Gauntlet

A local payment policy test harness for MCP paid tool demos.

Gauntlet helps developers test whether an AI agent's simulated payment request satisfies a configured deterministic policy before a paid MCP tool flow continues. V0.1 is an offline/local devtool. It does not approve payments, move funds, verify merchants, or enforce production runtime policy.

V0.1 Scope

Gauntlet is actively seeking external validation; review the validation goals, contribute a scenario, or report integration feedback.

• Local CLI: gauntlet init, gauntlet run, gauntlet run --ci
• Deterministic policy rules for amount, merchant matching, quote expiry, quote drift, idempotency, required metadata, and review thresholds
• history.json fixture support for budget and duplicate checks
• Redacted receipt.json and developer-facing report.md
• One mock MCP paid tool example
• 8 must-have scenarios, with 12 backlog scenarios documented

Project Docs

• Product PRD: Gauntlet PRD.md
• Feature spec: spec.md
• Implementation plan: plan.md
• Data model: data-model.md
• CLI contract: contracts/cli.md
• Quickstart: quickstart.md
• Tasks: tasks.md
• External validation plan: external-validation-plan.md
• Integration trial: integration-trial.md
• Outreach templates: outreach-templates.md
• Validation tracker: validation-tracker.md
• FDE demo playbook: fde-demo-playbook.md

Browser Demo

打开中文静态 FDE 演示：

open demo/index.html

演示页面把 Gauntlet 呈现为一台本地 Agent 支付失败测试工作台，按「测试输入 → 执行规则 → 验证结果 → 测试凭证」推进。可以切换内置 fixture、修改金额和商户、观看八项确定性规则逐项执行，并查看原因码、请求快照、脱敏凭证和开发报告。页面不连接钱包，也不会移动真实资金。

Development

npm install
npm run typecheck
npm test
npm run build

Pull requests run the same verification steps in GitHub Actions.

Contributing

See CONTRIBUTING.md for development and contribution guidelines.

Current CLI

Run built-in scenarios:

npm run dev -- run

Create local fixtures:

npm run dev -- init

Run a custom local fixture set:

npm run dev -- run \
  --policy gauntlet/policy.yaml \
  --quote gauntlet/quote.json \
  --request gauntlet/requests/valid-payment.json \
  --history gauntlet/history.json \
  --output-dir gauntlet/receipts

Receipts are redacted by default. Use --unredacted only for local debugging.

License

Gauntlet is available under the MIT License.