The gateway in front of every AI agent.
Agents act on instructions hidden inside the tools they call. Proxara inspects every tool call, description, and result, and stops the attack before it reaches the model or the wire.
Sits in front of every MCP host and agent
The inspection point in front of every tool call.
None of these attacks breaks encryption. None trips a DLP rule. Each turns a tool the agent already trusts into the exfiltration channel, and each meets a layer built to stop it.
Hidden instructions inside a tool description
The MCP spec puts no restriction on a tool’s description. The interface shows the short name; the model receives the whole description as trusted context and acts on it. Invariant Labs exfiltrated ~/.ssh/id_rsa through a poisoned add tool.
The research behind the threat
Designed for the realities of agentic AI.
The MCP ecosystem grew faster than its security did. Tool calling went mainstream in a year, and the threat research followed close behind.
Every JSON-RPC message crosses one pipeline
A reverse proxy between any MCP host and any downstream server. Nine stages run in fixed order on every tools/call, tools/list, and resources/read. Nothing crosses without passing through.
Reads the instructions, not just the actor
A Bedrock classifier scans every tool description and result before the model sees it. Authentication checks the actor; nothing else in the stack checks the instructions hidden in the tools the agent already trusts.
Sees the whole session, not one call
A per-session directed graph of every call matches read-then-exfil and leak-then-send shapes, with a 10-call baseline and 3σ deviation flags. The lethal trifecta is caught as a pattern, not a single request.
Secure.
Scalable.
Seamless.
Privately deployable: a single ~5 MB Rust binary that runs embedded, standalone on :8443, or hosted in your own VPC. Built like security tooling, not a wrapper.
Built for the hot path: a wait-free arc-swap configuration path keeps p99 added latency under 120 ms, inside Claude Desktop’s request budget even on tools/list.
Drops in with no agent changes: every MCP host — Claude Desktop, Cursor, Claude Code, Windsurf, ChatGPT Desktop, internal agents — is treated as just another JSON-RPC client. No per-host integration.
Part of one inspection layer.
The agent gateway is one surface Proxara governs. The rest of the firm runs through the same point.
Documented in the wild — what the field is reporting.
“The WhatsApp exfiltration ran over WhatsApp’s own encrypted infrastructure. End-to-end encryption was never broken, and DLP saw normal traffic.”
The confidence you need to put AI to work without risk.
Tell us what your firm is up against with agents and MCP, and our team will reply in a few hours.
Book a call