LABSCO SUMMARY

Tier 1 does the work, and it costs nothing per call.

The poisoned-invoice case — our banking details changed, remit to this address — is caught structurally, because the address only ever appeared inside untrusted document content. No model is consulted for that. The project publishes numbers rather than a slogan: on a corpus of 42 sessions, 21 attacks and 21 legitimate flows built to tempt false positives, 19 of 21 attacks were caught and 1 of 21 legitimate flows was blocked, with the misses and the false positive each documented.

What it is

An MCP proxy. Point an agent at Tripwire instead of at its tool servers and everything is forwarded transparently, with a three-tier check on calls policy marks as consequential: signed receipts of what actually happened, a provenance index of where every value came from, and a multi-model consensus panel for high-stakes calls.

What you get

Every tool result signed into an HMAC-SHA256 receipt ledger, so fabricated results and tampered values fail the check — Tier 0, around 1ms
Every observed value indexed with its origin and trust label, so an address that only appeared inside an untrusted document is refused structurally with no model call — Tier 1
A panel of independent models from different providers checking intent match, source grounding and bounds, with strict-JSON verdicts, quorum aggregation and fail-closed semantics — Tier 2
Block results built for the agent to act on: the violated parameter, the required provenance, the observed origins, and a remediation line telling it to fetch the value from a trusted tool
A synthetic tool the agent calls to state its intent, which policy can require — tripwire__declare_intent
A hash-chained, append-only audit log of every decision including passes, re-validated by tripwire verify-log

Requirements

Node and npm. npm install -g tripwire-mcp, then tripwire init to answer a few plain-language questions and write the config, and tripwire check to confirm your servers start and the rules make sense. init also writes tripwire-agent-config.json to paste into your client, replacing the tool servers listed there today; tripwire logs shows what happened in plain English. For server-side deployments set the transport to http in the YAML config — binding beyond loopback requires an auth_token, and Tripwire refuses to start exposed without one. The package is tripwire-mcp 0.3.1.

Setup effort

Follow the published steps — npm install -g tripwire-mcp

See installation options

USE CASES

01

Protecting a payment or trading tool

Mark it consequential in policy so its parameters must trace back to a trusted source before the call goes through.

02

Catching a plausible but wrong amount

Let the consensus panel apply a bounds check on values that are receipted and therefore pass the structural tier.

03

Keeping a record you can re-check

Re-validate the hash-chained audit log rather than trusting that the log was not edited.

04

Running agents server-side

Switch to the HTTP transport so one process serves many agents, each with its own isolated verification session.

BEFORE YOU INSTALL

What to know first

Requires

tripwire on PATH

Optional

ANTHROPIC_API_KEY in your environment
OPENAI_API_KEY in your environment
GEMINI_API_KEY in your environment
GOOGLE_API_KEY in your environment

Where it runs

Both documented clients run the server on your machine.

INSTALLATION

Connect your client

Server setup

TERMINAL

npm install -g tripwire-mcp

In the folder where you want the config to live, run the guided setup, then check it. init asks which tool servers to put behind Tripwire and writes tripwire.yaml plus tripwire-agent-config.json; check confirms your servers start and the rules make sense.

TERMINAL

tripwire init
tripwire check

Paste tripwire-agent-config.json into your client instead of the tool servers it lists today (the block below is its shape), then restart the client.

MCP Clients

Claude Desktop, Claude Code

JSON

{
  "mcpServers": {
    "tripwire": {
      "command": "tripwire",
      "args": [
        "run",
        "--config",
        "tripwire.yaml"
      ]
    }
  }
}

The keys are optional — they turn on the AI double-check. The Getting Started guide says: if the tripwire-agent-config.json that tripwire init writes has an env section with <your key here> placeholders, paste your real API keys there before you add it to your client.

Tripwire MCP