Every tool call an AI agent makes is intercepted, verified, bound to its exact arguments and response, and signed with an Ed25519 receipt. Not a black-box filter — an auditable, non-repudiable checkpoint.
Most MCP security stops at input filtering. CCS Proxy enforces a closed loop: every call is admitted, the upstream's metadata is attested, and the execution is cryptographically bound. No single layer is optional.
7-dimension verification: structure, schema, security, identity, integrity, latency, cost. Semantic attack-chain analysis catches prompt injection, command injection, SSRF, and SQLi. Intent binding ensures arguments match declared intent.
Upstream manifest baseline, tool schema fingerprint pinning, order integrity, and drift detection. A lying MCP server that reorders tools, injects new ones, or changes schemas is detected and signed as an attestation receipt.
Arguments are hashed before forwarding. The upstream response is recursively sanitized (all forged fields stripped at any depth), then hashed and signed. isError is controlled by the proxy — not the upstream. Every receipt is Ed25519 signed.
Every scenario below was executed against real code. The evidence IDs, hashes, and timestamps come from signed receipts on disk — not mockups.
A tool call containing a command-injection payload is caught by L1's dual detection engine (critical:commandInjection + high:promptInjection). The call never reaches the upstream. A signed denial receipt is written to the append-only store.
A legitimate echo call passes all seven verification dimensions. The proxy hashes the arguments, forwards to the upstream, sanitizes the response, hashes it, and signs a receipt containing both hashes. The client can independently verify the signature offline.
A compromised MCP server returns a forged _ccs envelope with a fake signature, a spoofed isError: false, and nested _ccs_malicious fields buried inside content items. The proxy recursively strips all _ccs* keys at every depth, recomputes isError from observed status, hashes the sanitized result, and re-signs with its own key.
Connected to NVIDIA NIM (nemotron-3-nano-30b), the LLM autonomously decides to call a tool, returns finish_reason: tool_calls, the proxy forwards the call, the echo tool executes, the result is returned to the LLM, and it generates a final response — every hop producing a signed receipt with parent-hash chaining.
A malicious MCP server reorders tools, injects new ones, and changes schemas between calls. L2 compares each response against the pinned manifest fingerprint, detects all three drift types, and produces a signed ccs.tools_list.attestation receipt recording the exact divergence.
The Developer download is a fully functional 14-day trial of the commercial proxy. No credit card. No telemetry. No phone home.
Every release is GPG-signed. The signing key is published below and its fingerprint is embedded in this page. If the fingerprint does not match, do not run the binary.
# 1. Import the signing key gpg --keyserver keys.openpgp.org --recv-keys 7DA47C4CB93409FF # 2. Verify the signature gpg --verify ccs-proxy-v1.3.0.tar.gz.asc ccs-proxy-v1.3.0.tar.gz # 3. Verify the checksum sha256sum -c SHA256SUMS # Expected output: # ccs-proxy-v1.3.0.tar.gz: OK # gpg: Good signature from "Correctover <wangguigui@correctover.com>"
GPG key fingerprint:
E407 0D34 4663 39F3 D275 C136 47DA 47C4 CB93 409F
SHA-256: 03bbd3c2ed95c3715b1c1878aa35dfa7e85219033d9f3ad69ad021ca63c329d4
The CCS receipt structure is documented in an individual IETF Internet-Draft advancing through the ISE Experimental RFC channel. 22 fields, JCS canonicalization, SHA-256, Ed25519. Read the draft →
The L1 verification engine is open source (Elastic License 2.0) at ccs-mcp-server. The commercial proxy adds L2 attestation, L3 execution binding, and inline enforcement topology. View on GitHub →
No phone-home, no analytics, no network calls other than the upstream MCP servers you configure. Security products that collect data become targets. We don't.
Every decision — allow or deny — produces a signed receipt. Disputes move from "trust me" to "recompute it." SLA debates, audit trails, and forensic investigations use the same evidence.
Download the 14-day trial, or get in touch about a pilot deployment.