[AGENT-GUARD] · MCP FIREWALL

Auths Agent Guard

Pre-Execution Spend Budget Caps & Kernel Capability Sandboxing

Pre-execution budget caps, time-to-live bounds, and OS kernel sandboxing for Model Context Protocol (MCP) servers. Refuses overspending before it happens and leaves signed audit receipts.

Read Documentation View on GitHub

[INTERACTIVE PROTOCOL FLOW]

Agent Guard Execution Gate

1. Agent Tool Call

tools/call (Est: $0.05)

Invoked

2. Auths Capability Gate

Cap<Scope> · TimedCap

Verified

3. OS Kernel Sandbox

Landlock LSM / WASI

Sandboxed

4. Signed DSSE Receipt

WASM Verifiable Log

Signed Receipt

1. Agent Tool Call — Detail

Agent requests tool execution with parameters and cost metadata.

NATIVE MACOS APP

Encrypted Touch ID Approvals via Murmur

When an AI agent requests an elevated spend or high-risk capability, it deposits a sealed challenge envelope at an encrypted zero-knowledge relay. You receive an instant Touch ID prompt on your Mac—no inbound open ports, no master keys exposed.

✓ Zero Knowledge✓ Signal Protocol Ratchet✓ Secure Enclave Bound

APPROVAL_FLOWZero-Knowledge Relay

01Agent deposits sealed envelope to mailbox

02Encrypted push sent to Murmur macOS app

03Maintainer approves via Touch ID assertion

04Agent drains signed proof & resumes execution

[CONFIGURATION & BOUNDS]

One-Line MCP Client Integration

Prepend auths wrap to any existing MCP server line in your client config. No toolchain or central server required.

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y", "@auths-dev/mcp", "wrap",
        "--scope", "paid.call",
        "--budget", "$50",
        "--ttl", "30m",
        "--", "npx", "-y", "@modelcontextprotocol/server-filesystem", "/workspace"
      ]
    }
  }
}

[SCOPE]

Capability Scope

Restricts tool calls to authorized functions (e.g. paid.call or fs.read). Prevents arbitrary command execution.

[BUDGET]

Spend Budget Cap

Enforces dollar spend caps ($50). Refuses tool invocation at protocol boundary before overspending happens.

[TTL]

Time-to-Live Bound

Hard time expiration (30m). Automatically invalidates agent session capabilities upon TTL expiration.

[RECEIPT]

Verifiable Spend Receipt

Emits signed DSSE spend receipts verifiable 100% offline via browser WebAssembly without cloud servers.