dgenio/AgentFence policy check
Gate recorded MCP / tool calls against an AgentFence policy in CI. Fails the job when any call matches a denied (or asked) decision.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| policy | Path to the policy YAML file. | yes | — |
| calls | Path to the JSONL tool-call input (or a recorded audit log of calls). | yes | — |
| fail-on | Comma-separated decisions that fail the job: deny, ask, or deny,ask. With the non-interactive default, ask decisions are auto-denied and thus counted under deny. | no | deny |
| audit-log | Optional path to write the audit JSONL log to. | no | "" |
| tamper-evident | Write a hash-chained, tamper-evident audit log (requires audit-log). | no | false |
| approval-timeout | Maximum time to wait on an ask decision (e.g. 30s). 0 waits forever. | no | 30s |
| go-version | Go toolchain version used to build the agentfence binary. | no | 1.22 |
Outputs
| name | description |
|---|---|
| total | Total number of calls evaluated. |
| allow | Number of allow decisions. |
| deny | Number of deny decisions. |
| ask | Number of ask decisions. |
| decisions-file | Path to the JSON file containing the full decision summary. |