Pramaan WebMCP

Pramaan extends beyond passive governance into an active security scanning and validation platform for both Agent-to-Agent (A2A) networks and Model Context Protocol (MCP) servers.

Comment

Inspiration

AI agents are rapidly evolving from simple chatbots into autonomous systems that browse the web, execute tools, access enterprise APIs, manage infrastructure, interact directly within browser applications, and collaborate with other AI agents. Protocols such as A2A (Agent-to-Agent), MCP (Model Context Protocol), and emerging browser-native WebMCP (Web Model Context Protocol) have made agent interoperability possible, but they largely focus on communication not trust.

Today, an AI agent can execute tools directly in a user's browser, call remote MCP servers, or request another agent to execute sensitive actions with little or no governance around identity, delegation, permissions, or intent. This creates entirely new attack surfaces, including client-side prompt injection, DOM & storage exfiltration, identity spoofing, unauthorized tool execution, replay attacks, and rogue autonomous behavior.

We built Pramaan to answer one fundamental question:

Before one AI agent trusts another or executes tools in a user's browser, how can it prove that the request is legitimate, authorized, secure, and compliant?

Our vision is to bring the same level of security and governance that enterprises expect from human users to autonomous AI agents across backend networks, MCP servers, and client-side browser runtimes.

What it does

Pramaan is a Proof-of-Authority governance layer and security ecosystem that sits between AI agents and verifies every interaction before execution, spanning A2A communication, remote MCP endpoints, and browser-native WebMCP tool calling.

Instead of allowing agents to communicate or invoke tools unrestricted, every request passes through a comprehensive security and governance pipeline.

Pramaan provides:

  • Proof-of-Authority verification for every A2A interaction
  • Verifiable agent identities using W3C Verifiable Credentials (Agent Passports)
  • Human-backed delegation chains with cryptographic hash-chain ledgers
  • Zero-Knowledge Proof-based policy validation for privacy-preserving constraints
  • Dynamic authority intersection to calculate effective permissions
  • Rogue agent detection through 6-signal behavioral risk scoring
  • Quorum-based trust receipts (e.g. 2-of-3 / 3-of-5 threshold signing)
  • Automatic revocation and circuit breaking with sub-second propagation
  • Tamper-evident audit logging with hash-chained records
  • Prompt injection detection across 6 defense layers
  • Replay attack prevention, API rate limiting, and honeypot/canary traps

🌐 WebMCP Studio & Browser-Native Agent Tool Execution

Pramaan natively integrates WebMCP (navigator.modelContext), turning the browser into a secure, interactive Agentic Runtime:

  • Interactive WebMCP Studio & Inspector: Built-in floating HUD and interactive console to prompt LLMs (Gemini 3.7 / 3.6 Flash), inspect schemas, and dispatch client-side tools in real time.
  • Reactive UI Automation & Live Page State: Agents invoking WebMCP tools (pramaan_agent_scan, pramaan_mcp_scan, pramaan_agent_builder, pramaan_mcp_builder) automatically navigate the SPA, fill input parameters, trigger live background tasks, and pop open configuration drawers with real-time feedback.
  • Scoped Least-Privilege Tools: Exposes strictly scoped, validated tools preventing arbitrary browser storage or DOM tampering.
  • Dual-Plane Governance: Extends backend Proof-of-Authority checks to client-side tool calling, ensuring browser agents cannot bypass authentication or rate limits.

🛡️ Sentinel & DeepTeam Red Teaming

Beyond governance, Pramaan includes Sentinel, an AI security assessment platform capable of:

  • Scanning A2A agents for governance vulnerabilities and missing constraints
  • Auditing MCP servers across SSE and Streamable HTTP protocols
  • Discovering exposed tools and resources with automated risk classification
  • Running AI red-team attacks using DeepTeam (OWASP Top 10 for Agentic AI)
  • Generating actionable security reports with downloadable JSON audits

How we built it

Pramaan is built as a modular governance platform composed of multiple independent security components working together across backend, frontend, and browser runtimes.

Tech Stack & Core Libraries

  • Backend: Python, FastAPI, Google ADK, Gemini 3.6 / 3.7 Flash, A2A SDK, MCP Python SDK (sse & streamable_http), DeepTeam
  • Frontend & Client: React, TypeScript, Tailwind CSS, Vite, AG-UI Protocol, Monaco Editor, Lucide Icons
  • Browser Agentic Layer: WebMCP (navigator.modelContext), Custom Web Events Reactive Bus, Client-side LLM Tool Dispatcher

Governance & Security Engine

We designed a multi-stage verification pipeline where every request passes through:

  1. Identity verification (W3C Verifiable Credentials)
  2. Delegation chain validation
  3. Policy evaluation (OPA / Rego)
  4. Risk assessment & behavioral scoring
  5. Authority computation
  6. Human approval routing (HITL)
  7. Audit logging
  8. Final tool execution

We also implemented a global interceptor that performs:

  • PII redaction (Email, SSN, API keys, credentials)
  • Goal integrity validation
  • OPA / Rego access control policies
  • Sandbox restrictions and autonomy budgets
  • Output validation and blocklist filtering

Challenges we ran into

Building end-to-end governance across backend agents, MCP endpoints, and in-browser WebMCP tools introduced several unique technical challenges:

  1. Bridging Browser WebMCP with Reactive UI State: When an agent executes a tool via WebMCP (e.g., creating a new MCP server or scanning a target), the React UI needed to react immediately, navigating routes, updating grids, populating Monaco code editors, and triggering background scans without page refreshes. We solved this by creating a typed event bus and reactive HUD notification layer.

  2. Multi-Protocol MCP Transport Support: Public MCP servers use varying transports (traditional Server-Sent Events via GET vs. Streamable HTTP over POST). Designing the scanner and proxy to automatically negotiate between SSE, Streamable HTTP, and hosted local stdio subprocesses required deep protocol normalization.

  3. Multi-Factor Trust Decisions Without Latency Overhead: Combining cryptographic credential verification, zero-knowledge range checks, OPA policy evaluation, and behavioral risk scoring into a sub-second decision loop required optimizing verification pipelines and caching revocation trees in memory.

  4. Balancing Autonomous Agility with Strict Governance: Overly strict policies hinder agent utility. We engineered dynamic authority intersection and risk-tiered human-in-the-loop escalation to allow safe autonomous operations while intercepting high-risk actions.

Accomplishments that we're proud of

  • Complete Proof-of-Authority Framework: Designed and implemented an end-to-end PoA governance fabric for AI agents.
  • 16-Layer Defense Architecture: Built a multi-layered security suite covering both static configuration auditing and dynamic runtime interception.
  • Interactive WebMCP Studio: Implemented client-side WebMCP tooling that allows users to interact with their agent fleet, launch automated scans, and build agents using natural language prompts inside the browser.
  • Universal MCP Scanner: Built a scanner capable of auditing remote SSE, Streamable HTTP, and locally hosted MCP servers, enumerating capabilities and assigning granular tool risk tiers.
  • Automated AI Red-Teaming: DeepTeam integration to simulate adversarial prompt injections, privilege escalation attempts, and jailbreaks.
  • Zero-Knowledge & Verifiable Identity: Implemented privacy-preserving policy proofs and W3C compliant Agent Passports.

What we learned

  • Security Must Span From Cloud to Browser: Securing Agentic AI requires governance at every hop from agent-to-agent network protocols down to client-side WebMCP browser execution.
  • Authentication, Authorization and Trust: Knowing an agent's identity is just step one. Continuous verification of authority, delegation scope, intent alignment, and runtime behavior is essential.
  • Emerging Standards Need Governance: While A2A, MCP, and WebMCP provide the communication plumbing, enterprises require a dedicated trust fabric before giving autonomous agents access to production systems.

What's next for Pramaan

  • Expanded WebMCP Standard Support: Aligning with evolving browser standards for native agent-to-web-application interaction.
  • Decentralized Trust Authorities: Multi-tenant, cross-organization Proof-of-Authority federations.
  • Continuous Behavioral Threat Modeling: Real-time graph neural network anomaly detection across large agent fleets.
  • Enterprise SIEM & SOAR Connectors: Direct streaming of audit trails and trust receipts to Splunk, Datadog, and Microsoft Sentinel.
  • Hardware-Backed Key Storage (HSM/TPM): Securing agent private keys and delegation signatures with hardware security modules.

Built With

Share this project:

Updates

Submission history