v1.3.0 — 22/22 tests passing

The only MCP security proxy with
end-to-end cryptographic attestation

Every tool call an AI agent makes is intercepted, verified, bound to its exact arguments and response, and signed with an Ed25519 receipt. Not a black-box filter — an auditable, non-repudiable checkpoint.

$npx ccs-lint --demo
7KB security linter for MCP JSON-RPC. Catches nested receipt field injection. Zero dependencies. npm →
22/22
Tests passing
3
Enforcement layers
97ms
P50 deny latency
0
Runtime dependencies
53KB
Tarball size

Three layers. One trust boundary.

Most MCP security stops at input filtering. CCS Proxy enforces a closed loop: every call is admitted, the upstream's metadata is attested, and the execution is cryptographically bound. No single layer is optional.

LAYER 1 — ADMISSION

Verify before forward

7-dimension verification: structure, schema, security, identity, integrity, latency, cost. Semantic attack-chain analysis catches prompt injection, command injection, SSRF, and SQLi. Intent binding ensures arguments match declared intent.

8 attack payloads denied
97ms P50 deny latency
0 upstream calls on deny
LAYER 2 — PROTOCOL ATTESTATION

Trust the metadata

Upstream manifest baseline, tool schema fingerprint pinning, order integrity, and drift detection. A lying MCP server that reorders tools, injects new ones, or changes schemas is detected and signed as an attestation receipt.

Reorder/inject/drift detected
Signed list attestation
MRTR & stamp verification
LAYER 3 — EXECUTION BINDING

Bind call to response

Arguments are hashed before forwarding. The upstream response is recursively sanitized (all forged fields stripped at any depth), then hashed and signed. isError is controlled by the proxy — not the upstream. Every receipt is Ed25519 signed.

Ed25519 signed receipts
Recursive sanitization
Tamper detection at any depth
┌──────────────────────────────────────┐ MCP Client (Claude / Cursor / IDE) └──────────────────┬───────────────────┘ tools/call ┌──────────────────────────────────────┐ CCS Proxy v1.3.0 (inline, mandatory) L1 AdmissionDENY + signed receipt allow L2 Attestation → manifest verified L3 Execution → args_hash → forward response_hash → sanitize → sign └──────────────────┬───────────────────┘ verified call ┌─────────────┼─────────────┐ upstream 1 upstream 2 upstream N (stdio) (HTTP/SSE) (NIM, etc.)

Real tests. Real receipts.

Every scenario below was executed against real code. The evidence IDs, hashes, and timestamps come from signed receipts on disk — not mockups.

DENY · 97ms

Prompt injection blocked before upstream

A tool call containing a command-injection payload is caught by L1's dual detection engine (critical:commandInjection + high:promptInjection). The call never reaches the upstream. A signed denial receipt is written to the append-only store.

evidence_id: ev_cf98c0ef... · upstream_server: null · NIM calls: 0
ALLOW · SIGNED

Normal agent tool call with end-to-end binding

A legitimate echo call passes all seven verification dimensions. The proxy hashes the arguments, forwards to the upstream, sanitizes the response, hashes it, and signs a receipt containing both hashes. The client can independently verify the signature offline.

evidence_id: ev_e8fc8b06... · 211ms · Ed25519 verified
FORGERY · STRIPPED

Malicious upstream forges a CCS receipt

A compromised MCP server returns a forged _ccs envelope with a fake signature, a spoofed isError: false, and nested _ccs_malicious fields buried inside content items. The proxy recursively strips all _ccs* keys at every depth, recomputes isError from observed status, hashes the sanitized result, and re-signs with its own key.

Poisoned hash: 63f9266d... → Sanitized hash: 370815b5... · 6/6 assertions passed
AGENT LOOP · 6.4s

Real LLM agent function-calling through the proxy

Connected to NVIDIA NIM (nemotron-3-nano-30b), the LLM autonomously decides to call a tool, returns finish_reason: tool_calls, the proxy forwards the call, the echo tool executes, the result is returned to the LLM, and it generates a final response — every hop producing a signed receipt with parent-hash chaining.

3 evidence chain nodes: 3b5cb223 → 8f5fabed → f6eeeb4f · 2 NIM round-trips
L2 ATTESTATION

Lying server detected via manifest drift

A malicious MCP server reorders tools, injects new ones, and changes schemas between calls. L2 compares each response against the pinned manifest fingerprint, detects all three drift types, and produces a signed ccs.tools_list.attestation receipt recording the exact divergence.

Tests 11–14: reorder / inject / schema_drift / aggregation · all detected

Start free. Scale when it matters.

The Developer download is a fully functional 14-day trial of the commercial proxy. No credit card. No telemetry. No phone home.

Developer
Free
14-day full-feature trial. Self-hosted. For evaluation and non-production use.
  • All 3 enforcement layers
  • 17 mock + 5 NIM tests
  • Signed receipts & verification
  • HTTP/SSE + stdio transports
  • No SLA / community support
  • 14-day evaluation license
Download tarball
Enterprise
Custom
From $15K/year. For financial services, healthcare, and regulated deployments.
  • Everything in Pro
  • Unlimited upstreams & seats
  • SOC 2 / ISO 27001 evidence packages
  • KMS / HSM integration (AWS KMS, Vault, PKCS#11)
  • SIEM integration (Splunk, Datadog, ELK)
  • On-prem / air-gapped deployment
  • Dedicated support engineer, 4h SLA
  • 99.9% uptime SLA & IP indemnification
Contact sales

Verify before you run.

Every release is GPG-signed. The signing key is published below and its fingerprint is embedded in this page. If the fingerprint does not match, do not run the binary.

Verifying the v1.3.0 release

# 1. Import the signing key
gpg --keyserver keys.openpgp.org --recv-keys 7DA47C4CB93409FF

# 2. Verify the signature
gpg --verify ccs-proxy-v1.3.0.tar.gz.asc ccs-proxy-v1.3.0.tar.gz

# 3. Verify the checksum
sha256sum -c SHA256SUMS

# Expected output:
# ccs-proxy-v1.3.0.tar.gz: OK
# gpg: Good signature from "Correctover <wangguigui@correctover.com>"

GPG key fingerprint:

E407 0D34 4663 39F3 D275  C136 47DA 47C4 CB93 409F

SHA-256: 03bbd3c2ed95c3715b1c1878aa35dfa7e85219033d9f3ad69ad021ca63c329d4

View release on GitHub →

Built on open standards.

IETF Internet-Draft

The CCS receipt structure is documented in an individual IETF Internet-Draft advancing through the ISE Experimental RFC channel. 22 fields, JCS canonicalization, SHA-256, Ed25519. Read the draft →

Open-source core

The L1 verification engine is open source (Elastic License 2.0) at ccs-mcp-server. The commercial proxy adds L2 attestation, L3 execution binding, and inline enforcement topology. View on GitHub →

Zero telemetry

No phone-home, no analytics, no network calls other than the upstream MCP servers you configure. Security products that collect data become targets. We don't.

Non-repudiable receipts

Every decision — allow or deny — produces a signed receipt. Disputes move from "trust me" to "recompute it." SLA debates, audit trails, and forensic investigations use the same evidence.

Secure every agent tool call.

Download the 14-day trial, or get in touch about a pilot deployment.