CERTIFY · REJECT · PROBE · ASK · CALIBRATED CONSEQUENCE CHECKS FOR THE ACTIONS OF AI AGENTS · NO LLM ON THE CERTIFY PATH · FAIL CLOSED · CERTIFY · REJECT · PROBE · ASK · CALIBRATED CONSEQUENCE CHECKS FOR THE ACTIONS OF AI AGENTS · NO LLM ON THE CERTIFY PATH · FAIL CLOSED · CERTIFY · REJECT · PROBE · ASK · CALIBRATED CONSEQUENCE CHECKS FOR THE ACTIONS OF AI AGENTS · NO LLM ON THE CERTIFY PATH · FAIL CLOSED · CERTIFY · REJECT · PROBE · ASK · CALIBRATED CONSEQUENCE CHECKS FOR THE ACTIONS OF AI AGENTS · NO LLM ON THE CERTIFY PATH · FAIL CLOSED · CERTIFY · REJECT · PROBE · ASK · CALIBRATED CONSEQUENCE CHECKS FOR THE ACTIONS OF AI AGENTS · NO LLM ON THE CERTIFY PATH · FAIL CLOSED · CERTIFY · REJECT · PROBE · ASK · CALIBRATED CONSEQUENCE CHECKS FOR THE ACTIONS OF AI AGENTS · NO LLM ON THE CERTIFY PATH · FAIL CLOSED · CERTIFY · REJECT · PROBE · ASK · CALIBRATED CONSEQUENCE CHECKS FOR THE ACTIONS OF AI AGENTS · NO LLM ON THE CERTIFY PATH · FAIL CLOSED · CERTIFY · REJECT · PROBE · ASK · CALIBRATED CONSEQUENCE CHECKS FOR THE ACTIONS OF AI AGENTS · NO LLM ON THE CERTIFY PATH · FAIL CLOSED ·
Shopping agents can now place real Instamart orders through Swiggy's published MCP tools. RiskGate makes the agent ask one short question when the order is ambiguous instead of guessing at checkout.
Transcript0:54 · narrated
Illustrative scenario · tool names from Swiggy's published Instamart MCP (instamart-evals, Apache-2.0) · not affiliated with Swiggy or Zepto
01 · What happened
The situation
A customer asks an AI agent for milk, bread and eggs for tomorrow morning. The agent calls the published Instamart tools step by step (get_addresses, search_products, update_cart, checkout), and checkout goes to the office: the last address used.
02 · The miss
Why the obvious safeguard didn’t catch it
Swiggy's own published guidance is to let the user choose the address. In an autonomous run there is no one to ask, so the template proceeds with the first address, and none of the public checkout tasks names one.
03 · RiskGate
List, play forward, decide
RiskGate, running as a proxy in front of the MCP server, holds the checkout and asks what else could be true: home, office, or already ordered today.
It plays the order forward in each world: safe in one of three.
So the agent asks once. One tap: home, not office. Now it is safe in every world left, and checkout is certified.
04 · At scale
What held, and the price
No outcome statistics are shown, because none exist for this setting. What is real is the surface: the tool and argument names, Swiggy's guidance and the `riskgate serve-mcp` proxy that sits in front of it.
13published Instamart MCP tools
1question, instead of a wrong delivery
0outcome stats claimed
Name one action your agent isn’t allowed to take today.
Send us its traces and what happened afterwards. We’ll show how often it could have run safely, and what it would have stopped.