and say so",
          "statement": "Connected-mode tool failures are handled one by one: fall through to standalone at init, retry the audit anchor at the next high flag, note a failed persistence in the summary, omit an unverifiable hash rather than invent one.",
          "source_refs": [
            {
              "path": "sdk/python/agentomy-agent/agentomy_agent/agent.md",
              "literal": "Omit the verification hash"
            }
          ]
        },
        "host_changes": {
          "value": "none",
          "statement": "Nothing changes on the governed agents. The peer is added to the team as a separate agent with its own identity.",
          "source_refs": [
            {
              "path": "sdk/python/agentomy-agent/agentomy_agent/agent.md",
              "literal": "deployed as a separate agent in the team with its own identity"
            }
          ]
        },
        "dimensions_assessed": {
          "value": {
            "standalone": [
              "Authorization",
              "Behavioral Integrity",
              "Auditability"
            ],
            "connected": [
              "Authorization",
              "Behavioral Integrity",
              "Auditability",
              "Override Capability",
              "OWASP Coverage",
              "Message Governance"
            ]
          },
          "statement": "Standalone mode assesses 3 of the 6 GovernanceBench dimensions; connected mode all 6.",
          "source_refs": [
            {
              "path": "sdk/python/agentomy-agent/agentomy_agent/governance.py",
              "literal": "Standalone mode: 3/6 GovernanceBench dimensions assessed (Authorization, Behavioral Integrity, Auditability)."
            }
          ]
        }
      }
    }
  },
  "links": {
    "human": "https://agentomy.com/mcp-gateway",
    "install": "https://agentomy.com/install",
    "service": "https://agentomy.com/service.json",
    "api_catalog": "https://agentomy.com/.well-known/api-catalog"
  }
}