Docs

MCP Fusion/Security and governance/Security pipeline

Security pipeline

Ask AI about Vinkius

Every layer between an agent and your data, in order: input firewall, strict validation, tenant middleware, Presenters, the redaction engine, the egress limiter, the prompt firewall and the sandbox.

MCP Fusion enforces security as a pipeline of layers, each with a clear position in the request. This page is the technical map: what runs, in what order, with what guarantees.

The order, end to end

1 contextFactory      tenant and identity resolution
2 rate limiter        sliding window, key from ctx
3 input firewall      LLM-as-Judge on the arguments
4 validate            strict Zod per action, unknown keys rejected
5 middleware chain    auth, audit, custom, precompiled and frozen
6 handler             your business logic
7 Presenter           schema shape → _select → redact → serialize
8 rules and UI        computed on the full object, never on the wire copy
9 egress guard        byte budget on the text response
10 audit + telemetry  every stage emits if a sink is configured

Layer by layer

Rate limiter

rateLimit({ windowMs, limit, keyFn }) is a middleware using a sliding window over timestamp lists. Two calls matter: increment() counts without recording, and record() only logs accepted requests, so rejected traffic cannot inflate its own window. keyFn(ctx) is the identity hook: rate-limit per token, per tenant or per user. Store is an interface; the in-memory store is documented as single-process only, production uses your Redis or KV behind the same interface.

Input firewall

inputFirewall({ judge }) runs after Zod validation, before your handler. The arguments are serialized into a judge prompt (backticks neutralized to prevent fence escape) and a pluggable SemanticProbeAdapter returns { safe, threats }. On !safe the handler is never called: the response is a self-healing toolError('INPUT_REJECTED', ...). This layer is for injection-shaped inputs: "ignore previous instructions", exfiltration payloads, smuggled file paths.

Presenter redaction (the egress firewall)

.redactPII(paths, censor?) compiles fast-redact paths into one function, cached on the Presenter. The pipeline order inside Presenter.make() is precise: truncate, validate, apply _select, clone the wire data, mask, stringify it, then render UI blocks and rules from the full unmasked object. Consequences:

  • the model text never contains masked fields; [REDACTED] is not even on the wire for _select-hidden keys
  • ui.table() blocks keep real values (they are built from the full object in memory, and the wire text is already frozen)
  • if structuredClone or the redactor throws, the pipeline throws too: Data withheld to prevent PII leak. Redaction is fail-closed at that point.

fast-redact is an optional peer. If it is not installed the redactor degrades to a no-op with a console warning. Treat it as a required dependency for connectors that hold personal data.

Prompt firewall

The rules themselves are attack surface: dynamic rules are generated from data, and data comes from the agent's world. presenter.promptFirewall({ judge }) sends the accumulated system rules to a judge before any of them reach the model. Strategy is fail-closed and per rule: if the judge flags the batch but names some rules, the unnamed ones are blocked too. Consensus mode (all judges agree) has no fail-open. Configuring a firewall forces the async path: make() throws, makeAsync() is the contract.

Sandbox

sandboxed() on a tool advertises computation delegation: the agent sends a JS arrow function, SandboxEngine runs it inside a fresh isolated-vm context with the data injected as an external copy, and only the returned value comes back. Defaults: 5s timeout, 128MB isolate, 1MB output cap, 64KB code cap. process, require, fs, globalThis and Buffer do not exist inside the context; the guard that rejects obvious patterns is DX only and explicitly not the boundary. On cancellation the engine disposes the isolate (or releases just the context when other requests share it) and recreates on the next call.

Kill switch and halt

The emergency stop lives in the console, see Connector policy: the global halt and per-connector policy. On the Edge, halted connectors stop serving calls without a redeploy.

What the framework does not do

Honesty over marketing: the framework's audit middleware emits events to your sink (SHA-256 argument digests, status classification, no signing, no chain). The tamper-proof signed audit chain is a Vinkius Cloud hosting feature: deploy with mcpfusion deploy and the platform records it for you. The same split applies to rate-limit stores: the interface is yours, the Edge runs it.

Next steps