Runtime privacy gateway
Every other check reads a trace after the fact. agentleak proxy sits between your agent and an MCP server and judges each tools/call against your flow rules before it is sent. The call is allowed, redacted or blocked, and the decision goes into a hash-chained evidence log.
The proxy launches the real server as a child process and forwards JSON-RPC untouched, except tools/call, which goes to the policy first.
A SIN sent to your KYC vendor for identity checks is fine. The same SIN sent to analytics is a leak. Rules name the data type, the sender, the recipient and the declared purpose.
Each decision is one line carrying the hash of the line before it. agentleak evidence verifies the chain and names the first entry that was edited, removed or reordered.
The mental model
Blocking whatever looks sensitive stops the task, and within a week somebody removes the gateway. So a refusal redacts by default, and only the values whose flow was refused: the order number stays, the SIN goes. Blocking is kept for flows that a deny rule names, because a deny rule means “not this, ever”.
A report tells you next week that a tool call carried a SIN to the wrong server.
The SIN is removed before the call is sent, and the log shows why.
How it works
Add privacy_policy.flows to agentleak.yaml: who may receive which data type, and for what purpose. The CI gate already reads the same rules.
In your MCP client configuration, launch agentleak proxy with the real server command after --.
Permitted flows pass, refused values are redacted, and denied flows are blocked with a reason the agent can act on.
Run agentleak evidence to summarize decisions and check that no entry in the chain was altered.
Guard an MCP server
{
"mcpServers": {
"github": {
"command": "agentleak",
"args": ["proxy", "--config", "agentleak.yaml",
"--evidence", "evidence.jsonl", "--",
"npx", "-y", "@modelcontextprotocol/server-github"]
}
}
}FAQ
Ready when you are
Create a local workspace, run a bundled scenario, then wire AgentLeak into CI or let your agent onboard itself.