ResolveGuard
Complete mediation Instrumented client only

MCP invocation firewall · synthetic attack lab

Keep the work.
Stop the boundary crossing.

Resolve checks identity, origin, server, credential audience, tool drift, arguments, provenance, destination, and effect at invocation time—before a routed action can escape its intended boundary.

12ordered checks
0external requests
1×maximum side effect
Invocation trace
Honest boundary

Resolve protects calls routed through this gateway. It does not claim to secure bypassed clients, a compromised browser or operating system, or every future attack.

Gateway-authored approval

Approve this exact invocation?

This text comes from Resolve policy—not the page, agent, tool description, or tool result.

Single use · short lived · any bound-field change invalidates approval

Metadata only

Redacted audit trail

Decisions, hashes, and outcomes remain. Raw documents, prompts, tool descriptions, arguments, and credentials do not.

Reference monitor, not magic

Where Resolve draws the line

01

Mixed context enters

User intent, page text, tool metadata, and results keep explicit provenance.

02

Authority is rebuilt

Identity, origin, audience, scopes, pins, arguments, destination, and data flow are checked in order.

03

Consequence stays visible

Safe local work moves. Blocks stop. Review creates one exact human approval.

04

Evidence survives safely

Replay-safe outcomes and redacted hashes remain without creating a second leak through logs.

Outside this proof

Unrouted calls, compromised or UI-automation-capable hosts, cryptographic proof of physical human presence, real OAuth brokerage, arbitrary remote servers, and universal semantic attack detection.

Synthetic lab

Reset every decision?

This clears decisions, approvals, operations, notes, outbox entries, and audit events, then restores the pinned catalog.