diff --git a/LICENSING.md b/LICENSING.md index 94183e6..554a235 100644 --- a/LICENSING.md +++ b/LICENSING.md @@ -36,6 +36,13 @@ commercial risk scoring, billing, private customer integrations, and other AgentVeil commercial control-plane services are not included in the MIT SDK license unless explicitly stated in a separate written license. +Public CLI code may include clients for pairing, hosted summary reporting and +conditional provider delivery. That client code does not include the hosted +service implementation or grant a workspace entitlement. A software license, +Console access and an additional provider's availability are separate matters; +see the [package scope](packages/agentveil-mcp-proxy/README.md#connect-to-agentveil-console-optional) +and [plans and pricing](https://agentveil.dev/#pricing). + ## Packaging Boundary The `agentveil` PyPI package is MIT licensed and must not ship the diff --git a/README.md b/README.md index 89bf3e1..0589bd3 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@ **Stop risky AI agent actions. Not the work.** -Independent AI agent security. For supported actions on configured routes, risky actions get a safe alternative or your approval before they run, so the task still gets done. Works with Cursor, Claude Code, Codex, Gemini CLI, Hermes CLI, and MCP tools. +Independent AI agent security. On configured routes, AgentVeil checks supported actions and applies policy: allow, request approval, provide redirect guidance to a controlled path, or block. Safe alternatives require an available controlled path. Works with Cursor, Claude Code, Codex, Gemini CLI, Hermes CLI, and MCP tools. [Quick Start](#quick-start) · [Console](#start-from-the-console) · [The Loop](#the-agentveil-loop) · [Connectors](#connectors-available-today) · [Evidence](#bounded-evidence) · [Scope](#scope) · [Design Basis](#design-basis) · [Docs](docs/) @@ -23,7 +23,7 @@ Independent AI agent security. For supported actions on configured routes, risky pip install agentveil-mcp-proxy ``` -**Packages**: [agentveil-mcp-proxy](https://pypi.org/project/agentveil-mcp-proxy/) · [agentveil](https://pypi.org/project/agentveil/) | **Website**: [agentveil.dev](https://agentveil.dev) | **Console**: [agentveil.dev/console](https://agentveil.dev/console/auth) | **Package source**: [`packages/agentveil-mcp-proxy/`](packages/agentveil-mcp-proxy/) +**Packages**: [agentveil-mcp-proxy](https://pypi.org/project/agentveil-mcp-proxy/) · [agentveil](https://pypi.org/project/agentveil/) | **Website**: [agentveil.dev](https://agentveil.dev) | **Console**: [agentveil.dev/console](https://agentveil.dev/console/auth) | **Plans**: [agentveil.dev/#pricing](https://agentveil.dev/#pricing) | **Package source**: [`packages/agentveil-mcp-proxy/`](packages/agentveil-mcp-proxy/) > **Agent action boundary:** AI runtimes execute agents. AgentVeil mediates > configured action paths around them. When a native or risky action hits the @@ -55,7 +55,8 @@ AgentVeil is one product loop, not a pile of separate components: Approval fixes actions that need human review. Redirect tells the agent to retry through the controlled MCP route when one is available. Hard-block means approval will not help for that action. Local proof is available now through -the CLI—not a future dashboard page. +the CLI. Console summaries complement those local records; they do not replace +local evidence export or offline verification. ## What AgentVeil Adds @@ -85,7 +86,17 @@ When you run a connector's `setup` command, AgentVeil opens the Console in your browser so you can approve this machine. The Console then shows what your connected projects report: project connection status, decision summaries and approval summaries. Raw prompts, source code and file contents stay on your -machine. Local protection works without the Console. +machine in this connector-summary flow. This is not a blanket statement about +content supplied to hosted SDK/API workflows; see [Data Handling](docs/DATA_HANDLING.md). +Local connector and proxy control do not require Console pairing; backend-backed +SDK and Runtime Gate workflows have their own service requirements. + +Successful connector setup and explicit status checks can also attempt browser +pairing and, for an eligible Console workspace, download and install an additional +local provider package. Availability depends on the workspace capability and +provider checks; installing the public proxy alone does not grant that capability. +See [the package's Console scope](packages/agentveil-mcp-proxy/README.md#connect-to-agentveil-console-optional) +for the distinction between pairing, reporting, and provider installation. If the browser did not open (for example on a headless machine) or you closed it, connect later: @@ -194,7 +205,8 @@ In this profile: ### Core MCP Proxy path -For lower-level MCP routing without an IDE connector: +For lower-level MCP routing without an IDE connector (an alternative to the +connector setup above, not an additional required step after connector setup): ```bash pip install agentveil-mcp-proxy @@ -204,6 +216,8 @@ agentveil-mcp-proxy run ``` This starts the core route: MCP tool calls explicitly pointed at `agentveil-mcp-proxy`. +For manual identity registration, backend readiness and signer-pinned offline +verification, follow the [Core MCP Proxy quickstart](docs/MCP_PROXY_QUICKSTART.md). ### Verify your setup works @@ -248,6 +262,11 @@ runtime-agnostic for MCP clients that are explicitly configured to call it. | Hermes CLI profile | AgentVeil launcher + project-local Hermes MCP route | Routed MCP approval/evidence, sandbox boundaries, redirect guidance inside the AgentVeil route | Available | | Core MCP Proxy | MCP transport boundary | Routed MCP policy, approval, redirect / policy-stop outcomes, bounded evidence | Available | +Here, **Available** identifies a shipped integration mechanism, not control of +unlisted client modes or a guarantee that a project's connection is active. Required +reloads, trust prompts, route configuration and observed hook evidence still +apply. Check the connector instructions above and local setup status. + The Python SDK also includes framework examples and optional helper modules for CrewAI, LangGraph, AutoGen, PydanticAI, OpenAI, Gemini, and AWS Bedrock. Those examples are not the same as a project connector: they show how agent workflows @@ -270,6 +289,13 @@ Current connector checks have been run with: | Hermes CLI | live controlled MCP route path | | Python package metadata | Python 3.10-3.13 | +Compatibility is scoped to the versions and client paths listed here. It does +not establish support for other client modes or later releases. Python metadata +states the declared interpreter range; runtime checks remain environment-specific. +Where a row omits an exact version +or check date, it is not a version-pinned compatibility guarantee. For project +readiness, use the connector-specific instructions and local status. + Other versions may work, but are not listed here until verified. ## What AgentVeil Controls @@ -382,6 +408,14 @@ agentveil-mcp-proxy setup remove gemini-cli --yes ## Scope +| Component | Availability and boundary | +|---|---| +| Public local packages | Project connectors, explicitly routed MCP calls and local evidence; Console pairing is optional. Backend-backed flows still need the configured backend. | +| Hosted Console | Device pairing and bounded connection/decision/approval summaries; visibility depends on what the connected project reports. | +| Additional local provider capabilities | Separate package, workspace eligibility and activation checks; they are not granted by installing the public proxy. See the [package scope](packages/agentveil-mcp-proxy/README.md#connect-to-agentveil-console-optional). | +| SDK primitives | APIs and examples for application-owned integrations, distinct from ready-to-use project connectors. | +| Preview / design-partner flows | The limited-release patterns listed below; they are not general public connector coverage. | + Available today: - MCP Proxy for routed MCP tool calls; @@ -414,7 +448,9 @@ Not included in the public connector: - global Cursor / Claude / Codex / Gemini / Hermes lock; - automatic control of unrelated chats; - private enterprise policy packs; -- hosted auth, licensing, telemetry, or enterprise custody logic. +- hosted service implementations for auth, licensing, telemetry, or enterprise + custody. Public clients may still contain pairing, summary upload and provider + installation code; this exclusion concerns the hosted implementation. ## Example Risk Patterns @@ -493,6 +529,12 @@ The root SDK is MIT-licensed. `agentveil-mcp-proxy` is a separately packaged source-available component under BUSL-1.1. See [Licensing](LICENSING.md) before using it in commercial or competing hosted services. +**Hosted Console and plans.** Local connector and proxy control do not require +Console pairing. Hosted services and additional capabilities have their own +availability and terms; see [plans and pricing](https://agentveil.dev/#pricing). +A software license describes rights to the package, not a hosted subscription +or entitlement. + ## Python SDK and advanced protocol primitives Advanced Python SDK package: `agentveil`. diff --git a/README_PYPI.md b/README_PYPI.md index 2c994ef..ab0017a 100644 --- a/README_PYPI.md +++ b/README_PYPI.md @@ -14,7 +14,15 @@ pip install agentveil-mcp-proxy ## Quick Start -Route MCP tool calls through AgentVeil: +For a project connector, start at the [Console](https://agentveil.dev/console/auth) +and follow the command for your agent, or use the +[connector instructions](https://github.com/agentveil-protocol/agentveil-sdk#start-from-the-console). +Console pairing is optional for local connector/proxy control. Connector +setup/status can also attempt browser pairing and, for eligible workspaces, +install an additional provider; see the +[package scope](https://github.com/agentveil-protocol/agentveil-sdk/blob/main/packages/agentveil-mcp-proxy/README.md#connect-to-agentveil-console-optional). + +For manual routing of one downstream MCP server, use the Core MCP Proxy path: ```bash pip install agentveil-mcp-proxy @@ -26,7 +34,12 @@ agentveil-mcp-proxy run MCP Proxy gates only tool calls routed through the proxy. It does not control host shell, IDE-native edits, direct git/pip commands, or other actions that bypass the proxy. Actions not routed through AgentVeil are not classified or -logged. +logged by that proxy. Project hooks add only their documented native-tool coverage. +Backend-backed actions still require the configured service; see the +[manual quickstart](https://github.com/agentveil-protocol/agentveil-sdk/blob/main/docs/MCP_PROXY_QUICKSTART.md). + +Console summaries and direct hosted SDK/API calls have different data boundaries; +see [Data Handling](https://github.com/agentveil-protocol/agentveil-sdk/blob/main/docs/DATA_HANDLING.md). ## Python SDK and advanced protocol primitives @@ -81,3 +94,5 @@ print("scope:", verification["scope"][0]["value"]) The `agentveil` package is MIT licensed. The separate `agentveil-mcp-proxy` package is source-available under Business Source License 1.1. See the [licensing boundary](https://github.com/agentveil-protocol/agentveil-sdk/blob/main/LICENSING.md). +Hosted Console and additional capabilities have separate availability and terms; +see [plans and pricing](https://agentveil.dev/#pricing). diff --git a/ROADMAP.md b/ROADMAP.md index ee6ae07..371aedf 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -3,9 +3,13 @@ ## Source Of Truth - Current public Python SDK package: `agentveil 0.7.23`. -- Current public MCP Proxy package: `agentveil-mcp-proxy 0.7.44`. +- Current public MCP Proxy package: `agentveil-mcp-proxy 0.7.49`. - Package metadata and PyPI are the version source of truth. This roadmap tracks product direction only; release history belongs in `CHANGELOG.md`. +- Versions above were checked against PyPI on 2026-10-20; consult package + metadata for later releases. Planned items have no promised dates. +- A shipped command does not establish that a workspace has the optional + provider, entitlement or configuration. See [product scope](README.md#scope). ## Available Today @@ -14,8 +18,8 @@ - [x] Project connector setup for Cursor, Claude Code, Codex, and Gemini CLI - [x] Hermes CLI controlled MCP launch profile - [x] Core MCP Proxy route for configured downstream MCP tool calls -- [x] W3C DID identity (`did:key`, Ed25519) -- [x] AVP-Sig request signing for authenticated protocol calls +- [x] Advanced SDK identity and request-signing primitives; see the + [SDK section](README.md#python-sdk-and-advanced-protocol-primitives) - [x] Posture/setup readiness checks with `integration_preflight()` - [x] Runtime Gate controlled-action flow with `controlled_action(...)` - [x] Local DelegationReceipt v1 issuance with `issue_delegation_receipt(...)` @@ -23,28 +27,20 @@ - [x] MCP Proxy evidence export and offline verification: `agentveil-mcp-proxy export-evidence` and `agentveil-mcp-proxy verify` +- [x] Console sign-in and machine pairing with `agentveil-mcp-proxy login` +- [x] Bounded project connection and decision/approval summary reporting +- [x] Explicit filesystem CA policy preview/apply with `upgrade-ca-policy`; + execution still requires the configured controlled path and available provider + ## Preview / Active Rollout - [ ] Broader controlled-action rollout for customer workflows - [ ] Operator-facing documentation for production adoption -- [ ] Customer-facing DelegationReceipt issuance UX and examples - [ ] Deployment documentation for approved customer environments -- [ ] Execution boundary and gateway adapter contract ## Planned -- [ ] Public agent reputation dashboard -- [ ] Expanded hosted MCP catalog metadata and recrawl -- [ ] Formal protocol specification v1.0 - [ ] Expanded Runtime Gate examples for common agent stacks - [ ] Dedicated root SDK CLI demo command: `agentveil demo controlled-action` - [ ] Dedicated root SDK proof commands: `agentveil proof export` and `agentveil proof verify --offline` -- [ ] Posture Check report for risky tools, write access, credentials location, - and bypass paths - -## Research / Future - -- [ ] Runtime proof and offline verification publication -- [ ] ERC-8004 bridge exploration -- [ ] Federation between AVP nodes diff --git a/docs/DATA_HANDLING.md b/docs/DATA_HANDLING.md index a725083..45aa6d9 100644 --- a/docs/DATA_HANDLING.md +++ b/docs/DATA_HANDLING.md @@ -21,6 +21,25 @@ Lurkr, the separate pre-runtime scanner, is also local-only: it does not upload source code, scan reports, findings, or usage telemetry to AgentVeil and does not make network calls during scan. +Console-connected setup/status is not a purely local inspection: it can attempt +browser pairing and contact hosted services, and eligible workspaces can receive +an additional local provider package. Those network/install paths are distinct +from the local evidence store. See the +[package Console scope](../packages/agentveil-mcp-proxy/README.md#connect-to-agentveil-console-optional). + +The reporting channels have different content boundaries: + +| Channel | What crosses the boundary | When | +|---|---|---| +| Local evidence and offline verification | Local artifacts are read or written; offline verification does not upload the bundle. | Local inspection/export/verification commands. | +| Routed Runtime Gate decisions | Privacy-filtered action metadata, resource/payload hashes and policy context. | A routed decision requires the configured backend. | +| Console reporting | Bounded project connection and decision/approval summaries, including local provider status; not raw prompts, source code or file contents in this summary flow. | Accepted pairing credential plus the relevant connection or action-reporting path. | +| Console pairing and provider delivery | Pairing/credential requests, eligibility requests and provider package download. | Setup/status or explicit login as described in the package scope; installation is eligibility-dependent. | +| Direct hosted SDK/API and support workflows | User-supplied content or execution parameters may be processed as workflow input. | The caller invokes that hosted content workflow; see Hosted Content Surfaces below. | + +Do not extend the privacy properties of one row to every AgentVeil API or to an +unrelated downstream server's own data handling. + ## Hosted AgentVeil Ledger Runtime Gate, receipts, approvals, delegation, reputation, governance, and audit diff --git a/docs/MCP_PROXY_QUICKSTART.md b/docs/MCP_PROXY_QUICKSTART.md index d4180bf..852e06b 100644 --- a/docs/MCP_PROXY_QUICKSTART.md +++ b/docs/MCP_PROXY_QUICKSTART.md @@ -1,12 +1,22 @@ # MCP Proxy Quickstart -This is the cold customer path for wrapping one downstream MCP server with the -AgentVeil MCP Proxy and producing an evidence bundle that is verifiable offline -in strict/proof-grade mode with an externally pinned signer DID. Every -step describes behavior that is implemented and locally verifiable. Anything -this quickstart does not cover yet is listed under +This guide is the manual Core MCP Proxy path for wrapping one downstream MCP +server and producing an evidence bundle for offline verification with an +externally pinned signer DID. It is intended for operators configuring a +specific downstream, identity and backend. For ordinary project connector setup, +start with the [Console and connector instructions](../README.md#start-from-the-console); +do not repeat this manual sequence on top of an existing connector setup unless +that is the intended configuration. + +Follow the steps in order for a new manual route. Completing an individual step +does not establish the end-to-end result. The evidence limits are listed under [What this quickstart does NOT prove](#what-this-quickstart-does-not-prove). +Console pairing is distinct from `register`: pairing connects the machine to +Console reporting, while `register` registers the proxy identity with its configured +backend. Console-integrated connector setup/status can also attempt an eligible +provider installation; see the [package scope](../packages/agentveil-mcp-proxy/README.md#connect-to-agentveil-console-optional). + For day-2 operations, headless mode, multi-IDE deployment, evidence vacuum, and identity migration, see [`MCP_PROXY_OPERATIONS.md`](MCP_PROXY_OPERATIONS.md). diff --git a/docs/README.md b/docs/README.md new file mode 100644 index 0000000..401601a --- /dev/null +++ b/docs/README.md @@ -0,0 +1,59 @@ +# AgentVeil Documentation + +Start with the existing product README; use this index to find the appropriate +route without repeating setup. + +## Start here + +- [Console and project connector setup](../README.md#start-from-the-console) +- [MCP Proxy package and CLI scope](../packages/agentveil-mcp-proxy/README.md) +- [Manual Core MCP Proxy quickstart](MCP_PROXY_QUICKSTART.md) +- [Connector mechanisms and coverage](../README.md#connectors-available-today) +- [Product scope and availability](../README.md#scope) + +## Operations and integrations + +- [MCP Proxy operations](MCP_PROXY_OPERATIONS.md) +- [Approval routing](APPROVAL_ROUTING.md) +- [Customer integration](CUSTOMER_INTEGRATION.md) +- [Integration examples](INTEGRATIONS.md) + +Framework examples and SDK helpers are not interchangeable with project hook +connectors. Choose the documented integration boundary for your application. + +## Security and data handling + +- [Security model and bypass boundaries](SECURITY_MODEL.md) +- [Data handling by workflow](DATA_HANDLING.md) +- [MCP Proxy design principles](MCP_PROXY_DESIGN_PRINCIPLES.md) +- [Security reporting](../SECURITY.md) +- [SDK, proxy and hosted licensing boundaries](../LICENSING.md) + +## Evidence and advanced SDK APIs + +- [Local evidence inspection and export](../packages/agentveil-mcp-proxy/README.md#local-evidence) +- [Proof packets](PROOF_PACKET.md) +- [Delegation receipts](DELEGATION_RECEIPT.md) +- [Advanced Python SDK](PYTHON_SDK_ADVANCED.md) +- [Advanced agent network primitives](ADVANCED_AGENT_NETWORK.md) +- [API reference](API.md) +- [Protocol reference](PROTOCOL.md) + +API/reference documentation describes the relevant primitives; it is not a +promise that an equivalent hosted UI or connector workflow is generally available. + +## Releases and historical notes + +- [Release history](../CHANGELOG.md) +- [Current roadmap](../ROADMAP.md) +- [Release provenance](RELEASE_PROVENANCE.md) + +The dated notes below describe specific historical changes, not current setup +instructions. They remain at their existing paths: + +- [Runtime Gate wire contract, 2026-07-28](runtime_gate_public_wire_contract_corrective_2026-07-28.md) +- [Runtime Gate privacy/action wire, 2026-07-29](runtime_gate_privacy_action_wire_corrective_2026-07-29.md) +- [Risk compatibility contract, 2026-07-29](production_risk_compatibility_public_contract_2026-07-29.md) +- [Downstream EOF/approval retirement, 2026-07-30](downstream_eof_approval_retirement_2026-07-30.md) + +For onboarding, follow Start here above rather than replaying historical change notes. diff --git a/docs/SECURITY_MODEL.md b/docs/SECURITY_MODEL.md index 7960251..3fb8e79 100644 --- a/docs/SECURITY_MODEL.md +++ b/docs/SECURITY_MODEL.md @@ -38,6 +38,17 @@ MCP Proxy does not control host shell commands, IDE-native edits, direct git or pip commands, or calls made to tools outside the proxy. Actions not routed through the proxy are not classified or logged. +Project hook connectors are an additional boundary around supported native agent +tools. Their coverage depends on the configured project, client hook support, +required trust/reload steps and an observed working hook. This does not extend +the Core MCP Proxy's coverage to arbitrary host commands. See +[connector coverage](../README.md#connectors-available-today). + +Console connection status and uploaded summaries are not substitutes for route +and hook evidence. Pairing, provider installation, workspace entitlement and +policy activation are separate checks; see the +[package scope](../packages/agentveil-mcp-proxy/README.md#connect-to-agentveil-console-optional). + ## Boundary Patterns Credential custody, egress boundaries, and API gates are stronger boundary diff --git a/packages/agentveil-mcp-proxy/README.md b/packages/agentveil-mcp-proxy/README.md index 7a3d7b0..25a1c0e 100644 --- a/packages/agentveil-mcp-proxy/README.md +++ b/packages/agentveil-mcp-proxy/README.md @@ -93,6 +93,13 @@ SDK is installed as a dependency. ## Quick Start +Choose one connector below, or use the Core MCP Proxy path for manual downstream +routing. Console pairing and eligible provider installation can be attempted by +successful setup and explicit status commands; read +[Connect To AgentVeil Console](#connect-to-agentveil-console-optional) for the +network and installation scope. Local connector/proxy control does not require +Console pairing; backend-backed actions retain their backend requirements. + ### Cursor project connector ```bash @@ -173,6 +180,11 @@ agentveil-mcp-proxy events show --last ### Core MCP Proxy +This is the manual route for an MCP client or downstream server; it is not an +extra setup step for project connector users. For registration, backend readiness +and signer-pinned offline verification, see the +[full Core MCP Proxy quickstart](../../docs/MCP_PROXY_QUICKSTART.md). + Create a local proxy identity, config, and control grant: ```bash @@ -274,9 +286,11 @@ agentveil-mcp-proxy export-evidence ./bundle.json agentveil-mcp-proxy verify ./bundle.json --trusted-signer-did did:key:... ``` -Raw MCP arguments, prompts, outputs, tokens, source code, secrets, and private -logs remain local by default. Runtime decisions should use bounded metadata and -hashes. See [Data Handling](../../docs/DATA_HANDLING.md). +For the routed MCP privacy path, local evidence omits raw MCP arguments and +content by default; decision requests use privacy-filtered metadata and hashes. +Console summary upload is a separate bounded reporting channel. Content supplied +to direct hosted SDK/API workflows has a different boundary; do not describe +those workflows as metadata-only. See [Data Handling](../../docs/DATA_HANDLING.md). ## Built-In Policy Packs @@ -299,6 +313,7 @@ for your specific downstream server. | `login` | Connect this machine to the optional AgentVeil Console via device pairing. | | `logout` | Revoke the Console device token and remove the local credential. | | `init` | Create encrypted identity, config, and control grant. | +| `upgrade-ca-policy` | Preview filesystem CA policy additions; applying requires `--apply` and the expected config hash. It does not activate an unavailable provider. | | `init --quickstart-filesystem ` | Configure the built-in filesystem downstream for local first run. | | `doctor` | Validate local files and control grant. | | `doctor --full` | Launch downstream and verify MCP `initialize` / `tools/list`. | @@ -337,28 +352,48 @@ device token locally at `~/.avp/console/device-token.json` with owner-only `0600` permissions. `logout` revokes that token with the Console and removes the local file. -Connecting to Console is optional. It does not activate paid, Team, policy, or -project-sync features, and it does not change how routed MCP calls or project -connectors are controlled locally. The stored token grants only the -`bounded_summary_upload` scope. - -After `login`, successful project connector setup and explicit `setup status` -for Codex, Claude Code, Cursor, or Gemini CLI may send one bounded project -connection summary to the Console. The upload includes a bounded local report -field, `private_guardrails_status`, with one of `active`, `inactive`, or -`unavailable`. That value reflects only the installed local paid provider state; -it does not grant entitlement. Console combines this report with server-owned -workspace capability before showing `Active`. Without a stored credential this -step is a silent no-op: no network request, no provider discovery, and no extra -CLI output. Boundary: the upload is best-effort and isolated from local setup; -Console rejection or outage does not change setup results, exit codes, connector -files, or Approval Center behavior. +Console pairing is optional for local connector/proxy control. The device token +grants the `bounded_summary_upload` scope; pairing is not a general Team, +billing or administration credential, and the token scope alone does not grant +a paid capability. + +**Pairing and reporting.** Successful connector setup and explicit `setup status` +for Codex, Claude Code, Cursor or Gemini CLI can attempt browser-session pairing +when no credential is stored. Status sync can also attempt to repair a rejected +credential through pairing. These paths may therefore open the browser or +contact Console before a stored credential is available; they are not an +unconditional offline no-op. + +With an accepted credential, the project-status client can send a bounded +project connection summary. Separate decision and approval summary clients +provide bounded action reporting; these are distinct reporting paths. +The `private_guardrails_status` field reports local provider state as `active`, +`inactive` or `unavailable`; it does not grant entitlement. Console also uses +server-owned workspace capability when presenting availability. + +**Conditional provider installation.** Successful connector setup and explicit +status paths also contain a best-effort provider-install flow. It checks the +Console credential, installed provider state and backend workspace eligibility. +If eligible, it downloads a provider wheel and invokes its installation and +activation flow. Installing the public proxy or holding a summary-upload token +does not by itself establish eligibility. This is a separate local package +installation, not just a summary upload. Saved filesystem CA rules still require +the explicit policy-upgrade path described above. + +**Failure boundary.** Console sync and conditional installation are best-effort. +Their failure is not evidence that a capability is active, and an uploaded +summary is not proof of installation. Check local provider and connector status. +Backend-backed Runtime Gate actions retain their own availability requirements. + +For the data-channel distinctions, see [Data Handling](../../docs/DATA_HANDLING.md). ## Relationship To AgentVeil `agentveil-mcp-proxy` is the public package for AgentVeil project connectors and the routed MCP action-control path. The root `agentveil` SDK contains identity, delegation, Runtime Gate client helpers, receipt helpers, and -framework adapters. +framework adapters. Local package licensing, hosted Console access and workspace +capabilities are separate boundaries; see [Licensing](../../LICENSING.md) and +[plans and pricing](https://agentveil.dev/#pricing). [ops-passphrase]: ../../docs/MCP_PROXY_OPERATIONS.md#security-trade-offs-by-passphrase-source