tchapwo1/tcha
Developer toolsこのページは AI により自動翻訳されています。技術的な詳細は原文をご確認ください。 原文を見る
Tcha Protection Pro 2.0 — In-line zero-latency MCP security firewall and 100-probe red-teaming suite for autonomous AI agents
概要
Protects autonomous AI agents against Indirect Prompt Injection, Unicode Steganography, SSRF / Cloud Metadata Exfiltration, Shell Escapes, and Destructive Tool Execution (OWASP Top 10 for LLMs 2025/2026, EU AI Act Article 15, SOC 2). - Wraps standard Model Context Protocol (MCP) server STDIO streams in a transparent, zero-latency firewall ($\le 2\text{ms}$ overhead). Blocks forbidden operations with standardized JSON-RPC error -32001. - Fires 100 categorized adversarial probes across 4 core vectors (Prompt Injection, SSRF Egress, Path Traversal, Tool Privilege Escalation) with instant resilience grading (A+ Tier / 100.0%). - Generates self-contained, air-gapped HTML/PDF audit certificates containing the cryptographic Merkle root hash, scorecard, and compliance crosswalk (OWASP LLM Top 10, EU AI Act Art. 15, SOC 2 CC6.1, ISO 42001). - Detects and neutralizes zero-width unicode steganography (\u200B, \uFEFF, etc.
README
以下は原文 README の抜粋です。原文を見る。
🛡️ Tcha Protection
An in-line firewall that blocks prompt injection, SSRF, path traversal, and destructive tool calls for MCP and agent tools, with a built-in 100-probe self-test.
-blue){kind=icon}
Tcha Protection runs as an in-line STDIO proxy firewall between your AI agent (Claude Code, Cursor, custom agents) and Model Context Protocol (MCP) servers. It intercepts and blocks SSRF egress to cloud metadata, stops path traversal before it touches the host filesystem, defuses indirect prompt injections, and pauses destructive tool calls for cryptographic Human-in-the-Loop (HITL) authorization. It also ships with a built-in 100-probe self-test benchmarking its own internal defense perimeter.
⚡ Headline Quickstart: In-Line Firewall
Wrap any standard MCP server command in a transparent, zero-trust proxy firewall:
npx tcha-protection wrap --
Example: Protecting the Official Filesystem MCP Server
npx tcha-protection wrap -- npx -y @modelcontextprotocol/server-filesystem ./workspace
When your agent invokes MCP tools:
- Safe calls (
read_file,list_directory): Forwarded with minimal latency (about 0.7 ms median proxy overhead across scenarios (excludes URL arguments; N=100, local, Windows 8-core laptop)). - Path traversal (
../../etc/shadow): Blocked in-line with JSON-RPC error code-32001. - SSRF egress (
http://169.254.169.254): Intercepted before the request touches internal networks or cloud metadata. - Destructive actions (
delete_file,drop_table): Suspended pending HMAC-SHA256 human authorization token. - Every event: Cryptographically logged to an append-only SQLite Merkle audit ledger under
~/.tcha/tcha_events.jsonl.
How to Authorize a Suspended Destructive Action (Out-of-Band HITL Flow)
When an agent invokes a destructive tool (e.g. delete_file, drop_table), Tcha Protection halts the call and emits an out-of-band authorization challenge:
{
"jsonrpc": "2.0",
"id": 4,
"error": {
"code": -32001,
"message": "[Tcha Guard]: High-risk Tier 3 tool invocation suspended awaiting human authorization. Run 'tcha approve ch_a1b2c3d4' to authorize.",
"data": {
"threat_type": "UNAUTHORIZED_TIER3_ACTION",
"rule_id": "SEC-HITL-003",
"challengeId": "ch_a1b2c3d4",
"toolName": "delete_file",
"params": { "path": "./workspace/note.txt" },
"expiresAt": 1729000300
}
}
}
Step 1: Human Out-of-Band Approval
A human operator in a separate terminal verifies the tool parameters and signs the authorization:
インストール
npx tcha-protection wrap -- <mcp command>