agent-security-stack

redstamp, truecopy & strongroom composed into one layered defense — and exposed as a single governed MCP server an agent can call mid-task.

github → build note → MIT the guard the trilogy

01What it is

Each guard closes one failure mode; the stack is all three, in one place. redstamp contains the action, truecopy vets the tool, and strongroom holds the keys — three small tools that compose into a single layered defense rather than three separate installs to wire up.

The pieces aren't islands: they share one spine, so truecopy reuses redstamp's scanner and strongroom reuses redstamp's tamper-evident audit. Composed in the path — client → truecopy → redstamp → server, egress through strongroom — a tool must be vetted to exist, safe to run, and hold a valid lease before it touches a secret. And the same trio is exposed on demand, as one MCP server an agent can simply call.

oys-mcp · config

# one MCP server, the whole trilogy
npx -y github:askalf/agent-security-stack oys-mcp

# three callable tools
warden_check    contain
canon_scan      vet
keeper_lease    key

Fig. 1 — the trilogy as one on-demand MCP server.

02What it does

One guarded call, three-way agreement

The trio composes into a single decision: a tool call proceeds only when all three layers agree — truecopy before redstamp before strongroom. Flip any one layer to "bad" and the call stops there: a poisoned tool stops at truecopy, a curl | bash stops at redstamp, a spent lease stops at strongroom.

Drop-in enforcers at the boundary

Each layer also ships a transparent proxy, so the same defense holds with no app changes. Chain them — client → truecopy-mcp → redstamp-mcp → server, egress through the strongroom broker — and the agent never holds a key: the broker redeems a scoped, single-use lease and injects the real secret only at egress, bound to one upstream.

One MCP server — call the whole stack

Where the proxies enforce mandatorily in the path, oys-mcp is the complementary on-demand surface: one server that hands any client — Claude Desktop, Claude Code, any agent runtime — the trio as callable tools, so an agent can ask the stack to vet content, actions, and secrets mid-task.

Three tools an agent can call

warden_check asks whether a {tool, input} is safe to run; canon_scan scans a manifest for poisoning; keeper_lease returns an opaque handle, never the secret. Each wraps the real library — no reimplementation. The MCP tool names keep the original codenames — warden, canon, keeper — for compatibility with existing configs.

A reproducible supply chain

The tools are pinned to vetted commits, so the stack is itself a reproducible supply chain — the thing it's protecting. npm install pulls all three and dedupes redstamp to a single shared copy; npm run demo shows a clean call proceed while a poisoned tool, a download-and-run, and a spent lease each get stopped. No third-party dependencies, MIT-licensed.

03Where it sits

Part of The Guard.

agent-security-stack composes the trilogy — redstamp, truecopy, strongroom — into one layered defense and one MCP server an agent can call. It lives in The Guard alongside two more Own Your Stack security tools, cordon and fieldpass, which guard the prompt and the browser as separate, standalone tools.

redstamp

An action firewall — classify, gate, and audit every tool call.

truecopy

Supply-chain gate — scan, pin, and verify the skills an agent may load.

strongroom

Scoped, short-lived secret leases instead of raw keys.

cordon

A fail-closed PII gateway — redact before a model sees it. (Separate tool.)

fieldpass

A governed browser that withholds injection from hostile pages. (Separate tool.)

Govern the agent, not just the prompt.

agent-security-stack is open source and MIT-licensed. Read the code, read the build note, run it on your own box.

View agent-security-stack on GitHub →