🛡️ Tcha Protection

An in-line firewall that blocks prompt injection, SSRF, path traversal, and destructive tool calls for MCP and agent tools, with a built-in 100-probe self-test.

Tcha Protection runs as an in-line STDIO proxy firewall between your AI agent (Claude Code, Cursor, custom agents) and Model Context Protocol (MCP) servers. It intercepts and blocks SSRF egress to cloud metadata, stops path traversal before it touches the host filesystem, defuses indirect prompt injections, and pauses destructive tool calls for cryptographic Human-in-the-Loop (HITL) authorization. It also ships with a built-in 100-probe self-test benchmarking its own internal defense perimeter.

---

⚡ Headline Quickstart: In-Line Firewall

Wrap any standard MCP server command in a transparent, zero-trust proxy firewall:

npx tcha-protection wrap -- 

Example: Protecting the Official Filesystem MCP Server

npx tcha-protection wrap -- npx -y @modelcontextprotocol/server-filesystem ./workspace

When your agent invokes MCP tools:

• Safe calls (read_file, list_directory): Forwarded with minimal latency (about 0.7 ms median proxy overhead across scenarios (excludes URL arguments; N=100, local, Windows 8-core laptop)).
• Path traversal (../../etc/shadow): Blocked in-line with JSON-RPC error code -32001.
• SSRF egress (http://169.254.169.254): Intercepted before the request touches internal networks or cloud metadata.
• Destructive actions (delete_file, drop_table): Suspended pending HMAC-SHA256 human authorization token.
• Every event: Cryptographically logged to an append-only SQLite Merkle audit ledger under ~/.tcha/tcha_events.jsonl.

How to Authorize a Suspended Destructive Action (Out-of-Band HITL Flow)

When an agent invokes a destructive tool (e.g. delete_file, drop_table), Tcha Protection halts the call and emits an out-of-band authorization challenge:

{
  "jsonrpc": "2.0",
  "id": 4,
  "error": {
    "code": -32001,
    "message": "[Tcha Guard]: High-risk Tier 3 tool invocation suspended awaiting human authorization. Run 'tcha approve ch_a1b2c3d4' to authorize.",
    "data": {
      "threat_type": "UNAUTHORIZED_TIER3_ACTION",
      "rule_id": "SEC-HITL-003",
      "challengeId": "ch_a1b2c3d4",
      "toolName": "delete_file",
      "params": { "path": "./workspace/note.txt" },
      "expiresAt": 1729000300
    }
  }
}

Step 1: Human Out-of-Band Approval

A human operator in a separate terminal verifies the tool parameters and signs the authorization: