LeoForge

Autonomous AI agents powered by the Model Context Protocol (MCP) and tool-calling LLMs suffer from a critical vulnerability: the conflation of untrusted external data with trusted control instructions. Indirect prompt injection attacks embedded inside inbound emails, webhooks, or documents can easily hijack model intent to exfiltrate classified secrets or execute unauthorized tool calls. Gauntlet-MCP solves this by introducing an action-centric security gateway built on the core axiom: "The Model Proposes; Deterministic Code Disposes." Instead of relying on brittle, probabilistic prompt guardrails, Gauntlet-MCP intercepts all proposed MCP tool calls with a sub-4ms, 5-layer deterministic Policy Enforcement Point (@pep_shield): MCP Protocol Integrity: Cryptographic SHA-256 tool schema & docstring pinning to prevent runtime Tool Poisoning and Rug Pulls. Dynamic Taint Tracking: Information Flow Control lattice preventing Confused Deputy cross-tool pivoting. Multi-Spectrum 9-Pass DLP: Recursively de-obfuscates and scans outbound arguments across Raw, Reversed, Base64/32, Hex, ROT13/Caesar, Delimiter-Split (C-A-N-A-R-Y), and Unicode Zero-Width Steganography/Homoglyphs. RFC-5322 Recipient & Egress Allowlisting: Defeats display-name spoofing and multi-recipient smuggling. Context-Isolated Execution Sandbox: Coroutine-safe in-memory virtual enterprise workspace. In our evaluation harness across 12 adversarial and benign enterprise scenarios, Gauntlet-MCP eliminates the Attack Success Rate (ASR) from 100% down to 0.0% while preserving 100% Benign Utility (0% False Positives) with <3.5ms latency overhead. Includes a FastAPI control plane and an interactive dark-mode Cyber Defense Command Center dashboard.