Gauntlet

A local payment policy test harness for MCP paid tool demos.

Gauntlet helps developers test whether an AI agent's simulated payment request satisfies a configured deterministic policy before a paid MCP tool flow continues. V0.1 is an offline/local devtool. It does not approve payments, move funds, verify merchants, or enforce production runtime policy.

V0.1 Scope

Gauntlet is actively seeking external validation; review the validation goals, contribute a scenario, or report integration feedback.

• Local CLI: gauntlet init, gauntlet run, gauntlet run --ci
• Deterministic policy rules for amount, merchant matching, quote expiry, quote drift, idempotency, required metadata, and review thresholds
• history.json fixture support for budget and duplicate checks
• Redacted receipt.json and developer-facing report.md
• One mock MCP paid tool example
• 8 must-have scenarios, with 12 backlog scenarios documented

Project Docs

• Product PRD: Gauntlet PRD.md
• Feature spec: spec.md
• Implementation plan: plan.md
• Data model: data-model.md
• CLI contract: contracts/cli.md
• Quickstart: quickstart.md
• Tasks: tasks.md
• External validation plan: external-validation-plan.md
• Integration trial: integration-trial.md
• Outreach templates: outreach-templates.md
• Validation tracker: validation-tracker.md

Development

npm install
npm run typecheck
npm test
npm run build

Pull requests run the same verification steps in GitHub Actions.

Contributing

See CONTRIBUTING.md for development and contribution guidelines.

Current CLI

Run built-in scenarios:

npm run dev -- run

Create local fixtures:

npm run dev -- init

Run a custom local fixture set:

npm run dev -- run \
  --policy gauntlet/policy.yaml \
  --quote gauntlet/quote.json \
  --request gauntlet/requests/valid-payment.json \
  --history gauntlet/history.json \
  --output-dir gauntlet/receipts

Receipts are redacted by default. Use --unredacted only for local debugging.

License

Gauntlet is available under the MIT License.