Tripwire MCP

The security gateway for MCP agents that other gateways can't be: it blocks prompt-injection-driven tool calls by checking whether an action is grounded in evidence and intent — not just whether it matches a regex.

npm install -g tripwire-mcp # then: tripwire init

AI agents now take real actions — payments, trades, writes, sends — and the parameters of those actions are taken on faith. Existing MCP security gateways are syntactic (globs, allowlists, regex); none can answer the question that matters:is this action grounded in the evidence and consistent with the user's intent?A payment to an attacker's address looks identical to a payment to the real vendor.

Tripwire is an MIT-licensedMCP proxy. Point any MCP agent at Tripwire instead of its tool servers; Tripwire forwards everything transparently while running a three-tier verification pipeline on calls that policy marks as consequential:

- Tier 0 — Receipts (deterministic, ~1ms).Every tool result is signed with HMAC-SHA256 into an unforgeable ledger of what actually happened. Fabricated tool results and tampered values fail against the receipts.
- Tier 1 — Provenance (deterministic, ~ms).Every value observed in tool results is indexed with its origin and trust label. A payment address that only ever appeared inside an untrusted document is blockedby construction— no model call, no heuristic.
- Tier 2 — Multi-model consensus (probabilistic, high-stakes only).Independent models from different providers check intent match, source grounding, and bounds/sanity, with strict-JSON verdicts, quorum aggregation, and fail-closed semantics.

Every decision — including passes — lands in a hash-chained, append-only audit log thattripwire verify-logre-validates.

The full design and build plan is inTRIPWIRE_PLAN.md.

Read next:docs/THREAT_MODEL.md— what each tier defends against, and exactly what Tripwire cannot do.docs/POLICY.md— the policy YAML reference.

v0.3.0 — all five build phases complete, plus a no-engineering-required setup flow (tripwire init/check/logs) andHTTP transportfor server-side deployments (one Tripwire process, many isolated agent sessions). Seedocs/GETTING_STARTED.mdandServer-side (HTTP).

- Phase 1 — Transparent proxy + receipts.stdio MCP proxy; tools from multiple upstreams merged and re-exposed as<upstream>__<tool>with definitions passed through verbatim; byte-equivalent passthrough proven by integration test; HMAC-SHA256 receipt ledger over canonical JSON (in-memory + JSONL); hash-chained audit log of all traffic;tripwire verify-log.
- Phase 2 — Policy engine + provenance index.Zod-validated YAML policy (tool globs, upstream, annotation matching; first rule wins); session value-provenance index over every receipted result (addresses, amounts, emails, URLs, ids — normalized across case, whitespace, hex prefixes, number formatting); structural Tier 1 enforcement ofsensitive_paramsprovenance, with anti-laundering (echoed inputs never gain a tool's trust label, failed executions are not evidence); structured machine-actionable BLOCK results built for agent self-correction. The poisoned-invoice attack is blocked by Tier 1 alone — zero model calls.
- Phase 3 — Intent capture + Tier 2 consensus.Synthetictripwire__declare_intenttool (receipted; policy can require it viarequire_intent, and the block error tells the agent how to self-serve); verification packet builder (intent + proposed call + Tier 1 provenance + receipted evidence excerpts); thin fetch-based verifier clients for Anthropic/OpenAI/Google with strict JSON verdict parsing; parallel panel with majority/unanimous quorum; timeouts, malformed output, and missing keys all count as failed verdicts under fail-closed; verifier disagreement flagged as signal; versioned prompt templates pinned in every audit entry. Live smoke script gated behind env keys (npm run smoke:live); CI stays fully deterministic with mocked verifiers.
- Phase 4 — Benchmark + demo.42-scenario corpus (21 attacks, 21 legitimate false-positive traps); deterministic harness whose numbers reproduce in CI with zero API calls;npm run demoshows the disarmed agent paying the attacker, the identical agent blocked structurally and self-correcting, and Tier 2 catching a plausible-but-wrong amount.
- Phase 5 — Threat model + launch.docs/THREAT_MODEL.md(per-tier defenses, assumptions stated as attack surface, and a plain list of what Tripwire does NOT defend against),docs/POLICY.mdpolicy reference, v0.1.0.

npm install npm run demo # deterministic, no API keys needed npm run demo -- --live # same demo with a real multi-provider verifier panel

{ "tripwire": "blocked", "code": "provenance_violation", "tool": "payments__send_payment", "violations": [ { "param": "recipient", "reason": "untrusted_provenance", "required_provenance": "trusted", "value_preview": "0xBBBB000000…0000BBBB", "observed_origins": [ { "upstream": "docs", "tool": "docs__read_document", "trust": "untrusted", "receipt_seq": 2 } ] } ], "remediation": "Fetch the required value from a trusted tool in this session…" }

A well-built agent reads this, re-queries the vendor record (trusted), and retries with the real address — which passes. That loop is tested end-to-end with zero verifier models intest/tier1.integration.test.ts.

Set it up (no config files to hand-write)

New to this? Followdocs/GETTING_STARTED.md— written for non-engineers.

npm install -g tripwire-mcp # or, before the npm release: github:bonesdefi/tripwire tripwire init # answers a few plain-language questions, writes your config tripwire check # confirms your servers start and your rules make sense

npm run demo # the poisoned-invoice story, no API keys needed

transport: type: http http: { host: 127.0.0.1, port: 8765, auth_token: a-long-random-secret }

Agents connect tohttp://…:8765/mcpwithAuthorization: Bearer …. Binding beyond loopbackrequiresthe token — Tripwire refuses to start exposed-but-unauthenticated. Details and the threat model for network exposure:docs/POLICY.md,docs/THREAT_MODEL.md.

tripwire run --config tripwire.example.yaml

{ "mcpServers": { "tripwire": { "command": "tripwire", "args": ["run", "--config", "tripwire.example.yaml"] } } }

Every session records to.tripwire/sessions/<session-id>/:

Read a session in plain English, or verify it cryptographically:

tripwire logs .tripwire/sessions/<session-id> # what happened, in plain English tripwire verify-log .tripwire/sessions/<session-id> # prove the record wasn't altered # audit chain OK (14 entries) # receipts OK (7 receipts)

Tamper with a single byte of either file and verification fails loudly, naming the line.

npm test # deterministic; spawns real MCP servers over stdio, no API keys needed npm run typecheck npm run lint npm run build

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

Trust and safety layer for AI agents — scores MCP servers for security risk, capability flags, and prompt injection.

Vaara is the tamper-evident runtime evidence layer for AI systems. It covers EU AI Act compliance, and any other case where you need to prove what an agent actually did. Open source, no SaaS, no telemetry.

Enforces organisational AI usage policies at the agent layer — blocks prohibited model calls, enforces data residency rules, logs policy violations, and ensures AI governance policies are machine-executable.

Guardrails service for AI agents. Default-deny tool call evaluation with LLM safety analysis, priority-ordered decision matrix, and human-in-the-loop escalations. Session recording, behavioral analysis, MCP proxy, secret redaction, and real-time audit.

AI-powered security operations with Wazuh SIEM + Claude Desktop. Natural language threat detection, automated incident response & compliance.

Cloud security insights, guardrail guidance, and compliance checking via Dawnguard.

Require a named human's offline-verifiable approval before an AI agent takes an irreversible action — payment release, record change, deploy. Two-person rule, Ed25519 Trust Receipts, IETF-drafted, Apache-2.0.

Six-gate governance for AI agents: PROCEED/PAUSE/HALT decisions with hash-chained audit trails.

EU AI Act compliance scanner for Python AI agents — 10 tools for scanning, analysis, and remediation

EXIF for AI. AKF embeds trust scores, source provenance, and compliance metadata into every file your AI touches — DOCX, PDF, images, code, and 20+ formats. 9 MCP tools: stamp, inspect, trust, audit, scan, embed, extract, detect. Audit against EU AI Act, SOX, HIPAA, NIST in one command.