The security stack for AI agents

• Static analysis of an MCP server’s own tool definitions — no LLM, no network
• Catches tool-poisoning, hidden-unicode & homoglyph names, tool-shadowing, secret solicitation
• Rug-pull detection via lock / verify

• Three guards in one SDK: inbound injection block, tool-call guard, outbound PII/secret redaction
• Tool-call guard is the differentiator — stops mass email/delete/refund/exfil
• Drop-in SDK: data never leaves your box; optional LLM judge

• Focus on indirect prompt injection via tool output
• Canary-token + forbidden-tool scoring; multi-run land-rate by tactic
• Cross-model / cross-vendor matrix (Claude + GPT)

• Derives inject point → landing → causal path → blast radius from a JSONL trace
• Verdicts: LANDED / ATTEMPTED / CLEAN
• No LLM, no cloud — pure analysis

• Sits inline between agent and MCP servers (stdio + HTTP/SSE)
• Drops poisoned tools, enforces allow/deny, blocks injected results, redacts PII in arguments
• JSONL forensic log; consumes the policy bastionsupply harden emits

• 128 rows: 81 malicious payloads / 47 benign false-positive traps
• 5 languages (en/it/de/fr/es), one taxonomy
• Three format adapters: to_probe, to_semantic, to_trace

Defense in depth

Static pre-flight scanning, in-process filtering, and an inline runtime gateway — layered, not a single choke point.

Runs on your box

Core detection is local and dependency-light. No data leaves your infrastructure; an LLM judge is opt-in.

Honest benchmarks

Measured against a shared, multilingual corpus with false-positive traps — recall and FPR published, not hand-waved.