Inbound Tool-Schema Sanitizer
Cleans inbound MCP tool definitions before the model reads them, stripping embedded directives, running injection detectors, and holding schema drift against a SHA-256 baseline.
MCP firewall
MCP firewall capabilities
IntentGate is the protocol-aware MCP firewall for AI agents. It sits inline on the tool-call wire, between the model and the MCP servers it reaches, and enforces a fixed set of runtime controls on every request as it passes. These are those controls: eight capabilities, each with its own reference page, that together clean what the model reads, decide what the agent is allowed to do, bound how far it can go, cut it off on command, and leave signed evidence of every decision. Enforcement is deterministic, sub-millisecond deterministic checks and single-digit-ms policy, with no LLM in the block decision.
One request through the firewall
Every tool call takes the same ordered path. An inbound tool schema is sanitized, the call is resolved against declared intent, runtime limits bound how far it can go, upstream credentials are brokered on the outbound hop, and the request is either forwarded or denied, with signed evidence written either way. Deception and Session Rewind run alongside as the catch-and-recover layer.
Inbound tool schemaThe tools/list definitions and the call the model wants to make, arriving on the wire before anything is trusted.
Firewall pipelineSanitizer, Intent Enforcement, and Runtime Limits run in order, each a deterministic check on the call as it passes.
Forward or denyAn allowed call is forwarded upstream with brokered credentials; a call outside policy is denied, or every call is cut on the Kill Switch.
Tool-Schema Sanitizer
The inbound tools/list definitions are cleaned before the model reads them: embedded directives stripped, injection detectors run, schema drift held against a SHA-256 baseline.
INBOUNDIntent Enforcement
The Semantic Action Resolver checks the requested call against the user's declared intent and refuses actions that fall outside it, so a hijacked agent cannot act beyond what was asked.
RESOLVERuntime Limits & Circuit Breakers
Outbound velocity, scope, and spend are bounded per session; a breaker trips when a threshold is crossed, stopping a runaway loop before it compounds.
BOUNDCredential Brokering
On the upstream hop, the broker injects the credential the target server needs. The agent never holds or sees the secret, so a compromised agent has nothing to leak.
UPSTREAMForward / allow · Kill Switch / deny
A call inside policy is forwarded and allowed; a call outside it is denied, and a single Global Kill Switch can cut every in-flight call across the fleet at once.
DECIDEProof-of-Intent Packaging
Every decision, allow, deny, or cut, is packaged as tamper-evident, signed evidence, so what happened and why can be verified after the fact.
EVIDENCECatch-and-recover layerActive Agentic Deception feeds a probing agent controlled false data instead of failing open, and Self-Healing Session Rewind rolls a compromised session back to its last known-good state.
The eight capabilities
Each control is enforced inline on the tool-call wire and documented on its own reference page. They compose: the inbound hygiene, the authorization decision, the runtime bounds, the emergency stop, the credential boundary, the deception and recovery layer, and the evidence trail.
Intent Enforcement
The Semantic Action Resolver checks each requested tool call against the user's declared intent and refuses actions that fall outside it.
Runtime Limits & Circuit Breakers
Bounds outbound velocity, scope, and spend per session, tripping a circuit breaker when a threshold is crossed to stop a runaway loop.
Global Kill Switch / STOP ALL
A single control that cuts every in-flight tool call across the fleet at once, halting all agents on command.
Credential Brokering
Injects the upstream credential a target server needs on the outbound hop, so the agent never holds or sees the secret.
Active Agentic Deception
Feeds a probing or hijacked agent controlled false data instead of failing open, containing it while the event is recorded.
Self-Healing Session Rewind
Rolls a compromised session back to its last known-good state, undoing the effects of a detected bad path.
Proof-of-Intent Packaging
Packages every allow, deny, or cut decision as tamper-evident, signed evidence that can be verified after the fact.
Related
The capabilities index sits inside the docs hub. These pages show how the controls are positioned, how they fit the architecture, and where they land in the product.