Agent Monitor — Local Security Boundary for AI Agents & MCP

Agent Monitor is a zero-trust, local-first security platform for autonomous AI agents and Model Context Protocol (MCP) clients. It sits between the agent and its tools as a transparent policy gate: every tool call is intercepted, evaluated by deterministic rules, and either allowed, blocked, or paused for a human — before anything executes.

It lets developers give agents real capabilities (file writes, shell commands, network access) while keeping full visibility, rate limits, secret redaction and a tamper-evident record of everything the agent did.

Coding agents and MCP servers run with the same privileges as the developer. A single prompt injection hidden in a README or web page can make an agent read .env files, push code, or send data to an external server. Most agent runtimes log after the fact; they don't stop the action.

MCP adds a second risk: tools are discovered at runtime, so a server can change a tool's schema or behaviour after it has been trusted (a 'rug-pull').

1. Payload bounds — oversized frames (10MB) and arguments (1MB) are rejected. 2. Kill switch — an authoritative flag in SQLite that halts everything instantly. 3. Source quarantine — calls from a quarantined MCP server are blocked, and quarantine survives restarts. 4. Rate limiting — a sliding window stops command floods.

5. Normalization — raw MCP calls, shell commands and resource URIs are mapped to typed canonical actions, with RFC 8089 file-URI handling. 6. Workspace guardrails — path traversal, symlink escapes, null bytes, multi-layer URL encoding, Unicode tricks and Windows/UNC escapes are all contained. 7. Risk assessment — a 0–100 score from CWE-mapped rules, plus a check that the tool's schema fingerprint hasn't changed.

8. Policy evaluation — versioned policies with additive specificity; when rules conflict, DENY beats ASK beats ALLOW. 9. Human approval for ASK, from the terminal or web dashboard. 10. Post-approval revalidation — the approved action's context hash, expiry, active policy version, kill switch and quarantine are all checked again.

11. Execution with a bounded timeout. 12. Result inspection — API keys, AWS credentials, JWTs and private keys are replaced with [REDACTED:<type>], and responses over 500KB are truncated. 13. Persistence to SQLite with SHA-256 hash chaining. 14. Automatic incident creation for critical violations, and live dispatch to connected clients.

Deterministic, not probabilistic. Using an LLM to judge whether an LLM's action is safe just moves the prompt-injection problem one level up. The policy engine is synchronous, rule-based code with no model calls, so the same input always produces the same decision — and every decision comes with an explainable risk breakdown.

Local-first storage. Security tooling that requires a cloud account or a database server doesn't get installed. SQLite in WAL mode gives a single-file store with concurrent reads, a 5s busy timeout, and transactional migrations. Approvals are resolved with a conditional UPDATE (… WHERE status = 'pending'), so only one resolver can ever win — no race conditions between terminal and web.

Tamper-evident audit. Each event stores the hash of the previous event. JSON is canonicalized (sorted keys) before hashing so the same event always hashes the same way. 'agent-monitor audit verify' walks the chain and reports any break.

Two entry points, one invariant. The MCP gateway protects third-party agents without touching their code; the in-process interceptor protects agents built on Agent Monitor's own runtime. Both run the same 14-stage pipeline from a dependency-free core package.

A TypeScript monorepo with six packages: core (pure domain logic — normalizer, risk and policy engines, sequence engine, fingerprinting, hash chaining, secret redaction; zero external dependencies), server (SQLite persistence, migrations, kill switch, incidents, event bus and SSE), agent (guardrails, safe tools, interceptor, approval manager and a reference DeepSeek coding agent), gateway (the MCP stdio proxy), cli, and web (the Next.js dashboard).