# FidusGate

> Reference MCP policy gateway and receipt-first console: inspect tool-call decisions, understand policy outcomes, and verify Ed25519-signed receipts.

FidusGate is an Apache-2.0 reference implementation, not a production-hardened security product. The public demo is browser-only and synthetic; the connected console uses a configured gateway with role-scoped development sessions. Signature integrity, hash-chain linkage, issuer trust, and tool execution are separate claims. The static scenario engine is not Cedar. This curated navigation file is a reading aid; it does not grant authority or guarantee crawler discovery.

## Start here

- [Repository overview](https://github.com/SafetyMP/FidusGate/blob/main/README.md): purpose, audiences, demo, capabilities, and limits
- [Interactive demo](https://safetymp.github.io/FidusGate/): synthetic decisions and browser receipt verification; no tools execute
- [Documentation index](https://github.com/SafetyMP/FidusGate/blob/main/docs/README.md): current guides and historical records
- [Getting started](https://github.com/SafetyMP/FidusGate/blob/main/docs/getting-started.md): toolchain, local setup, and verification
- [Agent guide](https://github.com/SafetyMP/FidusGate/blob/main/AGENTS.md): commands, source map, data preservation, and fail-closed boundaries

## Product and implementation

- [Product direction](https://github.com/SafetyMP/FidusGate/blob/main/docs/DESIGN-PIVOT.md): receipt-first scope and design goals
- [Architecture](https://github.com/SafetyMP/FidusGate/blob/main/docs/ARCHITECTURE.md): applications, persistence, Cedar, and receipt flow
- [Connected console](https://github.com/SafetyMP/FidusGate/blob/main/docs/CONNECTED-CONSOLE-REDESIGN.md): workspaces, sessions, role controls, and verification limits
- [Public demo and hosting](https://github.com/SafetyMP/FidusGate/blob/main/docs/github-pages-demo.md): static build and main-branch deployment
- [Development receipt seeds](https://github.com/SafetyMP/FidusGate/blob/main/docs/development-receipt-seeds.md): signed fixtures and explicit legacy repair
- [Threat model](https://github.com/SafetyMP/FidusGate/blob/main/docs/adr/0000-threat-model.md): security objectives and exclusions

## Contribute and review

- [Contributing](https://github.com/SafetyMP/FidusGate/blob/main/CONTRIBUTING.md): setup, safe tests, and pull requests
- [Security policy](https://github.com/SafetyMP/FidusGate/blob/main/SECURITY.md): private vulnerability reports and support scope
- [Support](https://github.com/SafetyMP/FidusGate/blob/main/SUPPORT.md): public troubleshooting routes
- [Copilot instructions](https://github.com/SafetyMP/FidusGate/blob/main/.github/copilot-instructions.md): coding conventions and source links
- [Code review skill](https://github.com/SafetyMP/FidusGate/blob/main/.github/skills/code-review/SKILL.md): repository review guidance
- [Cedar MCP receipts skill](https://github.com/SafetyMP/FidusGate/blob/main/.github/skills/cedar-mcp-receipts/SKILL.md): tool gates and verification, adapted from scopeblind/scopeblind-gateway

## Optional

- [MCP transport migration](https://github.com/SafetyMP/FidusGate/blob/main/docs/mcp-2026-07-28-migration.md): repository transport behavior and compatibility notes
- [Maintainer presentation guide](https://github.com/SafetyMP/FidusGate/blob/main/docs/community/github-presentation.md): repository metadata and public assets
- [Factory overlay](https://github.com/SafetyMP/FidusGate/blob/main/docs/factory-overlay.md): internal workflow guidance, separate from public product behavior