Agent Firewall MCP server

Deterministic checks for AI agents, with the misses written down

Deterministic detection of known attack patterns against the things an agent does: installing a package, reading untrusted text or email, following a link, sending money, writing code. No LLM anywhere in the detection path. Same input, same verdict, every time, with a rule id and a ruleset version attached to each one. Free, MIT, and the complete product runs locally.

This is a tripwire, not a blocker. It detects patterns it has rules for. It does not stop an attacker who reads those rules, and the rules are public. What determinism buys is not protection, it is evidence: a verdict you can reproduce, diff between commits, and put in a check that fails when your agent's exposure changes.

How well it works, measured

CORPUS.md is the answer, produced by running node scripts/corpus-report.js. Nothing in it is an estimate and CI fails if a case stops behaving the way it is recorded.

<!-- corpus:start -->

<!-- corpus:end -->

The injection row is the honest one: 3 of 7. Reword an attack and the rules score it zero, and four such rewordings live in the corpus as recorded misses. The false-positive column is zero across 11 ordinary cases, which matters just as much, because a checker that fires on git commit -m "fix $(whoami) thing" gets switched off and then detects nothing at all.

Every claim on this page maps to a case in the corpus. If a sentence here cannot be reproduced by running it, it should not be here.

What it is, and what it is not

Every check is a regex against a known pattern, a Unicode or structural test, or a lookup against a public list: OSV, OFAC, HIBP, Spamhaus, DNS, RDAP, an Ethereum RPC node. Nothing here is a classifier and nothing here understands what it reads. Where a check could not run, the response says so and never reports a pass in its place. For an actual boundary you want permissions or a sandbox, and you should run both.

Guide: Why your AI agent needs deterministic guardrails.

The tools

The hosted URLs are a free shared mirror of the same engines, rate-limited and with no SLA. There is no paid tier: if you need volume or privacy, run it locally, where there is no limit and nothing leaves the machine.

Shortened. The full README is on GitHub.