The security stack for AI agents

• Static analysis of what an MCP server or A2A agent claims about itself: no LLM, no execution
• Catches tool-poisoning, hidden-unicode & homoglyph names, tool-shadowing, secret solicitation
• Encoded poisoning: decodes base64, hex, binary, base32, ascii85/base85, Morse and escapes before scanning (88% of encoded corpus attacks caught, 0% false positives on the benign traps)

• Static code-layer scan of a skill’s bundled scripts — regex + a Python AST tier, no LLM, no execution
• Catches hook-install/persistence, lateral tampering, egress, secret reads, obfuscation, and opaque/renamed binaries
• Shadow detection: flags capabilities the code exercises that SKILL.md never declared

• Scans the memory an agent auto-loads as trusted every session (v0.1: CLAUDE.md + Claude Code auto-memory)
• Judges shape, not vocabulary: declarative facts pass, imperatives aimed at future behavior get flagged
• Baseline diff catches stealth and delayed poison, the new lines since you last vetted it

• Three guards in one SDK: inbound injection block, tool-call guard, outbound PII/secret redaction
• Tool-call guard is the differentiator — stops mass email/delete/refund/exfil
• Drop-in SDK: data never leaves your box; optional LLM judge

• Focus on indirect prompt injection via tool output
• Canary-token + forbidden-tool scoring; multi-run land-rate by tactic
• Cross-model / cross-vendor matrix (Claude + GPT)

• Derives inject point → landing → causal path → blast radius; verdicts LANDED / ATTEMPTED / CLEAN
• Scores a bastionfuse trip snapshot: the call the fuse tripped on is the landing, reported as contained because the fuse blocked it
• Multi-agent cascades: patient zero, every agent the injection reached, agent-to-agent hops, and a worm signal when agents re-send the payload

• Sits inline between agent and MCP servers (stdio + HTTP/SSE)
• Drops poisoned tools, enforces allow/deny, blocks injected results, redacts PII in arguments
• Scans everything the model can read: tool results, embedded resources and files, resources/read, prompts, resource and prompt lists, server errors and the server’s own instructions

• One proxy in front of every peer agent (A2A v1.0 and v0.3), so it sees each agent-to-agent hop
• Scans peer replies (task artifacts, status, history, streamed chunks) for injection, and flags an agent passing a payload on to another peer
• Pins and rewrites agent cards: bastionsupply checks at startup, drift blocked, callers can only reach the mesh endpoint

• Watches what the agent does, not what its text says: the backstop for when every text detector misses
• Honeytokens and decoy files (bastionfuse plant): an agent that reads a decoy and then tries to send data out is stopped
• Decoy MCP tools no legitimate flow calls; budgets on calls, egress, destructive actions, hosts and bytes

• 181 rows: 118 malicious payloads / 63 benign false-positive traps, including encoded attacks and encoded benign traps
• 5 languages (en/it/de/fr/es), one taxonomy
• Shared decoder: variants() returns what base64, hex, binary, base32, ascii85, Morse, escapes and more say, so every tool decodes and rescans the same way

Defense in depth

Static pre-flight scanning, in-process filtering, and an inline runtime gateway — layered, not a single choke point.

Runs on your box

Core detection is local and dependency-light. No data leaves your infrastructure; an LLM judge is opt-in.

Stops what the agent does

Bastion stops what the agent does, not just what it reads. Encoded payloads (base64, binary, rot13…) are decoded and rescanned, and the tool policy and flow guard hold even when a payload slips past every text check.

Honest benchmarks

Measured against a shared, multilingual corpus with false-positive traps — recall and FPR published, not hand-waved.