Atreides: Agent Security Gateway

A proof-carrying MCP security gateway. Stop agent runaway with deterministic, provenance-based policy and auditable trust receipts—not LLM confidence scores. x

Comment

Inspiration

Most prompt-injection defenses concentrate on detecting suspicious wording—asking whether text looks malicious. This is fundamentally a guessing game that relies on heuristic model confidence scores.

We were inspired to change the question: instead of analyzing text, we built a deterministic action boundary. We asked, “Can this specific context authorize this specific action?” Atreides evaluates whether untrusted provenance is authorizing a sensitive capability (like secret egress) and returns a definitive, explainable decision rather than a warning.

What it does

Atreides is a developer-focused security gateway that tracks the path from untrusted context to a requested Model Context Protocol (MCP) action.

  • Upstream MCP Broker: It discovers configured stdio upstream MCP tools and enforces deterministic policy before an allowed tool call is forwarded to execution.
  • Trust Receipts: It produces a signed, hash-chained trust receipt. Every action—allowed or blocked—is fully auditable, exposing the policy name, reason, version, prior hash, and a SHA-256 evidence hash.
  • Provenance-aware decisions: It makes decisions based on the trust level, data sensitivity, destination, and write impact. Untrusted provenance cannot by itself authorize secret egress or other high-impact tool actions.
  • Safe Red-Team Replay: We built an interactive operator console that safely recreates an indirect prompt-injection attempt (exfiltrating fake secret-labelled data) without ever contacting an external service.

How we built it

We architected the solution as a TypeScript monorepo with two primary applications:

  1. The Gateway: A Node.js backend using Zod for payload validation and the @modelcontextprotocol/server SDK. It functions as a provenance-aware policy evaluator and receipt service.
  2. The Operator Console: A Next.js/React frontend providing an immersive, progressively enhanced visual system. It includes a live policy laboratory and live receipt-chain verification to visualize the difference between an unprotected agent and an Atreides-protected action.

Codex / GPT-5.6 Assistance: We utilized Codex during the build for architecture decomposition, TypeScript scaffolding, policy-test design, and visual-system iteration.

Challenges we ran into

  • Intercepting MCP Calls: Building a transparent stdio upstream MCP broker that could discover configured tools, pause execution, evaluate our deterministic policy, and only forward allowed calls required careful management of the stdio streams and the MCP protocol lifecycle.
  • Hash-Chain Integrity: Ensuring every trust receipt correctly referenced the prior receipt's hash while maintaining high throughput for the gateway. The cryptographic hash chain ensures the receipt ledger is append-only and tamper-evident: $$H_n = \text{SHA256}(H_{n-1} \parallel \text{Receipt}_{n})$$

Accomplishments that we're proud of

  • Deterministic Security: We successfully proved that policy-as-code can block secret exfiltration with 100% certainty based on context provenance, without invoking an LLM for authorization.
  • Auditable Proof: Implementing the hash-chained receipts with optional durable JSONL persistence and HMAC signing.
  • The Visual Experience: We're incredibly proud of the web product experience, particularly the "Run before/after proof" demo which visually demonstrates the vulnerability of an unprotected agent versus the strict pre-execution enforcement of Atreides.

What we learned

We learned that attempting to filter out "bad words" or malicious-sounding prompts is inherently flawed for autonomous agents. True security for agentic systems requires strict, pre-execution capability authorization. By treating policy as code rather than relying on model heuristics, we can give developers auditable, mathematically verifiable confidence in their agents' boundaries.

What's next for Atreides

This prototype is currently a pre-execution evaluator and stdio MCP broker. Our next steps are:

  • Expanding to a transparent drop-in transport proxy for any MCP transport (beyond just stdio).
  • Adding identity-aware authorization and mTLS for production deployments.
  • Integrating an encrypted, access-controlled append-only store for durable receipts and managed signing keys to move from prototype to production control plane.

Built With

Share this project:

Updates