Mastyf.ai

mastyf.ai

Secure the Action Boundary, Not Just the Prompt.

A local reference monitor and security gateway for AI agents and MCP. Your LLM proposes actions. Mastyf decides whether those actions reach the real world.

Website · Quick start · Policy · Dashboard · GitHub

[!NOTE]

Enterprise & Cloud Platform Support: Mastyf is verified and deployed as a native CONTENT_AUTHZ Service Extension for Google Cloud Agent Gateway (us-central1), with distributed Redis state, sub-second fail-closed enforcement, and real-time BigQuery audit logging. See the Google Agent Gateway Runbook.

---

The problem

AI agents can read your files, push code, query databases, execute shell commands, and call external APIs. They do it autonomously, at machine speed.

Traditional security controls weren't built for that.

Mastyf.ai acts as a perimeter security layer for AI. It intercepts every tool call, evaluates it against your security policies using multi-agent swarm analysis, and blocks malicious or unauthorized actions before they execute.

Every decision is enforced, logged, and auditable.

---

What it stops

---

Quick start

🛡️ Mastyf Security Gateway & Protected Agent (Python Quickstart)

Run the local reference monitor, MCP discovery, and plain-English protected agent runtime:

# Install Mastyf Gateway package

git clone https://github.com/mastyf-ai/mastyf.ai.git cd mastyf.ai/mastyf_gateway pip install -e .

Launch Mastyf (Auto-discovers tools, prompts for permissions, and starts protected agent)

mastyf

• On first run, Mastyf automatically discovers your local MCP servers/tools, prompts for your intended permissions in plain English, presents a conservative diff, and upon confirmation activates the policy.
• Every tool proposal from the conversational agent is intercepted by the reference monitor ($A = \text{CBAC} \cap \text{DIFC} \cap \text{Workflow}$). Non-ALLOW actions dispatch strictly 0 bytes to tool backends.
• Includes real-time Security HUD and cryptographic receipt audit chaining (mastyf audit verify).

Common CLI Commands

# Start interactive protected agent (or first-run onboarding if fresh install)

mastyf

Run a single query non-interactively

mastyf -m "Find unpaid customer invoices"

Propose a policy change in plain English

mastyf policy "Allow reading invoices, but never delete data or make HTTP calls"

Inspect staged proposed policy vs active policy diff

mastyf policy status

Promote staged policy to active enforcement

mastyf policy activate

Intercept an MCP server via stdio reverse proxy

mastyf proxy -- uvx mcp-server-sqlite --db /tmp/test.db

Cryptographically verify the tamper-evident execution receipt ledger

mastyf audit verify --ledger ~/.mastyf/receipts.jsonl

Run local action boundary failure mode demonstrations

mastyf demo --scenario all

---

Build from source (TypeScript / Cloud Platform)

Clone the repository and run the setup script.

Requirements:

• Git
• Linux (the setup script installs Nix automatically if needed)

git clone https://github.com/mastyf-ai/mastyf.ai.git

cd mastyf.ai chmod +x setup.sh ./setup.sh

The setup script automatically:

• Installs Nix (if required)
• Enables Nix flakes
• Creates the development environment
• Installs all project dependencies
• Rebuilds native packages
• Builds the entire project
• Adds a convenient mastyf shell alias

Once installation completes, start the proxy and dashboard:

node dist/cli.js start

Or simply use the alias after opening a new terminal:

mastyf

The dashboard will be available at:

• Dashboard: http://localhost:4000

---

Test the installation

If the dashboard is running, verify the HTTP bridge:

curl -X POST http://localhost:4000/mcp -H "Content-Type: application/json" -d '{"jsonrpc":"2.0","id":"1","method":"tools/list","params":{}}'

---

Dashboard

Full visibility into every action your AI takes.

---

Dashboard auth is on by default, including loopback. The start scripts provision $MASTYF_HOME/dashboard_api_key and never print it. Set DASHBOARD_AUTH_DISABLED=true only for explicit local test isolation — that combination is refused on any non-loopback bind.

---

How enforcement works

Every tool call passes through three layers before it reaches your infrastructure.

Layer 1 - Pattern detection Regex-based scanning for injection, dangerous paths, leaked secrets, shell commands, and encoding tricks. Runs in microseconds with no external dependencies.

Layer 2 - Schema validation Rejects malformed payloads, oversized arguments, and JSON-RPC violations before they reach policy evaluation.

Layer 3 - Semantic review An optional local LLM (Ollama) or cloud model evaluates borderline calls that pass pattern checks. Falls back to heuristics if no model is configured.

Anything that fails is blocked. The tool never runs. Everything is logged.

---

Policy

Your rules live in default-policy.yaml. You own them. mastyf.ai enforces them.

policy:

mode: block default_action: pass unicode_strict: true rules:

• name: block-sensitive-paths action: block argPatterns:
• field: path patterns: ['^/etc/', '/\.ssh', '/\.aws/credentials']

• name: rate-limit-tool-calls action: block maxCallsPerMinute: 120

• name: block-shell-injection action: block patterns: ['rm\s+-rf', 'curl\s', 'wget\s', '[^]+`']

Roll out safely with three enforcement modes:

Pre-built templates for HIPAA, PCI-DSS, GxP, and data residency are in policy-templates/.

---

Architecture

mastyf.ai runs two coordinated swarms. The CI Swarm attacks your policy before code ships. The Runtime Swarm enforces and learns from every live tool call in production. Four feedback loops connect them so the system gets harder to bypass over time.

flowchart TB

AI["🤖 AI Clients\nCursor · Claude Desktop · Cline"]

subgraph CI["🔵 CI Swarm (PR + Nightly)"] direction LR Scout["🔍 Scout Agent\nSAST, deps, config scan"] Corpus["📋 Corpus Agent\n228 fixtures eval"] Evasion["⚡ Evasion Agent\n120+ probes + generate new"] Parity["🔄 Parity Agent\nNode vs Python"] ProxyA["🖥️ Proxy Agent\nLive stdio MCP tests"] Report["📊 Report Agent\nsecurity-swarm/latest.json"] Scout --> Corpus --> Evasion --> Parity --> ProxyA --> Report end

subgraph Runtime["🟢 Runtime Swarm (Production Proxy)"] direction LR BG["🛡️ BlockGuard\nsync policy"] IL["📈 InstantLearner\nper-block stats + suggestions"] SA["🧠 SemanticAuditor\nasync LLM, optional"] PS["🔗 PatternSynthesizer\nbatch suggestions"] Cal["⚙️ Calibrator\nlabels + thresholds"] BG --> IL --> PS --> Cal BG --> SA --> PS end

Tools["🗄️ MCP Tools\nfilesystem · GitHub · databases · APIs"]

AI -->|"every tool call"| BG BG -->|"✅ allowed"| Tools Report -->|"🔁 Loop A: bypasses to corpus"| Corpus Cal -->|"🔁 Loop B: blocks to rules"| BG Cal -->|"🔁 Loop C: labels to LLM"| SA Report -->|"🔁 Loop D: CI metrics weekly"| Cal

style CI fill:#EFF6FF,stroke:#3B82F6,stroke-width:2px,color:#1E3A5F style Runtime fill:#F0FDF4,stroke:#22C55E,stroke-width:2px,color:#14532D style Scout fill:#DBEAFE,stroke:#3B82F6,color:#1E40AF style Corpus fill:#DBEAFE,stroke:#3B82F6,color:#1E40AF style Evasion fill:#DBEAFE,stroke:#3B82F6,color:#1E40AF style Parity fill:#DBEAFE,stroke:#3B82F6,color:#1E40AF style ProxyA fill:#DBEAFE,stroke:#3B82F6,color:#1E40AF style Report fill:#DBEAFE,stroke:#3B82F6,color:#1E40AF style BG fill:#BBF7D0,stroke:#16A34A,color:#14532D style IL fill:#BBF7D0,stroke:#16A34A,color:#14532D style SA fill:#BBF7D0,stroke:#16A34A,color:#14532D style PS fill:#BBF7D0,stroke:#16A34A,color:#14532D style Cal fill:#BBF7D0,stroke:#16A34A,color:#14532D style AI fill:#FEF3C7,stroke:#F59E0B,stroke-width:2px,color:#78350F style Tools fill:#FEF3C7,stroke:#F59E0B,stroke-width:2px,color:#78350F

Canonical gates: 228/228 corpus, 0 bypasses, 100% parity

CI Swarm

Runs on every PR and nightly. Six agents work in sequence, each one hardening what the previous found.