Two independent pipelines — one inspecting everything your agents send, one inspecting everything their tools send back. Every stage of both, and what each is built to catch.
Every MCP message — request and response — passes through an independent stack of detectors.
Tenant-scoped business rules — agent permissions, identity scopes, tool boundaries, time windows, rate limits. Pre-built defaults or fully custom; respected by every tier downstream.
Pattern matching across the full known-attack corpus — prompt injections, credential theft attempts, URL exfiltration, command injection. Maintained against the relevant threat catalogues.
Attacks that disguise themselves: Unicode tricks, base64 and hex encoding, invisible characters, homoglyph substitution, RTL overrides. Decoded and normalised before re-inspection.
AI-powered semantic analysis catches polite-but-malicious intent — the attack that reads as a normal request to a regex but is engineered to subvert the agent's reasoning. Detection runs against contrastive pairs — attack examples scored against a calibrated benign corpus where grey-zone cases are explicitly tagged with the attack category they're designed to disambiguate. Coverage maps to OWASP Agentic Top 10 and MITRE ATLAS, so every signal carries a technique ID your SOC already recognises.
Tracks what each agent normally does — message volume, tool mix, time-of-day, sender geography, parameter ranges — and flags anomalies. The agent that suddenly tries to read the entire customer table at 3am gets stopped.
A small, fast AI model trained specifically on security threats — not a generalist LLM. Used for the residual edge cases the deterministic tiers couldn't decide on.
The request side asks whether a message is a known attack. The response side asks a different question: does what came back match what was asked — and is it safe for the agent, the user, and every downstream system? Five stages, every one correlated to the request that triggered it.
Before any content is parsed, size caps, decompression-ratio limits, and nesting-depth checks bound what a tool can return. An expansion bomb or a response that violates the rate floor is stopped here, before it can exhaust the agent or hide a payload in sheer volume.
Every response is classified — a normal result, a notification, or a server-initiated request — and each content block is routed by where it is going. A block destined for the model is inspected differently from a URL the agent might fetch or a file a human will open. The routing decides which detectors run.
Version-aware validation of the JSON-RPC envelope: the response must match the protocol version negotiated at initialize, carry no unexpected fields, and arrive within a plausible time window for the tool. Structural anomalies surface before content inspection even begins.
Content is inspected by destination, not just by pattern. Track A scans model-visible text for instruction injection, soft influence, hidden Unicode, leaked credentials, and execution bait. Track B validates structured data against the tool's declared output schema — catching responses that violate it, tools that declare a schema then return text to evade it, and field values that don't fit their role, like a shell command in a description or an injection payload in an ID. Track C treats every returned URL as a deferred attack — blocking dangerous schemes, private-network targets, credentials in query strings, and path traversal. Track D catches what a human or downstream system will render: inline scripts, CSV formula injection, Trojan-Source bidi, SVG-embedded JavaScript.
The stage that has no request-side equivalent. Every response is compared against the request that triggered it: do the IDs and parameters that were asked for actually appear? Is the response proportionate in size and sensitivity to what was requested? Does a read-only query come back with instructions to act, foreign-tenant identifiers, or unexpected side effects? Individually clean content that doesn't match the request is exactly how a compromised tool hides — this is where it surfaces.
Two surfaces, two purpose-built detector sets. Both fire inline before the agent or the tool sees the message — every signal logged for audit.
Every detection in the pipeline carries a technique ID and a category mapping. OWASP for the threat taxonomy your SOC already speaks. MITRE ATLAS for kill-chain analysis. The compliance frameworks your auditor will ask about. We publish the mappings — your team verifies coverage, not us.
Every detection pattern carries an OWASP LLM Top 10 category ID, so each alert lands in the taxonomy your SOC already speaks. The mapping is regenerated against the current codebase on every release — and published for your team to check.
Every alert ships with its MITRE ATLAS technique ID, so it drops straight into the kill-chain analysis your threat hunters already run — from prompt injection through tool-based exfiltration.
The MCP response path runs an independent inspection pipeline. Each gate carries Adversa AI MCP, OWASP, MITRE ATLAS, and CWE category metadata — schema drift, rug pulls, instruction injection in tool results, undeclared capability use, transport substitution.
Article 12 — high-risk system logging. Article 13 — transparency obligations. Regulation (EU) 2024/1689 — high-risk enforcement deferred to December 2027 under the Digital Omnibus.
The tamper-evident audit chain produces evidence mapped to the control families your auditor works from — SOC 2 security, availability and confidentiality criteria, and ISO/IEC 27001 Annex A.12 (logging) and A.16 (incident management) — so the evidence is ready when your attestation work begins. The controls map to CheckedAgent; the certification stays yours.
Detection-category-to-framework matrices are versioned and public. Reproduce them against our regression corpus in your environment before you sign anything.
The Detection Event Log is the single timeline of every agent communication CheckedAgent has inspected. Pass, block, or flag — every record carries the agent identity, the threat signature, the tier that caught it, and a cryptographic signature.
30-minute walkthrough with a security engineer — not a sales rep. We'll show the full pipeline, run your suspected attack patterns through it, and answer the questions your auditor is already asking.