An agent may have valid IAM access and still do something inappropriate[span_11](start_span)[span_11](end_span). Cloud gateways stop at tool allowlists. RCF evaluates payload semantics inline over stdio, preventing authorized agents from producing destructive real-world side effects.
Every tool discovery and execution frame passes through 14 compiled Go security engines before a single byte reaches the upstream MCP server.
Intercepts tools/list on the wire, strips unauthorized tools so the LLM never knows they exist, and ranks schemas via Okapi BM25 to cut token costs by 94%.
Decodes JSON \uXXXX and double URL-encoding (%252e%252e%252f), evaluates Shannon byte entropy (>6.2 bits/byte), and traps canary honeypot tools.
High-risk payloads are detonated inside a memory-isolated wazero WebAssembly micro-VM with zero host filesystem or network mounts, then vaporized cleanly.
Freezes execution mid-flight and spawns an air-gapped macOS (osascript) or Windows native caution modal—or routes to the CISO Cloud Approval Queue.
Deploy in Shadow Mode on Day 1 to measure simulated blocks across your engineering fleet, then promote Ed25519-signed least-privilege rules with 1-Click Hot-Reload.
Chains every record via RFC 6962 Merkle trees, Post-Quantum Hybrid Lattice signatures, and ZKP commitments while streaming gen_ai.* logs to Datadog & Splunk.
RCF complements your existing SIEM (Datadog, Splunk, Sentinel) by enforcing zero-trust governance at the local protocol edge where cloud SDKs cannot reach.
| Security & Performance Capability | RCF v2.0 Antimatter | Cloud APM AI Guards (e.g. Datadog AI Guard) | Cloud Prompt APIs (e.g. Lakera / Arthur) | Basic Open-Source MCP Gateways |
|---|---|---|---|---|
Protects Local stdio Desktop Apps (Claude, Cursor, VS Code, LM Studio) | ✓ 1-Click Auto-Wrap (9 Platforms) | ✕ Requires custom code SDK instrumentation | ✕ Cloud REST API only | Manual JSON config editing |
| Inspection Latency Overhead | 0.08ms (1.16M frames/sec local Go) | 650ms – 1,300ms cloud roundtrip | 300ms – 800ms HTTP call | 15ms – 50ms (Python/Node) |
| Payload Sovereignty (Zero Raw Prompts/PII Sent to Cloud) | ✓ 100% SHA-256 & ZKP Commitments | ✕ Ships raw prompt & tool content to cloud | ✕ Ships raw text to third-party API | Logs plaintext locally |
| Pre-Execution Ephemeral Wasm Micro-VM Detonation | ✓ Built-in (wazero default-deny) | ✕ None | ✕ None | ✕ None |
| Air-Gapped Native macOS / Windows HITL Approval Dialogs | ✓ Native OS Caution Modal + Cloud Queue | ✕ None | ✕ None | ✕ Terminal CLI only |
| Okapi BM25 Context Router (Token Cost Reduction) | ✓ 94% – 99.4% Schema Pruning | ✕ None | ✕ None | ✕ None |
| SEC Rule 17a-4 WORM Export & Offline Cryptographic Verifier | ✓ Merkle + Ed25519 + PQC Verifier CLI | ✕ Standard mutable cloud logs | ✕ None | ✕ None |
While v2.0 locks down the MCP execution plane today, Founding Enterprise Partners gain early access to our v3.0 kernel and hardware-enforced capabilities:
Instant APFS/btrfs copy-on-write snapshots and SQL savepoints before every approved tool mutation, enabling 1-click consequence reversal.
Cryptographic taint propagation across multi-agent swarms so untrusted web/email reads cannot trigger downstream privileged tools.
Kernel-space socket/file Wireguard hooks (BPF_LSM) paired with 5ms hardware KVM micro-VM detonation.
Hardware-bound LocalAuthentication TouchID / Apple Watch unlock required for Tier-0 production mutations.