Resolve Guard

A deterministic invocation-time policy gateway that makes routed MCP/WebMCP authority visible, blockable, exactly approvable, and replay-safe.

Comment

Problem

Browser agents can combine a person's intent, page content, tool metadata, tool results, credentials, and remembered context inside one decision loop. The individual pieces may look harmless, while the composed action quietly moves protected data to another origin, invokes a changed tool, presents a credential to the wrong resource, or turns a vague confirmation into a consequential side effect.

Prompt-injection classification alone cannot reconstruct the authority that was lost. Advanced users and agent developers need one visible enforcement point that evaluates the actual invocation at the moment it would run.

Solution

Resolve Guard is an invocation-time security gateway and synthetic attack lab for one instrumented MCP/WebMCP client. Every protected call is normalized into an action envelope and evaluated by twelve deterministic checks: actor and client identity, browser origin, pinned MCP server, credential audience, least scopes, tool-manifest pin, schema pin, exact arguments, canonical destination, capability class, data-flow policy, and effect policy.

The result is one of three explicit outcomes:

  • Allow: bounded local work proceeds automatically.
  • Block: a failed invariant stops execution and cannot be overridden by approval.
  • Review: a policy-valid consequential action stops at a trusted, exact human approval surface.

An approval is short-lived and bound to one normalized invocation, including its actor, client, origin, server, tool, effect, destination, data labels, argument digest, policy version, and expiry. Execution is at-most-once; replay returns the original operation instead of creating a second effect. The audit trail records correlated identifiers, decisions, and digests without raw protected content or credentials.

Why This Matters

WebMCP makes websites meaningfully agent-native: an agent can discover and invoke structured capabilities instead of guessing through a visual interface. That also creates composed authority across the person, browser, page, agent, MCP client, MCP server, credential, tool, and destination.

Resolve Guard uses WebMCP to make that composition inspectable and enforceable. The agent can discover the security lab, inspect policy, run preflights, explain failures, and synchronize results into the same visual surface the person sees. The person retains the only approval surface for consequential work. Together they can investigate unsafe actions quickly without giving the agent a protocol tool that approves its own request.

This proof of concept deliberately makes a narrow claim: it protects calls routed through one instrumented gateway. It does not claim to secure bypassed calls, compromised browsers or operating systems, dishonest providers after an allowed call leaves the boundary, or every future attack.

How We Used AI

The application itself demonstrates structured human-agent collaboration through imperative WebMCP tools. A WebMCP-capable agent can:

  1. list the seven deterministic attack scenarios;
  2. inspect the gateway policy and coverage boundary;
  3. run a scenario preflight;
  4. retrieve a redacted decision; and
  5. inspect the metadata-only audit trail.

The agent cannot approve or execute a review decision through MCP or WebMCP. That omission is intentional: useful analysis remains agent-accessible, while the consequential boundary remains visible and human-controlled.

All demo identities, documents, credentials, destinations, and effects are synthetic. Resolve Guard itself calls no external provider and uses no production credential.

How We Used Codex

Codex helped turn the participant-directed security concept into a scoped proof of concept, threat model, policy engine, REST/MCP/WebMCP surfaces, adversarial scenarios, responsive attack-lab interface, tests, browser verification, and documentation.

The process included an explicit product pivot: an earlier seller-operations concept was discarded after the participant clarified that the real goal was to restore disappearing security boundaries between people, browser agents, MCP clients, servers, tools, credentials, and side effects. Codex rebuilt the project around that corrected outcome rather than rewording the obsolete implementation.

Codex also ran a real native WebMCP session in the in-app browser. That run exposed a runtime boundary gap: the browser surfaced additionalProperties: false to the agent but did not enforce it before calling the page handler. A regression test locked the defect, the page execution boundary was hardened with independent exact-key validation, and the invalid call was re-run with zero audit or operation side effects. The final automated suite passes 31 tests.

Key Features

  • Seven deterministic proof scenarios covering safe local work, injected exfiltration, parameter smuggling, destination confusion, tool drift, credential-audience mismatch, and exact approval/replay.
  • Twelve ordered, explainable invocation checks with stable allow/block/review reason codes.
  • Five same-origin imperative WebMCP tools registered with document.modelContext.registerTool().
  • Strict runtime validation in every page-defined tool before API I/O or UI mutation.
  • Independent tool-manifest and input-schema pins.
  • Default-deny protected-data egress and canonical exact-destination enforcement.
  • Exact, short-lived, single-use, UI-only human approval.
  • At-most-once sandbox execution with idempotent replay.
  • Metadata-only correlated audit with canary-backed redaction tests.
  • Dependency-free Node.js 22 implementation, responsive keyboard-accessible UI, local MCP HTTP/stdio transport, and a sealed synthetic public-demo mode.

Architecture

One in-memory domain service backs the visible browser UI, REST endpoints, MCP over HTTP/stdio, and imperative WebMCP tools, so every surface shares the same decision semantics.

user goal + page/tool/result content
             | mixed trust with provenance
             v
instrumented browser agent / MCP client
             | every protected invocation
             v
Resolve Guard enforcement point
  normalize -> authenticate -> authorize -> data-flow check
                | allow    | block    | exact review
                v          X          v
        pinned sandbox tool     visible approval surface
                |                         |
                +------ execute once <----+

The public demo is deliberately sealed: fixed fake identities, synthetic source data, in-memory effects, no credentials, and no outbound server request.

Testing Instructions

Public judge flow

  1. Open https://resolve-guard.vercel.app in ChatGPT's WebMCP-capable in-app browser, or Google Chrome 149+ with chrome://flags/#enable-webmcp-testing enabled and the browser restarted.
  2. Confirm the header reports five registered WebMCP tools.
  3. Run Safe local summary. Expect allow / LOCAL_FLOW_ALLOWED and one bounded synthetic operation.
  4. Run Injected exfiltration. Expect block / DATA_EGRESS_DENIED and no operation.
  5. Run Hidden callback parameter. Expect block / UNKNOWN_ARGUMENT.
  6. Run Publish sanitized status. Expect review / HUMAN_APPROVAL_REQUIRED and no operation before approval.
  7. Open the exact approval, enter the visible confirmation, execute, then replay. Expect the same operation to be returned and no second effect.
  8. Open the audit trail. Confirm it contains decision/approval/operation metadata and digests, not raw protected content or credentials.

Suggested agent prompts

  1. “List the Resolve Guard security scenarios and state its coverage boundary.”
  2. “Run the injected exfiltration preflight and explain why it cannot execute.”
  3. “Run the sanitized publish preflight.”
  4. Confirm the agent stops at HUMAN_APPROVAL_REQUIRED and exposes no approval or execution tool.

Local verification

npm start
npm run verify

Requirements: Node.js 22.14 or newer. There are no package dependencies and no credentials to configure.

Public Demo Link

https://resolve-guard.vercel.app

Public Repository Link

https://github.com/VIVEHACKER/resolve-guard

The repository is public, includes the complete MIT license at the root, and contains all source, assets, run instructions, tests, and WebMCP registration code. Anonymous HTTPS clone, raw-file access, the public main branch, WebMCP registration code, and GitHub's MIT license detection were verified after publication.

Demo Video

Public YouTube video: https://youtu.be/8uttf0gkMqE

  • Visibility independently verified as Public.
  • Duration: 2:30, below the three-minute limit.
  • 1080p H.264 video with English AAC narration.
  • Custom thumbnail and published English captions.
  • Anonymous playback and audible playback were verified.

The video is an uninterrupted, mouse-driven walkthrough of the real visual lab backed by the same policy engine. It shows the page reporting five registered native WebMCP tools and demonstrates allow, block, review, exact approval, at-most-once execution, replay, schema-smuggling rejection, audit evidence, and the honest protection boundary. It does not depict an agent clicking the native WebMCP tool handle on screen; the separate native-agent execution evidence and reproduction prompts are included in the repository.

Known Limitations

  • Resolve protects only calls routed through this instrumented gateway; bypassed calls are outside its coverage.
  • The proof of concept does not protect a compromised browser, operating system, client, gateway process, or dishonest provider after an allowed call leaves the boundary.
  • It is not a production OAuth server, credential broker, durable multi-tenant service, compliance product, or universal prompt-injection detector.
  • Identity headers, source data, credentials, destinations, and side effects are synthetic.
  • Storage and effects are in memory and reset with the process.
  • The mouse-driven public video demonstrates the real UI and shared engine; native WebMCP agent invocation is documented and reproducible but is not shown as an agent transcript inside the video.
  • Cross-client compatibility beyond the verified Codex in-app browser is not claimed.

Built With

Share this project:

Updates

Submission history