{ "markdown": "

\n \"mastyf.ai\n

\n\n

mastyf.ai

\n\n

Perimeter security for your AI.

\n\n

Runtime enforcement, policy control, and full audit trail for every AI action.

\n\n

\n Website ·\n Quick start ·\n Policy ·\n Dashboard ·\n GitHub\n

\n\n

\n\"License\"\n\"CI\"\n\"Version\"\n\"TypeScript\"\n\"npm\"\n

\n\n---\n\n## The problem\n\nAI agents can read your files, push code, query databases, execute shell commands, and call external APIs. They do it autonomously, at machine speed.\n\nTraditional security controls weren't built for that.\n\nMastyf.ai acts as a perimeter security layer for AI. It intercepts every tool call, evaluates it against your security policies using multi-agent swarm analysis, and blocks malicious or unauthorized actions before they execute.\n\nEvery decision is enforced, logged, and auditable.\n\n\n---\n\n## What it stops\n\n| Threat | What it looks like |\n|--------|--------------------|\n| Prompt injection | Malicious instructions embedded in tool arguments to hijack agent behavior |\n| Path traversal | Attempts to access `/etc/passwd`, `.ssh/id_rsa`, `.aws/credentials` |\n| Secret exfiltration | API keys and tokens leaking through tool arguments |\n| Shell injection | Reverse shells, `rm -rf`, encoded PowerShell commands |\n| Data exfiltration | Bulk SQL dumps, `git push`, `aws s3 cp`, unauthorized file transfers |\n| SSRF | Calls to metadata endpoints, localhost, and private IP ranges |\n| Encoding evasion | Base64 blobs and Unicode homoglyphs used to bypass pattern detection |\n| Cost abuse | Runaway agent loops burning through token budgets |\n| Rug-pull attacks | Tool definitions that silently change mid-session |\n\n---\n\n## Quick start\n\n### Build from source\n\nClone the repository and run the setup script.\n\n**Requirements:**\n- Git\n- Linux (the setup script installs Nix automatically if needed)\n\n```bash\ngit clone https://github.com/mastyf-ai/mastyf.ai.git\ncd mastyf.ai\nchmod +x setup.sh\n./setup.sh\n```\n\nThe setup script automatically:\n\n- Installs Nix (if required)\n- Enables Nix flakes\n- Creates the development environment\n- Installs all project dependencies\n- Rebuilds native packages\n- Builds the entire project\n- Adds a convenient `mastyf` shell alias\n\nOnce installation completes, start the proxy and dashboard:\n\n```bash\nnode dist/cli.js start\n```\n\nOr simply use the alias after opening a new terminal:\n\n```bash\nmastyf\n```\n\nThe dashboard will be available at:\n\n- Dashboard: http://localhost:4000\n\n---\n\n### Test the installation\n\nIf the dashboard is running, verify the HTTP bridge:\n\n```bash\ncurl -X POST http://localhost:4000/mcp -H \"Content-Type: application/json\" -d '{\"jsonrpc\":\"2.0\",\"id\":\"1\",\"method\":\"tools/list\",\"params\":{}}'\n```\n---\n\n## Dashboard\n\nFull visibility into every action your AI takes.\n\n\"20260628-1234-42\n\n---\n\n| Section | What you see |\n|---------|-------------|\n| Protection | Block rate, top triggered rules, live threat feed |\n| Activity | Every tool call with full arguments, allow or block status, timestamp |\n| Policy | Live rule editor with hot-reload from YAML |\n| Threat Lab | AI-suggested attack tests, reviewed and approved before anything applies |\n| Cost | Token usage and cost estimates broken down per tool call |\n\n\n\n> Do not expose port 4000 publicly without enabling dashboard auth. The default local dev config has `DASHBOARD_AUTH_DISABLED=true`.\n\n---\n\n## How enforcement works\n\nEvery tool call passes through three layers before it reaches your infrastructure.\n\n**Layer 1 - Pattern detection**\nRegex-based scanning for injection, dangerous paths, leaked secrets, shell commands, and encoding tricks. Runs in microseconds with no external dependencies.\n\n**Layer 2 - Schema validation**\nRejects malformed payloads, oversized arguments, and JSON-RPC violations before they reach policy evaluation.\n\n**Layer 3 - Semantic review**\nAn optional local LLM (Ollama) or cloud model evaluates borderline calls that pass pattern checks. Falls back to heuristics if no model is configured.\n\nAnything that fails is blocked. The tool never runs. Everything is logged.\n\n\"image\"\n\n\n---\n\n## Policy\n\nYour rules live in `default-policy.yaml`. You own them. mastyf.ai enforces them.\n\n```yaml\npolicy:\n mode: block\n default_action: pass\n unicode_strict: true\n rules:\n - name: block-sensitive-paths\n action: block\n argPatterns:\n - field: path\n patterns: ['^/etc/', '/\\.ssh', '/\\.aws/credentials']\n\n - name: rate-limit-tool-calls\n action: block\n maxCallsPerMinute: 120\n\n - name: block-shell-injection\n action: block\n patterns: ['rm\\s+-rf', 'curl\\s', 'wget\\s', '`[^`]+`']\n```\n\nRoll out safely with three enforcement modes:\n\n| Mode | Behavior | When to use |\n|------|----------|-------------|\n| `audit` | Log everything, block nothing | First week, understand what your AI does |\n| `warn` | Log and flag, still forwards | Tuning phase before enforcement |\n| `block` | Stops violations before execution | Production |\n\nPre-built templates for HIPAA, PCI-DSS, GxP, and data residency are in [`policy-templates/`](policy-templates/).\n\n\"image\"\n\n---\n\n## Architecture\n\nmastyf.ai runs two coordinated swarms. The CI Swarm attacks your policy before code ships. The Runtime Swarm enforces and learns from every live tool call in production. Four feedback loops connect them so the system gets harder to bypass over time.\n\n```mermaid\nflowchart TB\n\n AI[\"🤖 AI Clients\\nCursor · Claude Desktop · Cline\"]\n\n subgraph CI[\"🔵 CI Swarm (PR + Nightly)\"]\n direction LR\n Scout[\"🔍 Scout Agent\\nSAST, deps, config scan\"]\n Corpus[\"📋 Corpus Agent\\n228 fixtures eval\"]\n Evasion[\"⚡ Evasion Agent\\n120+ probes + generate new\"]\n Parity[\"🔄 Parity Agent\\nNode vs Python\"]\n ProxyA[\"🖥️ Proxy Agent\\nLive stdio MCP tests\"]\n Report[\"📊 Report Agent\\nsecurity-swarm/latest.json\"]\n Scout --> Corpus --> Evasion --> Parity --> ProxyA --> Report\n end\n\n subgraph Runtime[\"🟢 Runtime Swarm (Production Proxy)\"]\n direction LR\n BG[\"🛡️ BlockGuard\\nsync policy\"]\n IL[\"📈 InstantLearner\\nper-block stats + suggestions\"]\n SA[\"🧠 SemanticAuditor\\nasync LLM, optional\"]\n PS[\"🔗 PatternSynthesizer\\nbatch suggestions\"]\n Cal[\"⚙️ Calibrator\\nlabels + thresholds\"]\n BG --> IL --> PS --> Cal\n BG --> SA --> PS\n end\n\n Tools[\"🗄️ MCP Tools\\nfilesystem · GitHub · databases · APIs\"]\n\n AI -->|\"every tool call\"| BG\n BG -->|\"✅ allowed\"| Tools\n Report -->|\"🔁 Loop A: bypasses to corpus\"| Corpus\n Cal -->|\"🔁 Loop B: blocks to rules\"| BG\n Cal -->|\"🔁 Loop C: labels to LLM\"| SA\n Report -->|\"🔁 Loop D: CI metrics weekly\"| Cal\n\n style CI fill:#EFF6FF,stroke:#3B82F6,stroke-width:2px,color:#1E3A5F\n style Runtime fill:#F0FDF4,stroke:#22C55E,stroke-width:2px,color:#14532D\n style Scout fill:#DBEAFE,stroke:#3B82F6,color:#1E40AF\n style Corpus fill:#DBEAFE,stroke:#3B82F6,color:#1E40AF\n style Evasion fill:#DBEAFE,stroke:#3B82F6,color:#1E40AF\n style Parity fill:#DBEAFE,stroke:#3B82F6,color:#1E40AF\n style ProxyA fill:#DBEAFE,stroke:#3B82F6,color:#1E40AF\n style Report fill:#DBEAFE,stroke:#3B82F6,color:#1E40AF\n style BG fill:#BBF7D0,stroke:#16A34A,color:#14532D\n style IL fill:#BBF7D0,stroke:#16A34A,color:#14532D\n style SA fill:#BBF7D0,stroke:#16A34A,color:#14532D\n style PS fill:#BBF7D0,stroke:#16A34A,color:#14532D\n style Cal fill:#BBF7D0,stroke:#16A34A,color:#14532D\n style AI fill:#FEF3C7,stroke:#F59E0B,stroke-width:2px,color:#78350F\n style Tools fill:#FEF3C7,stroke:#F59E0B,stroke-width:2px,color:#78350F\n```\n\n**Canonical gates:** 228/228 corpus, 0 bypasses, 100% parity\n\n### CI Swarm\n\nRuns on every PR and nightly. Six agents work in sequence, each one hardening what the previous found.\n\n| Agent | What it does |\n|-------|-------------|\n| Scout | SAST scan, dependency audit, config review |\n| Corpus | Evaluates all 228 attack fixtures against current policy |\n| Evasion | Runs 120+ bypass probes and generates novel ones using an LLM |\n| Parity | Verifies Node and Python implementations produce identical decisions |\n| Proxy | Live stdio MCP session tests against a running proxy instance |\n| Report | Writes `security-swarm/latest.json` with full results and metrics |\n\n### Runtime Swarm\n\nRuns inside the production proxy on every tool call.\n\n| Component | What it does |\n|-----------|-------------|\n| BlockGuard | Enforces the active policy synchronously on every call. Fail-closed. |\n| InstantLearner | Tracks per-block statistics and surfaces rule suggestions in real time |\n| SemanticAuditor | Optional async LLM review for calls that clear pattern checks but look suspicious |\n| PatternSynthesizer | Batches suggestions from InstantLearner and SemanticAuditor into candidate rules |\n| Calibrator | Labels candidates, tunes thresholds, and promotes approved rules back into BlockGuard |\n\n### Feedback loops\n\n| Loop | Signal | Effect |\n|------|--------|--------|\n| A | CI bypass found | Added to corpus, CI now guards against it permanently |\n| B | Runtime block pattern | Synthesized into a new rule, promoted to BlockGuard |\n| C | Calibrator label | Used to fine-tune SemanticAuditor thresholds |\n| D | CI metrics (weekly) | Updates runtime config — keeps CI and production in sync |\n\nThe proxy supports five transports: stdio, HTTP, SSE, streamable HTTP, and WebSocket.\n\nFor enterprise deployments with Redis, Postgres, and Kubernetes see [`docs/ENTERPRISE_DEPLOYMENT.md`](docs/ENTERPRISE_DEPLOYMENT.md).\n\n---\n\n## Threat Lab\n\nThreat Lab watches live traffic and uses a local LLM to propose new attack test cases when it detects suspicious patterns. Nothing is applied automatically. You review and approve every suggestion in the dashboard before it becomes a rule.\n\nApproved discoveries feed back into the CI attack corpus for ongoing regression testing.\n\n```bash\nollama serve\nollama pull qwen3:8b\n\nexport OLLAMA_BASE_URL=http://127.0.0.1:11434\nexport MASTYF_AI_LLM_PROVIDER=ollama\nexport MASTYF_AI_LLM_MODEL=qwen3:8b\n\npnpm dashboard:proxy\n```\n\"image\"\n\n---\n\n## MCP package trust scores\n\nBefore installing any MCP server from npm, check its trust score at [https://www.mastyf.ai/certified](https://www.mastyf.ai/certified). Scores cover CVE exposure, typo-squat risk, maintainer signals, and known attack patterns. Free, no account required.\n\n---\n\n## Common commands\n\n| Command | What it does |\n|---------|-------------|\n| `node dist/cli.js start` | Start proxy and dashboard on port 4000 |\n| `node dist/cli.js onboard` | Wrap your MCP config to route through the proxy |\n| `node dist/cli.js doctor` | Health check for DB, policy, and environment |\n| `node dist/cli.js scan --all` | Scan MCP configs for CVEs and injection risks |\n| `pnpm test` | Run the full test suite |\n| `pnpm security-swarm:fast` | Quick security regression, 5 to 15 minutes |\n| `pnpm security-swarm:analyze` | Full adversarial analysis |\n\n---\n\n## Troubleshooting\n\n| Problem | Fix |\n|---------|-----|\n| Dashboard shows no data | Proxy and dashboard must share the same `MASTYF_AI_DB_PATH`. Default is `~/.mastyf-ai/history.db` |\n| `dist/cli.js` not found | Run `pnpm build` |\n| AI still hitting tools directly | Run `node dist/cli.js onboard --apply` |\n| Ollama warnings at startup | Run `ollama serve` or remove `MASTYF_AI_LLM_PROVIDER` from your environment |\n| npm install fails | npm publish is not live yet. Use `git clone` and `pnpm install` |\n\n---\n\n## Learn more\n\n- [Enterprise deployment (Redis, Postgres, Helm)](docs/ENTERPRISE_DEPLOYMENT.md)\n- [Defense pipeline in depth](docs/DEFENSE_FABRIC.md)\n- [Security Swarm and CI red teaming](security-swarm/README.md)\n- [Real-world MCP integration examples](docs/REAL_WORLD_INTEGRATION.md)\n- [Core detection engine](packages/core/README.md)\n\n\n", "bytes": 13055, "sha": "59317dfcdb06e10cad25962ee35945a86ba1ae8a5e4d13b3b1df88764518f4e4", "repo_slug": "mastyf-ai/mastyf.ai", "fonte": "repo", "truncated": false, "api": "https://agentalog.com/api/listings/mcp_io_github_mastyf_ai_mastyf_ai_7361b6b4/readme" }