PreTXsim

A high-performance, deterministic Rust MCP server that acts as an air-gapped pre-execution firewall to prevent prompt injection, price surges, and hidden fees in autonomous Alexa+ voice transactions.

Comment

As ambient AI voice assistants evolve into autonomous agents capable of taking real-world actions—such as buying products, booking home services, and managing subscriptions—they introduce a dangerous security vulnerability: untrusted tool execution.When an assistant processes voice commands, prompt injection from malicious web listings, merchant price-manipulation attacks, or hidden regional checkout fees can easily trick an agent into executing unauthorized transactions.

Relying on an LLM’s internal system prompt to police its own financial spending is inherently unsafe.We built PreTxSim-MCP to solve this exact problem: providing an air-gapped, sub-50ms pre-execution security firewall that evaluates state deltas and enforces hard user safety boundaries before any payment rails or tool calls can settle real funds.

What it doesPreTxSim-MCP is a self-hosted Model Context Protocol (MCP) server built in Rust. It exposes a spec-compliant Streamable HTTP transport layer (/mcp endpoint) that intercepts agent tool calls (such as agent_checkout) and runs them through a sequential 4-Layer Deterministic Validation Pipeline: Intent Guard (intent_guard): Compares the user’s original voice prompt against the merchant’s returned SKU metadata using substring/semantic distance checks to block prompt injections or category hijacking.

Price Oracle (price_oracle): Validates item unit prices against baseline market expectations to block merchant price-inflation anomalies (>100% markup spikes).State Ledger (state_ledger): Tracks rolling, session-wide spend across sequential multi-step tool calls to prevent agents from exceeding cumulative session budget caps.

Tax & Fee Surface (tax_surface): Calculates regional sales tax, VAT, and processing fees prior to checkout, blocking transactions if hidden fees push the total past authorized limits.If any layer fails, the server instantly short-circuits and returns a structured JSON verdict with a BLOCK verdict and a precise error code (INTENT_MISMATCH, PRICE_ANOMALY, SESSION_CAP, or TAX_OVERAGE).

How we built it Language & Core Safety Engine: Built in 100% memory-safe Rust for near-instantaneous (sub-50ms) validation.Protocol & Transport Layer: Built using the official rmcp 0.3 SDK with axum and tower-http to serve a spec-compliant Streamable HTTP MCP Server (spec 2025-11-25+) on 0.0.0.0:3000/mcp.Schema Generation: Utilized schemars and serde for automatic JSON-RPC tool input parameter schema generation.

Logging & Transport Integrity: Strict isolation of all application tracing to stderr to ensure zero log leakage onto stdout/HTTP stream channels, preserving transport frame integrity.Open Source Licensing: Distributed under the permissive MIT License.

Challenges we ran intoTransport Schema Alignment: Shifting from early stdin/stdout command-line adapters to a production-ready Streamable HTTP service that strictly meets the Model Context Protocol standards required by the Alexa+ track.Eliminating Floating-Point Inaccuracies: Designing an exact tax and session calculation engine in integer cents to eliminate floating-point precision drift during financial policy evaluations.

Zero-Trust Isolation: Guaranteeing that logging frameworks never write debug logs to HTTP body streams, preventing protocol framing corruption during real-time inspection.Accomplishments that we're proud ofSub-50ms Latency: Achieved deterministic, near-instantaneous validation that introduces zero human-perceptible delay into conversational voice UX.

Rigorously Tested Safety Engine: Comprehensive test coverage (9 passing unit tests) validating all four failure paths (INTENT_MISMATCH, PRICE_ANOMALY, SESSION_CAP, TAX_OVERAGE) and clean execution paths (ALLOW).

Deterministic Security Guarantee: Proved that agentic commerce guardrails can be enforced deterministically without relying on slow, expensive LLM self-reflection loops.

What we learned MCP is the Universal Interface: The Model Context Protocol provides an extraordinarily clean, decoupled abstraction layer for inserting security sidecars between AI reasoning engines and execution tools.Pre-Execution vs. Post-Execution: Intercepting intent before tool calls reach payment gateways is orders of magnitude safer and cheaper than attempting chargeback recovery after an agent makes a mistake. Integer Financial Arithmetic: Handling all monetary values strictly as 64-bit integer cents across rust structs avoids common serialization and rounding bugs in multi-region tax calculations.

What's next for PreTxSim Shopify & Web2 E-Commerce Plugins: Packaging the core Rust binary into pre-checkout webhook middleware for Shopify stores and Stripe payment flows.Dynamic Regional Tax APIs: Integrating live global VAT and cross-border tax rate webhooks for real-time international fee projection. Web3 & Agentic Payment Rails: Extending the state ledger to support micro-payment and verifiable intent standards (such as x402 and AP2) for decentralized AI shopping agents.

Built With

  • agentic-commerce
  • alexa-plus
  • axum
  • firewall
  • json-rpc
  • mcp
  • model-context-protocol
  • open-source
  • pre-execution
  • rmcp
  • rust
  • schemars
  • security
  • serde
  • streamable-http
  • tokio
  • voice-commerce
  • zero-trust
Share this project:

Updates

Submission history