The poisoned-invoice case — our banking details changed, remit to this address — is caught structurally, because the address only ever appeared inside untrusted document content. No model is consulted for that. The project publishes numbers rather than a slogan: on a corpus of 42 sessions, 21 attacks and 21 legitimate flows built to tempt false positives, 19 of 21 attacks were caught and 1 of 21 legitimate flows was blocked, with the misses and the false positive each documented.
An MCP proxy. Point an agent at Tripwire instead of at its tool servers and everything is forwarded transparently, with a three-tier check on calls policy marks as consequential: signed receipts of what actually happened, a provenance index of where every value came from, and a multi-model consensus panel for high-stakes calls.
- Every tool result signed into an HMAC-SHA256 receipt ledger, so fabricated results and tampered values fail the check — Tier 0, around 1ms
- Every observed value indexed with its origin and trust label, so an address that only appeared inside an untrusted document is refused structurally with no model call — Tier 1
- A panel of independent models from different providers checking intent match, source grounding and bounds, with strict-JSON verdicts, quorum aggregation and fail-closed semantics — Tier 2
- Block results built for the agent to act on: the violated parameter, the required provenance, the observed origins, and a remediation line telling it to fetch the value from a trusted tool
- A synthetic tool the agent calls to state its intent, which policy can require — `tripwire__declare_intent`
- A hash-chained, append-only audit log of every decision including passes, re-validated by `tripwire verify-log`
Node and npm. `npm install -g tripwire-mcp`, then `tripwire init` to answer a few plain-language questions and write the config, and `tripwire check` to confirm your servers start and the rules make sense. `init` also writes `tripwire-agent-config.json` to paste into your client, replacing the tool servers listed there today; `tripwire logs` shows what happened in plain English. For server-side deployments set the transport to `http` in the YAML config — binding beyond loopback requires an `auth_token`, and Tripwire refuses to start exposed without one. The package is `tripwire-mcp` 0.3.1.
One command plus a key — npm install -g tripwire-mcp, then supply credentials