Inhuman MCP

Inspiration

Every approach to AI-driven incident response is built on supervising the model — "only report what you can confirm," confidence scores, a grader that double-checks the output. They're all fighting the same instinct: the model summarizing raw data into a finding that was never there, or firing off a command that quietly corrupts the evidence. But supervision is a mitigation on an output that can still lie.

We wanted to ask a different question: what if a fabricated finding simply had no way to exist? Not caught - ineffable, the way a good type system doesn't warn you about an impossible state but makes it unrepresentable. The SANS FIND EVIL! brief said it out loud - the soundest architecture is a custom MCP server where the agent physically cannot run a destructive command because the server doesn't expose one. We took that to its conclusion and pointed it at the harder fear too: hallucination.

What it does

Inhuman MCP is a forensic-discovery MCP server. It hands an agent host a single sift_discovery tool, and lets it investigate by writing small forensic queries. Every result comes back sealed, tracked, provenanced down to the origin; and possibility to sign the verdict becomes only possible if there's a reasonable explanation - why and how it was obtained.

The agent is only able to work on the case in the way an analyst does, and it self-corrects without a human in the loop, by design. A malformed query or an empty filter comes back not as a failure but as a door to the next step - a structured reply that explains the fix - and the agent corrects on its next call.

Agent is never stuck. Agent is never confused and lost. And agent is never able to make ungrounded claims.

How we built it

We spent over a year working on general MCP architecture that is capable to bear hundreds of tools without drift and without token budget inflation.

SIFT MCP was perfect application to prove the capability of our arch. We wired the full MCP tools list, introduced structured protocol with typed primitives like IP, and just gave it to the agent. There's no skills; no extra external calls; no harness or multi-agentic setup. It is just MCP - categorically better.

Challenges we ran into

On SIFT competition specifically - we found our own fabrication bypass and closed it. A model-typed sentinel once rode an if-condition's evidence provenance and signed through one of two seals that had drifted apart. Two independent agent swarms attacked the provenance core (18, then 14, reproduced findings — each a run, not an argument); we collapsed everything onto a single seal and regression-tested each. Finding and architecturally closing your own bypass is the strongest form of "we tested for it."

A local-model floor. On the same hardware, a 4-bit 9b model grounded 0 of 27 queries - it can't hold paren-balance and grounding discipline at once. 8-bit decisively solved the case. The architecture is model-agnostic, but the usable-local floor is real, and we found it empirically. Smallest model able to work with 100+ tools under our architecture turned out to be essentialai/rnj-1.

In general... We literally had to dive into compiler theory and write our own r7rs Scheme interpreter from scratch with end-to-end provenance. Then dive into field theory to implement uneval. Then dive into psychology and what can be probably called xenopsychology to build the self-healing interpreter loop that is allowing to never let AI get stuck.

Accomplishments that we're proud of

A small story that felt really good: frontier agent we don't control works a published intrusion case through this server and could not fabricate a single value of the verdict if it tried — we demo exactly that: type a correct-but-guessed IP, watch it refuse to sign. The guarantee isn't our orchestration behaving well; it's a property of the artifact, so it holds against any host. (actually, it was failure mode first - agent grabbed IP addresses by prefix, and was unable to understand why he cannot just use random substring, so we had to introduce special primitive).

What's beautiful - we built provenance system to debug end-to-end multi-agentic pipelines; for SIFT, we were forced into making it sound, catching several obscure bugs.

And all of this works without any guidance. No "don't make mistakes" or "be honest". Just ontological status accompanying every value, traced to its very origin, along with tools to traverse over the execution trace for post. Agent knows at every step what can he do next, and flows organically step by step until he gets the answer.

What we learned

Born-provenance beats post-hoc grading. If every value is born knowing where it came from, "did the agent hallucinate?" stops being a question you audit and becomes one the data answers.

And the lesson that reshaped the whole submission: you don't teach an agent to think like a senior analyst with a prompt it can ignore — you teach it through the tool's own responses. A wrong query returns a door that explains the fix; a grounded fact returns with the next move implied. The method lives in the membrane, not in a skill bolted on top. You don't need a smarter agent — you need MCP, but better.

What's next for Inhuman MCP

Our multi-agent - 4 agent lineages serving different roles, shared under runner package - demonstrated insane performance, being able to find evil under 5 minutes. Small, extremely fast models (rnj-1 8b did great work) were scouting across the image, obtaining the crucial bits of data almost instantly, while large models were speculatively ideating on what to check next if hypotheses would confirm or debunk. It is cost-unoptimized, but insanely fast setup, potentially able to act faster than attacker; though, we still have some work to do on provenance traversal exposure and coordination to wire to this system.

We focused on making those runner pipelines being autonomous, so it could be living inside secure contours like PCI/DSS, but we needed way more time on researching the best LLM lineage pairings, as many were behaving poorly together - e.g. Llama and Qwen were unable to collaborate at all in our environment.

Built With

• arrival
• javascript
• mcp