The in-memory security proxy preventing LLM context leaks, credential exfiltration, and prompt injections during tool execution.
📦 Official Open-Source MCP Server Monorepo
The core Model Context Protocol (MCP) server implementation is located directly in this repository at packages/mcp/ and distributed on npm as @rohan-protocol/mcp.
Run from Source • MCP Tools • Client Setup • Architecture • Security
⚠️ Public Beta (v0.6.0): Rohan currently enforces client-side RAM witness isolation, V-01 semantic policy firewalls, and V-02 deterministic memory zeroization (zeroize) to shield MCP tool calls while native client-side WASM ZK-SNARK proving circuits are under active research (Milestone 1).
The Model Context Protocol (MCP) connects autonomous agents to tools. However, transport encryption (TLS) only protects data in flight — at the host boundary, standard MCP tools execute in cleartext:
🔴 WITHOUT ROHAN (Standard MCP)
Agent calls tool ➔ { "api_key": "sk_live_...", "db_password": "secret" } in plaintext
➔ Leaked directly into LLM conversation context & inference logs
➔ Permanent risk of context exfiltration & prompt injection
🟢 WITH ROHAN SHIELD
Agent calls tool ➔ Arguments evaluated strictly in isolated client RAM
➔ V-02 Zeroize wipes witness memory immediately from volatile memory
➔ Zero plaintext parameters ever enter the model context window
This repository contains the complete open-source MCP server implementation. You can clone and run the server locally over standard stdio:
git clone https://github.com/rohan-protocol/sdk.git
cd sdk
npm install
npm run build
node packages/mcp/dist/server.js
Or run directly via npx without cloning:
npx -y @rohan-protocol/mcp@latest
The @rohan-protocol/mcp server registers standard Model Context Protocol tool endpoints over JSON-RPC:
| MCP Tool | Description | Input Parameters |
|---|---|---|
rohan_zk_handshake |
Evaluates tool execution parameters in ephemeral RAM, strips prompt injections, generates a cryptographic 32-byte intent commitment, and anchors state transitions gaslessly to Midnight. | targetAgentId (string),intent (string),privatePayload (object) |
Add rohan-shield to your claude_desktop_config.json:
{
"mcpServers": {
"rohan-shield": {
"command": "npx",
"args": ["-y", "@rohan-protocol/mcp@latest"],
"env": {
"ROHAN_RELAYER_URL": "https://api.rohanprotocol.network/api/v1/handshake"
}
}
}
}
- Navigate to Settings → Features → MCP Servers → Add New MCP Server .
- Set the name to
rohan-shield. - Set the type to
command. - Use the command:
npx -y @rohan-protocol/mcp@latest
rohan-protocol/sdk
├── packages/
│ ├── mcp/ # 🤖 The Official Model Context Protocol (MCP) Server (Stdio)
│ ├── sdk/ # ⚙️ Core in-memory commitment engine & relayer client
│ └── webmcp/ # 🌐 React / Next.js browser hooks with V-07 DOM isolation
├── contracts/ # 📜 Midnight Compact smart contracts (rohan_handshake.compact)
└── README.md
┌─────────────────────────────────────────────────────────────────────────────┐
│ AUTONOMOUS AGENT RUNTIME │
│ Claude Desktop / Cursor IDE / Custom Agent Workflows │
└──────────────────────────────────────┬──────────────────────────────────────┘
│ Tool Execution (JSON-RPC)
▼
┌───────────────────────────────────────────────────────────────────────────┐
│ [@rohan-protocol/mcp] SERVER (packages/mcp) │
│ • Stdio MCP Protocol Server: Compliant with Anthropic MCP Specification │
│ • V-01 Semantic Firewall: Filters hidden Unicode & prompt injections │
└─────────────────────────────────────┬─────────────────────────────────────┘
│ In-Memory Witness
▼
┌───────────────────────────────────────────────────────────────────────────┐
│ [@rohan-protocol/sdk] ENGINE (packages/sdk) │
│ • Ephemeral RAM Commitment (32-Byte Intent Hash) │
│ • V-02 Deterministic Zeroize: Overwrites buffers immediately in memory │
│ • ZERO disk writes. ZERO swap-file exposure. │
└─────────────────────────────────────┬─────────────────────────────────────┘
│ Streamable HTTP (NDJSON)
│ received ➔ approved ➔ proving ➔ anchored
▼
┌───────────────────────────────────────────────────────────────────────────┐
│ ROHAN RELAYER PAYMASTER │
│ • Gasless Transaction Sponsoring ($tDUST covered automatically) │
│ • Scale-to-Zero Native (No persistent SSE connection bottlenecks) │
└─────────────────────────────────────┬─────────────────────────────────────┘
│ Immutable Replay Protection
▼
┌───────────────────────────────────────────────────────────────────────────┐
│ MIDNIGHT BLOCKCHAIN LEDGER │
│ Contract: rohan_handshake.compact (Preprod: 585ac0c4448257507d8ffa2a...) │
└───────────────────────────────────────────────────────────────────────────┘
| Threat ID | Threat Vector | Mitigation Mechanism |
|---|---|---|
| V-01 | Adversarial Prompt Injection | Pre-Prover Semantic Firewall: intercepts out-of-bounds payloads and strips zero-width Unicode injection characters ([\u200B-\u200D\uFEFF]). |
| V-02 | Residual Heap Exfiltration | Deterministic Memory Zeroize: multi-pass volatile memory wiping overwriting witness buffers with deterministic 0x00 byte patterns. |
| V-05 | Persistent Socket Exhaustion | Scale-to-Zero NDJSON: uses chunked Streamable HTTP instead of long-lived SSE connections, allowing proxies to spin down on idle. |
| V-07 | DOM / WebWorker Scraping | WebMCP Thread Isolation: isolates execution buffers inside WebWorkers, shielded from malicious third-party browser extensions. |
The cryptographic foundations, threat registers, and formal mathematical proofs are documented in our research paper:
Rohan: A Stateless Zero-Knowledge Trust Gateway for Privacy-Preserving Agentic Workflows via Streamable HTTP
Model Context Protocol Working Group & Rohan Protocol Lab
Published via Zenodo / IEEE Spec v2.0 • DOI: 10.5281/zenodo.22730240
We build in the open.
- 🐛 Found a bug or bypass vector? Open a GitHub Issue.
- ⭐️ Support: consider starring the repository to help other developers discover privacy-first MCP tools.
<sub>Licensed under the</sub>