mastyf.ai

Mastyf.ai is an open-source AI security platform that provides boundary protection for LLMs and AI agents. Its core positioning is to protect the "action boundary", not just prompts. AI agents can autonomously read files, push code, query databases, execute shell commands, and call external APIs. In this process, Mastyf.ai acts as a local reference monitor and security gateway: the LLM proposes actions, and Mastyf decides whether these actions can reach the real world.

Main capabilities

1. Security gateway and protected agents: intercepts every tool call, evaluates it against security policies through multi-agent swarm analysis, and blocks malicious or unauthorized operations before execution. All decisions are mandatorily logged and kept auditable.
2. Three-layer execution mechanism: the first layer is regex-based pattern detection, scanning for injection, dangerous paths, leaked secrets, shell commands, and encoding techniques, running at microsecond level with no external dependencies; the second layer is schema validation, rejecting malformed payloads, oversized parameters, and JSON-RPC violations; the third layer is semantic review, optionally using a local LLM (Ollama) or cloud model to evaluate boundary calls that pass schema checks, falling back to heuristics when no model is configured. Any call that fails checks is blocked, and the tool is never executed.
3. Policies and enforcement modes: rules are located in default-policy.yaml, owned by the user and enforced by Mastyf. Three enforcement modes are provided to support safe rollout, and preset templates such as HIPAA, PCI-DSS, GxP, and data residency are provided in policy-templates/.
4. Dual swarm and adversarial testing: CI Swarm attacks policies before code release, while Runtime Swarm enforces and learns from every live tool call in production. Four feedback loops connect the two, making the system harder to bypass over time. The specification gate reaches 228/228 corpus, 0 bypasses, 100% consistency, and runs on every PR and nightly.
5. Transport support: the proxy supports five transport methods—stdio, HTTP, SSE, streamable HTTP, and WebSocket.
6. Threat lab: monitors live traffic and uses a local LLM to propose new attack test cases when suspicious patterns are detected. They are not applied automatically; all suggestions must be reviewed and approved in the dashboard before becoming rules; approved findings are fed back into the CI attack corpus for continuous regression testing.
7. MCP package trust scoring: before installing any MCP server from npm, you can check its trust score at https://www.mastyf.ai/certified . The score covers CVE exposure, name-squatting risk, maintainer signals, and known attack patterns. Free, no account required.

Usage You can quickly get started with Python to run the local reference monitor, MCP discovery, and protected agent runtime; you can also build from the TypeScript/cloud platform source. In the quick start, the first run automatically discovers local MCP servers/tools, prompts the user in plain English to enter expected permissions, shows a conservative diff comparison, and activates the policy after confirmation. Every tool proposal from a conversational agent is intercepted by the reference monitor, and non-ALLOW actions dispatch strict 0 bytes to the tool backend. The runtime includes a live security HUD and an encrypted receipt audit chain (mastyf audit verify).

On Linux, the installation script automatically performs the following steps: install Nix (if needed), enable Nix flakes, create the development environment, install all project dependencies, rebuild native packages, build the entire project, and add a convenient mastyf shell alias. After installation is complete, you can start the proxy and dashboard, and the dashboard address is http://localhost:4000。仪表盘默认开启鉴权（包括回环地址），启动脚本会生成 $MASTYF_HOME/dashboard_api_key and never print it; DASHBOARD_AUTH_DISABLED=true may be set only in explicit local test isolation scenarios, and that combination will be rejected on any non-loopback binding.

Applicable scenarios and deployment It is suitable for individual developers and enterprise teams that want to add security protection for the AI agent and MCP ecosystem. Enterprise deployments can combine Redis, Postgres, and Kubernetes; see the documentation docs/ENTERPRISE_DEPLOYMENT.md. Mastyf has also been validated and deployed as a native CONTENT_AUTHZ service extension for Google Cloud Agent Gateway (us-central1), with distributed Redis state, sub-second fail-closed enforcement, and real-time BigQuery audit logs; see the Google Agent Gateway Runbook.

Research citation If Mastyf Guard, its benchmarking methodology, or Cognitive Harvard Architecture is used in research or production systems, its open-access publication can be cited: Das, R. (2026). Cognitive Harvard Architectures for AI Agent Perimeter Defense: Resolving the Confused Deputy Problem in Model Context Protocol via Capability-Based Access Control. Zenodo. doi: 10.5281/zenodo.22179415.

Limitations The current material does not provide details on fees, pricing, platform support scope, performance latency metrics, or specific available features beyond those mentioned, and no further information is currently provided.