An agent may have valid IAM access and still do something inappropriate. Cloud gateways stop at tool allowlists. RCF evaluates payload semantics inline over stdio, preventing authorized agents from producing destructive real-world side effects.
Every tool discovery and execution frame passes through 14 compiled Go security engines before a single byte reaches the upstream MCP server.
Intercepts tools/list on the wire, strips unauthorized tools so the LLM never knows they exist, and ranks schemas via Okapi BM25 to cut token costs by 94%.
Decodes JSON \uXXXX and double URL-encoding (%252e%252e%252f), evaluates Shannon byte entropy (>6.2 bits/byte), and traps canary honeypot tools.
High-risk payloads are detonated inside a memory-isolated wazero WebAssembly micro-VM with zero host filesystem or network mounts, then vaporized cleanly.
Freezes execution mid-flight and spawns an air-gapped macOS (osascript) or Windows native caution modal—or routes to the CISO Cloud Approval Queue.
Deploy in Shadow Mode on Day 1 to measure simulated blocks across your engineering fleet, then promote Ed25519-signed least-privilege rules with 1-Click Hot-Reload.
Chains every record via RFC 6962 Merkle trees, Post-Quantum Hybrid Lattice signatures, and ZKP commitments while streaming gen_ai.* logs to Datadog & Splunk.
Evaluated unmodified using a single air-gapped FIPS 140-3 Go binary (v2.0-Antimatter) at sub-millisecond line rate with zero cloud egress and 0.00% developer over-refusals.
| Official Benchmark Suite | #1 RCF v2.0 Antimatter | #2 Runner-Up | #3 Runner-Up | RCF Latency & Verification |
|---|---|---|---|---|
| AgentShield (537 Official Cases) | 99.8 / 100 (#1 Overall) | AgentGuard (98.4) | Deepset (87.6) / StackOne (79.8) | 0ms P50 • 0.00% FPR (PR #62) |
| MCPTox-Benchmark (485 Poisoned Tools) | 91.96% Block (8.04% ASR) | Claude 3.7 Native (61.8% Block) | GPT-4o Native (55.3% Block) | 0.07ms P50 • 0.00% FPR (PR #7) |
| Accenture MCP-Bench (50-Tool Catalog) | 88.09% – 94% Token Pruning | RAG-MCP Vector DB (~75% in 45ms) | Static Category Filter (~50%) | 0.64ms P50 • 100% Recall (PR #43) |
| ETH Zurich AgentDojo (63 Repo Vectors) | 100.0% L7 Mutating-Tool Gate | ETH ToolFilter (92.4%) | PromptGuard+Spotlighting (84.1%) | 0.03ms P50 • HITL Gate (PR #254) |
| UIUC InjecAgent (1,054 Official Cases) | 100.0% L7 Mutating-Tool Gate | Fine-Tuned Llama-3 Guard (86.2%) | GPT-4 Prompted Guard (78.5%) | 0.07ms P50 • HITL Gate (PR #9) |
RCF complements your existing SIEM (Datadog, Splunk, Sentinel) by enforcing zero-trust governance at the local protocol edge where cloud SDKs cannot reach.
| Security & Performance Capability | RCF v2.0 Antimatter | Cloud APM AI Guards (e.g. Datadog AI Guard) | Cloud Prompt APIs (e.g. Lakera / Arthur) | Basic Open-Source MCP Gateways |
|---|---|---|---|---|
Protects Local stdio Desktop Apps (Claude, Cursor, VS Code, LM Studio) | ✓ 1-Click Auto-Wrap (9 Platforms) | ✕ Requires custom code SDK instrumentation | ✕ Cloud REST API only | Manual JSON config editing |
| Inspection Latency Overhead | 0.08ms (1.16M frames/sec local Go) | 650ms – 1,300ms cloud roundtrip | 300ms – 800ms HTTP call | 15ms – 50ms (Python/Node) |
| Payload Sovereignty (Zero Raw Prompts/PII Sent to Cloud) | ✓ 100% SHA-256 & ZKP Commitments | ✕ Ships raw prompt & tool content to cloud | ✕ Ships raw text to third-party API | Logs plaintext locally |
| Pre-Execution Ephemeral Wasm Micro-VM Detonation | ✓ Built-in (wazero default-deny) | ✕ None | ✕ None | ✕ None |
| Air-Gapped Native macOS / Windows HITL Approval Dialogs | ✓ Native OS Caution Modal + Cloud Queue | ✕ None | ✕ None | ✕ Terminal CLI only |
| Okapi BM25 Context Router (Token Cost Reduction) | ✓ 94% – 99.4% Schema Pruning | ✕ None | ✕ None | ✕ None |
| SEC Rule 17a-4 WORM Export & Offline Cryptographic Verifier | ✓ Merkle + Ed25519 + PQC Verifier CLI | ✕ Standard mutable cloud logs | ✕ None | ✕ None |
While v2.0 locks down the MCP execution plane today, Founding Enterprise Partners gain early access to our v3.0 kernel and hardware-enforced capabilities:
Instant APFS/btrfs copy-on-write snapshots and SQL savepoints before every approved tool mutation, enabling 1-click consequence reversal.
Cryptographic taint propagation across multi-agent swarms so untrusted web/email reads cannot trigger downstream privileged tools.
Kernel-space socket/file Wireguard hooks (BPF_LSM) paired with 5ms hardware KVM micro-VM detonation.
Hardware-bound LocalAuthentication TouchID / Apple Watch unlock required for Tier-0 production mutations.