TimeProofs AgentReady
Pre-deployment CI gate for agent-facing tools

AgentReady CI Gate for agent-facing APIs and MCP tools

Fail the build before unsafe agent-facing APIs or MCP tools are deployed.

Explore AgentReady CI Gate View GitHub Action
CLI GitHub Action agentready.json v0.1 AR001-AR010 Local-first

A valid API contract can still fail as an agent-facing tool.

OpenAPI operations and MCP tools need explicit boundaries before deployment: when to use them, when not to use them, which values are allowed, what requires confirmation, and how recovery should work.

Wrong tool

Agents may select the wrong operation when descriptions and usage boundaries are too vague.

Unsafe action

Refunds, deletes, emails, exports, and publishing flows need limits and confirmation rules.

Bad release signal

Without a CI policy, risky tool surfaces can merge before anyone reviews the agent behavior.

One gate, four durable outputs.

AgentReady is more than a page-level scan. It creates artifacts a team can discuss in pull requests and keep as release evidence.

CLIRun local checks and CI policies from a terminal or automation runner.
GitHub ActionFail pull requests when a contract misses the configured readiness policy.
agentready.jsonExport score, status, risk counts, findings, rule codes, and recommendations.
AR rule codesUse stable names such as AR002 and AR007 for repeatable review discussions.

What can go wrong?

Agent-facing contracts can look valid while still giving autonomous tools the wrong path, missing guardrails, or too much reach.

Refund without confirmation

Money movement should show intent, amount, customer, and explicit approval before execution.

Delete user without explicit approval

Destructive account actions need clear confirmation, blocked states, and recovery behavior.

Send invoice to wrong recipient

Outbound messaging needs recipient validation, preview, and a bounded sending flow.

Webhook exposed as agent-callable tool

Internal callbacks should not become general tools without purpose, scope, and safety notes.

Search endpoint leaking customer data

Broad read tools need scoped parameters, output limits, and sensitive-data boundaries.

Start in CI, keep local-first scanner paths available.

The central product path is the CI Gate. Browser scans remain useful for quick local review, sample reports, and preparing a contract before adding automation.

1

Scan

Check an OpenAPI JSON/YAML file or MCP tools JSON locally before agents use it.

2

Gate

Apply a policy such as --min-score 75 --fail-on critical in CI.

3

Export

Keep the Markdown report and agentready.json as reviewable release artifacts.

What AgentReady checks

  • Unclear operation and tool names.
  • Missing when-to-use and when-not-to-use guidance.
  • Dangerous actions without human confirmation.
  • Irreversible operations and missing success verification.
  • Unbounded numeric parameters.
  • Missing enums for closed fields.
  • Weak error recovery for agents.
  • Sensitive data and broad permission risks.

Output

OpenAPI or MCP tools JSON
-> AgentReady analysis
-> AgentReady Score
-> risk findings
-> recommended fixes
-> human report
-> agentready.json
-> static scenario simulation
-> agentready-simulation.json

Built for teams exposing tools to agents

Useful for API builders, MCP tool builders, platform teams, and AI agencies that need a release check before connecting agents to real actions.

Clear boundaries

AgentReady is not a penetration test and does not guarantee absolute safety. It identifies structural risks before deployment and leaves runtime enforcement to runtime systems.