OPEN SOURCE TRANSPORT FIREWALL

Your AI agents need
a security boundary.

An inline transport firewall for autonomous AI agents and Model Context Protocol (MCP). Intercept indirect prompt injection, block cloud metadata SSRF, and contain unauthorized file access in under 1ms.

$ npm install -g tcha

# Installs the global Tcha Protection Pro inline security daemon

$ npx tcha audit

# Evaluates local agent configurations against 100 adversarial test probes

$ npx tcha init-mcp --claude-desktop

# Automatically configures inline transport filtering in claude_desktop_config.json

MIT Open Source

<1.0ms Latency Overhead

Zero Telemetry / No Account Required

Model Context Protocol (MCP) Ready

KINETIC SECURITY DEMONSTRATION

Live Exploit Interception

Watch Tcha Protection Pro neutralize real-time cloud metadata SSRF and path traversal attacks before execution.

tcha_interception_demo.mp4 (30s)

● LIVE INTERCEPT

DETERMINISTIC DEFENSE SANDBOX

Interactive Attack Parry Simulator

Select an adversarial attack vector to observe inline deterministic transport inspection and policy enforcement.

INCOMING AGENT TOOL CALL LangChain HTTP Client

fetch_url({
url: "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
timeout: 3000
})

FIREWALL DECISION & AUDIT REF BLOCKED (403)

Policy Rule: Block RFC 3927 link-local & cloud metadata ranges
Latency: 0.38ms
Status: Blocked at transport boundary
Evidence Nonce: TEST-PROBE-SSRF-028

Threat Vector: Agent was tricked by web scraping into exfiltrating AWS IAM role credentials.

BENCHMARK SCORECARD

Proof, not promises.

Audited under deterministic adversarial probe suites. Every metric links directly to reproducible evidence.

View Complete 100-Probe Audit Report ↗

100 / 100

Probes Neutralized

100% block rate across 4 adversarial threat classes

Security Escapes Detected

Zero uncontained remote code executions or data leaks

< 1.0ms

Measured Latency Overhead

Evaluated on Apple Silicon & Linux AMD64 workers

Regulatory & Enterprise Control Crosswalk

Regulatory Framework	Specific Mandate / Article	Tcha Protection Pro Enforcement Method	Status
EU AI Act	Article 15 Cybersecurity & Robustness	Prevents adversarial data poisoning and indirect prompt injection escapes.	Verified
SOC 2 Type II	CC6.1 Logical Boundary Access	Enforces strict transport sandboxing on all external agent network & tool calls.	Verified
ISO/IEC 42001	Annex A.9.2 AI System Impact Mitigation	Cryptographically signed Merkle audit logs for every intercepted agent decision.	Verified

THREAT COVERAGE

Security at every tool boundary.

Comprehensive runtime protection shielding model context and operating system resources.

⌁ Indirect Prompt Injection

Detects untrusted instructions embedded in external web scrapes, PDFs, and API payloads attempting to override the system prompt.

⌘ SSRF & Metadata Exfiltration

Blocks attempts to access internal subnets (`10.0.0.0/8`, `192.168.0.0/16`) and cloud instance identity endpoints (`169.254.169.254`).

▤ Path Traversal & Shadow Reads

Enforces strict chroot boundaries preventing agents from escaping the project root to inspect `.env`, SSH keys, or `/etc/passwd`.

⛨ Destructive Tool Agency

Intercepts recursive shell execution (`rm -rf`, `chmod 777`, shell piping) before it reaches the operating system kernel.

CURATED DOMAIN INTELLIGENCE

The Daily Tcha

Curated domain intelligence and strategic digital asset valuation for AI builders and investors.

FEATURED CURATION BRIEFING

agentdefense.ai

Category: Autonomous Agent Cybersecurity
Thesis: Exact-match premium keyword pair commanding enterprise institutional credibility for autonomous runtime firewalls.
Methodology: Linguistic density, industry VC funding momentum, search commercial intent.

Subscribe to The Daily Tcha

Join builders and tech executives receiving our private morning dispatch. No spam, 1-click unsubscribe.

Your AI agents needa security boundary.