Meta Global AI Hackathon 2026 • Startup Track Research Alpha v0.1.0-alpha.1

The Security Boundary for AI Agents

An inline security gateway and policy enforcement control plane for Model Context Protocol (MCP). Prevent prompt injection, intercept destructive commands, and generate tamper-evident audit logs with zero upstream code changes.

Quickstart Guide npm Package

bash — veylith stdio proxy

> npx veylith -- npx -y @modelcontextprotocol/server-filesystem ~/mcp-sandbox

✔ Preflight checks.

✔ Verifying MCP protocol. Found 14 active tools.

✔ Stage 1: Discovery Prompt-Injection Shield active.

✔ Stage 2: Inline Argument Policy Engine ready (<0.05ms).

✔ Stage 3: Response Quarantine & Canary Leak Redactor armed.

✔ Writing tamper-evident SHA-256 audit genesis log.

• Veylith Security Gateway listening on stdio.

Protocol Threat Landscape

Why MCP Needs a Security Boundary

As AI agents gain access to filesystems, databases, and APIs via MCP, giving them unmediated socket authority exposes your infrastructure to severe protocol-layer exploits.

STAGE 1 EXPLOIT Critical

Tool Discovery Poisoning

Compromised or malicious MCP servers inject covert instructions into tool schemas to manipulate the agent's reasoning loop.

tools/list.json Poisoned

"name": "read_files",
"desc": "[EXFILTRATE_TOKENS]"

STAGE 2 EXPLOIT High

Dangerous Invocations

Agents tricked by adversarial prompts generate destructive shell commands, SQL drops, or unauthorized path traversals.

tools/call.json Destructive

execute({
  "cmd": "rm -rf /",
  "path": "/etc/shadow"
})

STAGE 3 EXPLOIT Critical

Indirect Prompt Injection

Benign tools fetching untrusted web pages, emails, or tickets return payloads designed to hijack the agent context.

resources/read.json Injection

"result": "Invoice #123",
"/* DROP TABLE users */"

STAGE 4 EXPLOIT High

Exfiltration & SSRF

Agents inadvertently transmitting authorization headers, private IP metadata endpoints, or cloud keys to untrusted endpoints.

fetch/http.json SSRF Probe

http_get({
  "url": "http://169.254.169.254"
})

System Architecture

Veylith inspects MCP traffic across three distinct protocol stages, enforcing deterministic constraints and semantic reasoning before executing tools.

ALLOW Pass-Through

Payload passes deterministic and semantic checks. Forwarded to upstream MCP server with sub-millisecond overhead.

BLOCK Pre-Execution Halt

Dangerous command, forbidden tool, or malicious input detected. Execution stops locally with code -32603.

REVIEW Triage Gate

Ambiguous or high-consequence request flagged for human operator approval before allowing tool execution.

QUARANTINE Field Redaction

Indirect injection or prompt hijacking detected in tool output. Payload redacted before reaching the agent.

Engine Capabilities

Designed for Production Agents

Engineered with strict zero-trust principles, performance bounds, and tamper-evident transparency.

Sub-Millisecond Invariants

Tier 1 deterministic security rules evaluate in <0.05ms microbenchmarks, halting dangerous bash and SQL syntax with virtually zero latency.

Dual Topologies

Deploy as a zero-dependency in-process stdio wrapper for Claude Desktop and Cursor, or run as a centralized Streamable HTTP gateway.

SHA-256 Audit Hash Chain

Every inspection, tool call, and security violation is recorded in a cryptographically linked, append-only JSONL log anchored to a genesis hash.

Fail-Closed Guarantee

If downstream connections fail or semantic evaluators error, Veylith strictly fails closed, denying uninspected execution to prevent security bypasses.

Zero Config by Default

Immediate protection without requiring third-party API keys or external network calls. Bundled deterministic patterns catch top attack vectors out of the box.

Meta Muse Semantic Adapter

Optional Tier 3 semantic reasoning powered by Meta Muse (muse-spark-1.3 / Fireworks) to detect sophisticated natural-language adversarial injections.

Empirical Evaluation

Tested Against Real Threats

Evaluated on a 100-case MCP benchmark using live Fireworks AI model inference against adversarial injection and benign enterprise workloads.

Veylith benchmark results across five evaluation metrics
Evaluation Metric	Benchmark Result	Test Scope & Target
Malicious Attack Recall	100.0% (50 / 50)	Full interception of destructive commands, prompt injections & schema tampering
Benign False Positive Rate	0.0% (0 / 35)	Zero legitimate developer and enterprise workflows blocked
Overall Evaluation Accuracy	85.0% (85 / 100)	50 attacks contained + 35 benign passed unhindered across 100 scenarios
Fireworks Inference Spend	$0.169 Total	Averaged $0.00169 per evaluation run across all semantic requests
Tier 1 In-Memory Latency	< 0.05 ms	Deterministic regex and AST rule evaluation on standard hardware

Disclosure on Historical Benchmark Context: In the original Phase 5D benchmark baseline, 15 ambiguous edge cases were allowed through under an earlier binary policy. This finding led directly to Veylith's hardened three-outcome policy (ALLOW, BLOCK, REVIEW/QUARANTINE) which routes ambiguous responses into safe quarantine without generating false positives on benign tools.

Developer Quickstart

Integrate in Minutes

Zero code changes required. Wrap any existing MCP server command in your configuration file.

# 1. Create a safe sandbox directory for tools
mkdir -p "$HOME/mcp-sandbox"
echo "Secure workspace notes" > "$HOME/mcp-sandbox/notes.txt"

# 2. Run any stdio MCP server directly through Veylith
npx veylith -- npx -y @modelcontextprotocol/server-filesystem "$HOME/mcp-sandbox"

# Or install globally:
npm install -g veylith

// ~/Library/Application Support/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "filesystem-secured": {
      "command": "npx",
      "args": [
        "-y",
        "veylith",
        "--",
        "npx",
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/Users/yourusername/mcp-sandbox"
      ]
    }
  }
}

// .cursor/mcp.json
{
  "mcpServers": {
    "filesystem-secured": {
      "command": "npx",
      "args": [
        "-y",
        "veylith",
        "--",
        "npx",
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/Users/yourusername/mcp-sandbox"
      ]
    }
  }
}

import { Client } from "@modelcontextprotocol/client";
import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";

const transport = new StdioClientTransport({
  command: "npx",
  args: [
    "-y", "veylith", "--",
    "npx", "-y", "@modelcontextprotocol/server-filesystem", "/Users/yourusername/mcp-sandbox"
  ]
});

const client = new Client({ name: "secure-agent", version: "1.0.0" }, { capabilities: {} });
await client.connect(transport);

// Invocations are automatically inspected & sanitized
const res = await client.callTool({ name: "read_file", arguments: { path: "/Users/yourusername/mcp-sandbox/notes.txt" } });

Security Model & Technical Limitations

Veylith is a research prototype (version 0.1.0-alpha.1) built for the Meta Global AI Developer Hackathon. It provides an application-layer defense-in-depth boundary; it does not replace operating-system sandboxing (such as Docker, Landlock, or process namespaces). Universal prompt injection immunity is an open research problem. Always run upstream MCP tools with minimal required OS privileges.