企业级AI代理与MCP在线防火墙、100探头红队套件和加密默克尔审计账本 保护自主人工智能代理免受间接提示注入、Unicode隐写术、SSRF/云元数据泄露、壳体逃逸和破坏性工具执行（2025/2026年度大型语言模型OWASP十大，欧盟人工智能法案第15条，SOC 2）。

---

⚡ 主要能力

• 内联MCP反向代理防火墙（tcha wrap）: 将标准模型上下文协议（MCP）服务器STDIO流包裹在透明、零延迟的防火墙中（$\le 2\text{ms}$开销）。用标准化JSON-RPC错误-32001阻断禁止操作。
• 自动100探针红队引擎（tcha audit）: 在4个核心向量（提示注入、SSRF退出、路径穿越、工具权限升级）发射100个分类对抗探针，并实现即时弹性评级（A+等级/100.0%）。
• 执行合规报告生成器（tcha report）: 生成包含加密默克尔根哈希、评分卡和合规交叉路口的自成一体、空气隔离的HTML/PDF审计证书（OWASP LLM Top 10，欧盟人工智能法案第15条，SOC 2 CC6.1，ISO 42001）。

🛡️ Tcha Protection

An in-line firewall that blocks prompt injection, SSRF, path traversal, and destructive tool calls for MCP and agent tools, with a built-in 100-probe self-test.

Tcha Protection runs as an in-line STDIO proxy firewall between your AI agent (Claude Code, Cursor, custom agents) and Model Context Protocol (MCP) servers. It intercepts and blocks SSRF egress to cloud metadata, stops path traversal before it touches the host filesystem, defuses indirect prompt injections, and pauses destructive tool calls for cryptographic Human-in-the-Loop (HITL) authorization. It also ships with a built-in 100-probe self-test benchmarking its own internal defense perimeter.

---

⚡ Headline Quickstart: In-Line Firewall

Wrap any standard MCP server command in a transparent, zero-trust proxy firewall:

npx tcha-protection wrap -- 

Example: Protecting the Official Filesystem MCP Server

npx tcha-protection wrap -- npx -y @modelcontextprotocol/server-filesystem ./workspace

When your agent invokes MCP tools:

• Safe calls (read_file, list_directory): Forwarded with minimal latency (about 0.7 ms median proxy overhead across scenarios (excludes URL arguments; N=100, local, Windows 8-core laptop)).
• Path traversal (../../etc/shadow): Blocked in-line with JSON-RPC error code -32001.
• SSRF egress (http://169.254.169.254): Intercepted before the request touches internal networks or cloud metadata.
• Destructive actions (delete_file, drop_table): Suspended pending HMAC-SHA256 human authorization token.
• Every event: Cryptographically logged to an append-only SQLite Merkle audit ledger under ~/.tcha/tcha_events.jsonl.

How to Authorize a Suspended Destructive Action (Out-of-Band HITL Flow)

When an agent invokes a destructive tool (e.g. delete_file, drop_table), Tcha Protection halts the call and emits an out-of-band authorization challenge:

{
  "jsonrpc": "2.0",
  "id": 4,
  "error": {
    "code": -32001,
    "message": "[Tcha Guard]: High-risk Tier 3 tool invocation suspended awaiting human authorization. Run 'tcha approve ch_a1b2c3d4' to authorize.",
    "data": {
      "threat_type": "UNAUTHORIZED_TIER3_ACTION",
      "rule_id": "SEC-HITL-003",
      "challengeId": "ch_a1b2c3d4",
      "toolName": "delete_file",
      "params": { "path": "./workspace/note.txt" },
      "expiresAt": 1729000300
    }
  }
}

Step 1: Human Out-of-Band Approval

A human operator in a separate terminal verifies the tool parameters and signs the authorization: