In-memory privacy shield to prevent context leaks in MCP tools

This repository implements an in-memory security proxy for Model Context Protocol (MCP) tool execution that prevents plaintext context leaks, credential exfiltration, and prompt injection. It argues that standard MCP tool calls expose sensitive parameters in cleartext at the host boundary (e.g., API keys or DB passwords leaking into LLM context and logs) and presents a defense combining client-side RAM witness isolation, a semantic firewall (V-01) to strip hidden/zero-width Unicode prompt injections, and deterministic memory zeroization (V-02) to immediately overwrite volatile buffers so no plaintext parameters enter model context windows. Execution produces a 32-byte intent commitment, anchors state transitions on a Midnight compact blockchain contract, and uses a relayer/paymaster for gasless, scale-to-zero transaction sponsoring.

Concrete implementation details include an open-source monorepo with packages/mcp (stdio MCP server), packages/sdk (in-memory commitment engine), and webmcp (browser hooks with DOM/WebWorker isolation). Exposed tool endpoints include a rohan_zk_handshake that evaluates parameters in ephemeral RAM and generates cryptographic commitments. Network behavior favors streamable NDJSON over long-lived SSE to avoid socket exhaustion (V-05). Instructions show how to run from source (git clone, npm install, npm run build, node packages/mcp/dist/server.js) or via npx. Cryptographic foundations and formal proofs are linked to an academic paper (DOI provided), and a security register lists threats and mitigations for residual heap exfiltration, prompt injection, scraping, and connection exhaustion.