01
Agents act without a human in the loop
They move money, book travel, write to databases and execute code. Nobody is reviewing each individual call.
Live engine — every verdict here is computed, not scripted
A firewall for AI agents.
AI agents now book, pay and run code on their own. When one is compromised, its requests look exactly like a healthy agent’s — same credentials, same endpoints, no alarm. Agent Trust Firewall sits in front of those calls, proves who is actually asking, and stops the bad ones before they execute.
No sign-up. The demo fleet is already running.
Live interception
- scenario
- …
- checks
- 7 signals scored
- Envelope openeddecrypted inside the firewall
- Identity proof checkedzero-knowledge, single-use
- Capability checkedMerkle inclusion proof
- Risk scoredseven signals, live intel
Verifying the call…
Why this needs to exist
Every company is building agents. Almost nobody is securing the handshake between them.
02
A compromised agent looks completely normal
It holds real credentials and calls real endpoints. Nothing in the request says it has been hijacked or its prompt poisoned.
03
Nothing checks the handshake
An API key proves someone once had a secret. It does not prove that this request, right now, came from the agent you think it did.
How it works
Every agent call is intercepted at the MCP layer and has to clear four checks before it is allowed to run.
Encrypted. The agent seals the call with a one-time key, so nothing readable crosses the wire.
Identity. It proves it holds its secret key without sending it, against a challenge good for exactly one request.
Capability. It proves the one permission this call needs, revealing nothing about the rest of its authority.
Risk and policy. Seven signals — including live external threat intelligence — produce an explained score; hard rules block regardless of where it lands.
Sealed in transit
The agent encrypts each call with a fresh key. Fields it marks sensitive are encrypted to the destination instead — those pass through unreadable to us.
Identity, proved not claimed
A zero-knowledge proof of key possession. The key is never sent, and the proof is bound to one challenge and one request.
Scored against live intel
Seven signals, including real-time lookups against public threat intelligence for the address the agent is calling from.
Blocked before it runs
Revoked key, replayed proof, ungranted capability — these block outright, at any configuration. They are not tunable.
See it stop something
Real attacks against the live engine — a genuinely forged key, a genuinely replayed proof. Pick one and watch what happens.
What this is, and what it isn’t
A security product should be easy to check and honest about its edges. Both columns below are part of the pitch.
Real, and you can check it
- Genuine cryptography: Schnorr zero-knowledge proofs and Merkle capability proofs over ed25519, X25519 with XChaCha20-Poly1305 for encryption. Audited primitives, no hand-rolled maths.
- External findings come from live lookups against public threat intelligence, and every one is labelled with its provider so you can check the claim yourself.
- The audit log is hash-chained. You can forge a record on the Audit page and watch the integrity check catch it.
Scoped, and we’d rather say so
- An MCP-ecosystem MVP, not an internet-scale agent mesh. It secures calls that pass through the interceptor.
- The audit log and traffic history are stored in Postgres, so they survive restarts and redeploys — which is what makes the hash chain worth verifying. Without a database configured the same code falls back to an in-process store and says so on
/api/health. - The agents in the demo fleet are synthetic. Their keys, proofs, verdicts and origin addresses are real — the addresses are live cloud hosts, and the intel shown about them is fetched at request time, so you can check any of it yourself.
- A firewall must read a request to score it, so ATF is a trusted endpoint for the outer envelope. Only fields sealed to the destination stay unreadable to it.
Unfamiliar with a term? The glossary explains every one in plain language.