Aletheia MCP is a Model Context Protocol (MCP) server that acts as a sub-millisecond runtime safety filter for AI agent tool calls, intercepting them before the agent executes the tool call. It targets Claude Code, Claude Desktop, and other MCP-compatible agents, intercepting destructive, credential-stealing, SSRF, and privilege-escalation operations in a deterministic manner with no large language model in the hot path. Its motivation comes from the classification of nine behavioral signatures in the Aletheia research paper, and the server focuses on two of them: S3 (Scope Creep Beyond Mandate) and S2b (prompt injection issues related to jailbreak vulnerability).
Purpose and positioning: When autonomous agents are granted tool execution permissions (Bash, SQL, filesystem modification, API calls), the primary failure mode is scope creep beyond mandate. Aletheia MCP serves as a fast first-line pre-execution filter that identifies known patterns of destruction, exfiltration, SSRF, and privilege escalation before the call executes, with overhead ranging from single-digit to low tens of microseconds. It is explicitly not a sandbox, not a formal guarantee, and cannot replace least-privilege credentials, non-root system users, scope-limited database grants, or container/VM-level isolation (Docker, gVisor, Firecracker). Its design intent is to serve as a layer of protection that cheaply removes common failure modes, used in combination with OS/network-level sandboxes rather than replacing them.
Main capabilities: Intercepting destructive shell changes (such as git reset --hard, rm -rf ); blocking credential collection (~/.ssh/id_rsa, .env, AWS credentials); blocking unbounded database writes (DELETE, UPDATE without a WHERE predicate, or with the always-true predicate WHERE 1=1); blocking interpreter escapes (python3 -c "os.system(...)", node -e "fs.rmSync('/')"); defending against SSRF and cloud metadata leakage (169.254.169.254, RFC1918 internal networks); blocking self-authorization escalation. Specific technical capabilities include: database and OS file primitive interception (PostgreSQL COPY ... PROGRAM, pg_read_file(), lo_import(); MySQL LOAD DATA INFILE, INTO OUTFILE; SQLite ATTACH DATABASE; SQL Server xp_cmdshell); SSRF defense for protocol-less and malformed URLs (normalizing 169.254.169.254/latest etc., strictly failing closed on invalid URLs); direct Shell metadata and network tool neutralization (scanning for direct IPs in curl/wget, blocking socat raw socket exfiltration); wildcard credentials and sensitive directory boundaries (covering .env. variants and ~/.kube/, ~/.docker/, ~/.gnupg/, .git-credentials); linear O(N) normalization, token-based non-backtracking brace expansion, remaining sub-millisecond on 100KB+ payloads; Bash socket pseudo-device interception (/dev/tcp/HOST/PORT, /dev/udp/HOST/PORT); SQL CTE and procedural block interception (WITH ... DELETE, DO $$ ... $$); dynamic linker hijacking defense (LD_PRELOAD, DYLD_INSERT_LIBRARIES); quote and backslash stripping, variable indirection and default fallback resolution, positional parameter and IFS normalization, dual-representation SQL analysis (inline comment evasion), interpreter escape interception (string concatenation, dynamic imports, -c/-e/-r flag parsing), automatic hex and Base64 decoding, Unicode NFKC and zero-width character cleanup, IPv4-mapped IPv6 SSRF conversion, percent-encoded path traversal multi-pass decoding, generic fork bomb detection, SetUID privilege escalation interception, tautological SQL predicate markers, polymorphic parameter inspection (failing closed for both native and unknown third-party tools).
Usage: two operating modes are provided. First, direct protection tools, including the standalone tools aletheia_set_mandate, aletheia_intercept, aletheia_safe_bash, aletheia_safe_sql. Second, fail-closed transparent proxy middleware that can wrap any downstream MCP server (such as Postgres, Filesystem, Bash) while intercepting both individual tools/call and JSON-RPC 2.0 batch arrays. Monotonic authorization escalation protection must be observed: agents may voluntarily tighten authorization, but loosening authorization requires operatorSecret. Observability resources expose real-time audit logs, interception rates, and latency distributions via aletheia://telemetry/summary. The project declares zero external API calls and zero LLM-as-a-judge latency on the hot execution path.
Performance and implementation: benchmarks are based on 10,000 consecutive multi-domain evaluations (Bash deobfuscation, SQL pattern validation, path validation, SSRF checks, prompt injection); p50 is stable across runs, while p99 varies with system load (observed range roughly 24–70 microseconds), still within the sub-millisecond target. It can be run locally via npm run benchmark; the specific microsecond figures should be regarded as an indication of "comfortably sub-millisecond" rather than a precise SLA. The key to achieving sub-microsecond overhead is that there is no LLM on the hot path, regular expressions are precompiled once at module load, inputs are short and operations are linear, dispatch executes only the checks for the relevant domain rather than all checks, and the audit log and latency history buffers are fixed-size (500 and 2,000 entries respectively) and use O(1) amortized operations. The figure of about 25 microseconds refers only to the in-process evaluation function itself and does not include JSON-RPC serialization or stdio pipe I/O in a real MCP session.
Applicable scenarios and limitations: suitable for providing fast pre-execution guardrails for MCP-compatible agents and intercepting common destructive and exfiltration patterns. Limitations include: detection is based on enumeration of known dangerous functions, flags, and syntactic shapes, so similar or novel variants not yet added to the pattern set will not be caught; no DNS resolution is performed, so SSRF protection is limited to literal IPs/hostnames in the request text, and the actual resolution result of a domain name is beyond the capability of this layer; prompt injection detection is keyword and pattern matching, not a semantic classifier, and can be bypassed by novel wording; this is a single, continuously iterating implementation that has not yet undergone independent third-party adversarial review. For any Turing-complete shell, pattern filtering can in theory always find novel or obfuscated constructs not yet covered by the current pattern set; this is an inherent property rather than a flaw that a future patch can completely close. The correct way to use it is to treat Aletheia as a layer of protection that cheaply removes common failure modes, combined with OS/network-level sandboxing, with the latter serving as the true security boundary.
