Tripwire MCP server

Tripwire

The security gateway for MCP agents that other gateways can't be: it blocks prompt-injection-driven tool calls by checking whether an action is grounded in evidence and intent — not just whether it matches a regex.

npm install -g tripwire-mcp   # then: tripwire init

AI agents now take real actions — payments, trades, writes, sends — and the parameters of those actions are taken on faith. Existing MCP security gateways are syntactic (globs, allowlists, regex); none can answer the question that matters: is this action grounded in the evidence and consistent with the user's intent? A payment to an attacker's address looks identical to a payment to the real vendor.

Tripwire is an MIT-licensed MCP proxy. Point any MCP agent at Tripwire instead of its tool servers; Tripwire forwards everything transparently while running a three-tier verification pipeline on calls that policy marks as consequential:

• Tier 0 — Receipts (deterministic, ~1ms). Every tool result is signed with HMAC-SHA256 into an unforgeable ledger of what actually happened. Fabricated tool results and tampered values fail against the receipts.
• Tier 1 — Provenance (deterministic, ~ms). Every value observed in tool results is indexed with its origin and trust label. A payment address that only ever appeared inside an untrusted document is blocked by construction — no model call, no heuristic.
• Tier 2 — Multi-model consensus (probabilistic, high-stakes only). Independent models from different providers check intent match, source grounding, and bounds/sanity, with strict-JSON verdicts, quorum aggregation, and fail-closed semantics.

Every decision — including passes — lands in a hash-chained, append-only audit log that tripwire verify-log re-validates.

The full design and build plan is in TRIPWIRE_PLAN.md.

Read next: docs/THREAT_MODEL.md — what each tier defends against, and exactly what Tripwire cannot do. docs/POLICY.md — the policy YAML reference.

Status

v0.3.0 — all five build phases complete, plus a no-engineering-required setup flow (tripwire init / check / logs) and HTTP transport for server-side deployments (one Tripwire process, many isolated agent sessions). See docs/GETTING_STARTED.md and Server-side (HTTP).

Shortened. The full README is on GitHub.