JAK Shield - The Execution Firewall for AI Agents

JAK Shield is an MCP-native execution firewall for AI agents, blocking unsafe tool calls, redacting sensitive data, enforcing approvals and using GPT-5.6 for deeper risk analysis.

Comment

Inspiration

AI agents are moving beyond answering questions. They can now send emails, run terminal commands, access databases, deploy software, publish content and initiate payments.

That creates a fundamental security problem: the same AI model deciding what action to take should not be the final authority deciding whether that action is safe.

While building agentic systems connected to real business tools, we realised that prompt-level safety was not enough. An agent can be manipulated by malicious instructions hidden inside a webpage, document, email, repository or tool response. Even a well-intentioned agent can misunderstand a request, expose sensitive information or perform an irreversible action.

We built JAK Shield to create a hard security boundary between an AI agent’s intention and its real-world execution.

What it does

JAK Shield is a local-first, MCP-native execution firewall for AI agents.

It sits between an AI agent and the tools that agent wants to use. Every protected tool call is evaluated before execution and receives one of five decisions:

  • allow
  • redact
  • rewrite
  • requires_approval
  • block

Unlike a safety prompt that the model may misunderstand or ignore, JAK Shield uses a deterministic policy engine as the final enforcement authority.

It can:

  • Block destructive SQL, dangerous shell commands, unauthorised deployments and unsafe payment actions.
  • Detect prompt-injection and offensive-cyber instructions in English and multiple additional languages.
  • Detect and redact PII, credentials, API keys and other secrets.
  • Track untrusted information across multiple tool calls using taint tracking.
  • Detect multi-step attack chains instead of evaluating every action in isolation.
  • Enforce role-based access control.
  • Require human approval for high-risk actions.
  • Issue exact-call, scoped and single-use authorisation tokens.
  • Activate Floodgate, an emergency lockdown that closes every non-read-only execution path.
  • Produce cryptographically signed, tamper-evident decision and audit records.

JAK Shield supports MCP over STDIO and Streamable HTTP, along with a REST API, allowing it to protect Codex, MCP-compatible clients and custom AI applications.

How OpenAI is used

During OpenAI Build Week, we used Codex running GPT-5.6 to upgrade and test JAK Shield’s optional semantic-risk analyst and its native Codex MCP integration.

The GPT-5.6 analyst uses the OpenAI Responses API with strict structured output. It analyses the semantic meaning behind a proposed tool call and can identify:

  • Hidden or conflicting intent
  • Prompt injection
  • Possible data exfiltration
  • Objective conflicts
  • Unsafe context
  • Opportunities to safely rewrite an action

Before any information is sent to the model, JAK Shield locally scans and redacts sensitive strings from nested tool arguments and agent context.

GPT-5.6 is deliberately advisory rather than authoritative. It may increase scrutiny, recommend redaction, require approval or suggest a safer rewrite, but it cannot:

  • Override a deterministic hard block
  • Reopen Floodgate
  • Bypass RBAC
  • Approve its own action
  • Execute a connector
  • Bypass exact-call authorisation tokens

If the OpenAI API is unavailable, times out, refuses the request or produces invalid structured output, JAK Shield safely falls back to deterministic enforcement.

This architecture combines GPT-5.6’s semantic understanding with predictable, non-bypassable execution controls.

How we built it

JAK Shield is built as a TypeScript monorepo containing:

  • A deterministic policy engine
  • An MCP STDIO and Streamable HTTP server
  • A Fastify REST API
  • A Next.js operational dashboard
  • An Electron desktop application
  • A human-approval gateway
  • A PII and secret-redaction layer
  • Prompt-injection detection
  • Taint and attack-chain tracking
  • Risk-detector packs
  • Signed audit infrastructure
  • Protected connector operations
  • Reference integrations for additional agent frameworks

For Codex, we created a project-level MCP configuration that treats JAK Shield as a required local security server.

The integration instructs Codex to route external side effects through shield.proxy_tool_call. Evaluation-only requests can use shield.evaluate_tool_call, while destructive or high-risk actions are stopped unless the required approval or authorisation is available.

We also created a verification flow that launches the compiled MCP server, performs MCP initialisation and tool discovery, evaluates a proposed tool call, exercises the proxy path and verifies that destructive SQL is deterministically blocked.

Challenges we faced

Separating intelligence from authority

The hardest architectural decision was ensuring that GPT-5.6 could provide valuable semantic analysis without becoming another security dependency.

The solution was an escalation-only design: AI-generated advice can make a decision stricter, but it cannot weaken a deterministic security decision.

Protecting data before AI analysis

A semantic analyst needs enough context to understand risk, but sending raw tool arguments could expose the very information JAK Shield is designed to protect.

We therefore added bounded, recursive, local pre-egress redaction before cache-key creation or model transmission.

Securing multi-step behaviour

Many agent attacks do not appear dangerous in a single tool call. A browser fetch may look harmless, followed by a database query and then an outbound email.

JAK Shield therefore tracks untrusted data and recognises cross-call attack patterns instead of treating every request as an isolated event.

Failing safely

Security tools must remain predictable during provider errors, malformed responses, missing credentials and timeouts.

The GPT-5.6 analyst never becomes a required dependency for deterministic enforcement. When it is unavailable, the core firewall continues operating.

Being honest about readiness

JAK Shield is currently ready for controlled early testing, not unrestricted production deployment.

Clean Windows virtual-machine acceptance, code signing, an independent penetration test and additional hosted multi-tenant hardening remain future validation steps. We chose to document these limits clearly rather than claim that automated testing proves the absence of vulnerabilities.

Accomplishments that we are proud of

  • Built an execution firewall that protects actions rather than merely filtering conversations.
  • Integrated GPT-5.6 without allowing probabilistic model output to overrule deterministic policy.
  • Added local pre-egress PII and secret redaction.
  • Created a native Codex MCP profile and verification workflow.
  • Implemented signed decisions and tamper-evident audit trails.
  • Protected destructive and external-side-effect operations with approvals and exact-call authorisation.
  • Added a one-click Floodgate emergency lockdown.
  • Verified MCP startup, tool discovery, evaluation, proxying and destructive-SQL blocking.
  • Preserved safe deterministic operation when the OpenAI analyst is disabled or unavailable.

What we learned

The biggest lesson was that AI-agent security cannot rely only on better prompts or smarter models.

Models are excellent at interpreting intent, ambiguity and context. However, irreversible actions require deterministic controls, explicit permissions and verifiable records.

The safest architecture is therefore not AI versus rules. It is:

AI for understanding. Deterministic policy for authority. Human approval for accountability.

What’s next

Our next steps include:

  • Completing clean-Windows-VM installation and lifecycle testing.
  • Adding code signing for the desktop installer.
  • Conducting an independent penetration test.
  • Hardening hosted multi-tenant deployment.
  • Expanding framework and client integration testing.
  • Improving the SQL parser and remaining concurrency controls.
  • Building clearer visual approval and incident-investigation workflows.
  • Making JAK Shield easier to install in front of any MCP-compatible AI agent.

Our long-term goal is to make JAK Shield a universal execution-security layer for autonomous agents—giving developers the freedom to build powerful AI systems without giving those systems unchecked authority over real-world tools.

Built With

  • ai-agents
  • codex
  • cybersecurity
  • data-loss-prevention
  • docker
  • electron
  • fastify
  • github-actions
  • gpt-5.6
  • mcp
  • next.js
  • node.js
  • openai
  • openai-responses-api
  • pnpm
  • postgresql
  • prisma
  • prometheus
  • prompt-injection
  • rbac
  • rest-api
  • turborepo
  • typescript
  • vitest
  • zod
Share this project:

Updates