Tripwire

The security gateway for MCP agents that other gateways can't be: it blocks prompt-injection-driven tool calls by checking whether an action is grounded in evidence and intent — not just whether it matches a regex.

npm install -g tripwire-mcp   # then: tripwire init

AI agents now take real actions — payments, trades, writes, sends — and the parameters of those actions are taken on faith. Existing MCP security gateways are syntactic (globs, allowlists, regex); none can answer the question that matters: is this action grounded in the evidence and consistent with the user's intent? A payment to an attacker's address looks identical to a payment to the real vendor.

Tripwire is an MIT-licensed MCP proxy. Point any MCP agent at Tripwire instead of its tool servers; Tripwire forwards everything transparently while running a three-tier verification pipeline on calls that policy marks as consequential:

• Tier 0 — Receipts (deterministic, ~1ms). Every tool result is signed with HMAC-SHA256 into an unforgeable ledger of what actually happened. Fabricated tool results and tampered values fail against the receipts.
• Tier 1 — Provenance (deterministic, ~ms). Every value observed in tool results is indexed with its origin and trust label. A payment address that only ever appeared inside an untrusted document is blocked by construction — no model call, no heuristic.
• Tier 2 — Multi-model consensus (probabilistic, high-stakes only). Independent models from different providers check intent match, source grounding, and bounds/sanity, with strict-JSON verdicts, quorum aggregation, and fail-closed semantics.

Every decision — including passes — lands in a hash-chained, append-only audit log that tripwire verify-log re-validates.

The full design and build plan is in TRIPWIRE_PLAN.md.

Read next: docs/THREAT_MODEL.md — what each tier defends against, and exactly what Tripwire cannot do. docs/POLICY.md — the policy YAML reference.

Status

v0.3.0 — all five build phases complete, plus a no-engineering-required setup flow (tripwire init / check / logs) and HTTP transport for server-side deployments (one Tripwire process, many isolated agent sessions). See docs/GETTING_STARTED.md and Server-side (HTTP).

• Phase 1 — Transparent proxy + receipts. stdio MCP proxy; tools from multiple upstreams merged and re-exposed as <upstream>__<tool> with definitions passed through verbatim; byte-equivalent passthrough proven by integration test; HMAC-SHA256 receipt ledger over canonical JSON (in-memory + JSONL); hash-chained audit log of all traffic; tripwire verify-log.
• Phase 2 — Policy engine + provenance index. Zod-validated YAML policy (tool globs, upstream, annotation matching; first rule wins); session value-provenance index over every receipted result (addresses, amounts, emails, URLs, ids — normalized across case, whitespace, hex prefixes, number formatting); structural Tier 1 enforcement of sensitive_params provenance, with anti-laundering (echoed inputs never gain a tool's trust label, failed executions are not evidence); structured machine-actionable BLOCK results built for agent self-correction. The poisoned-invoice attack is blocked by Tier 1 alone — zero model calls.
• Phase 3 — Intent capture + Tier 2 consensus. Synthetic tripwire__declare_intent tool (receipted; policy can require it via require_intent, and the block error tells the agent how to self-serve); verification packet builder (intent + proposed call + Tier 1 provenance + receipted evidence excerpts); thin fetch-based verifier clients for Anthropic/OpenAI/Google with strict JSON verdict parsing; parallel panel with

... View full README on GitHub