{"slug": "in-memory-privacy-shield-to-prevent-context-leaks-in-mcp-tools", "title": "In-memory privacy shield to prevent context leaks in MCP tools", "summary": "Rohan Protocol released version 0.6.0 of its open-source Model Context Protocol server, published on npm as @rohan-protocol/mcp, which evaluates MCP tool-call arguments in isolated client RAM and uses V-02 deterministic memory zeroization (zeroize) so plaintext parameters such as API keys and database passwords never enter the LLM context window. The public beta also enforces client-side RAM witness isolation and V-01 semantic policy firewalls, while native client-side WASM ZK-SNARK proving circuits remain under research as Milestone 1. The server exposes a single tool, rohan_zk_handshake, which strips prompt injections, generates a 32-byte intent commitment and anchors state transitions gaslessly to Midnight, and can be added to Claude Desktop via npx.", "body_md": "**The in-memory security proxy preventing LLM context leaks, credential exfiltration, and prompt injections during tool execution.**\n\n📦 **Official Open-Source MCP Server Monorepo**\n\nThe core Model Context Protocol (MCP) server implementation is located directly in this repository at [`packages/mcp/`](https://github.com/rohan-protocol/sdk/blob/main/packages/mcp) and distributed on npm as **`@rohan-protocol/mcp`**.\n\n[Run from Source](#-running-the-mcp-server-from-source) • [MCP Tools](#-exposed-mcp-tools) • [Client Setup](#-universal-mcp-client-setup) • [Architecture](#-architecture) • [Security](#-security-register-threat--mitigation)\n\n⚠️ Public Beta (v0.6.0): Rohan currently enforces client-side RAM witness isolation, V-01 semantic policy firewalls, and V-02 deterministic memory zeroization (zeroize) to shield MCP tool calls while native client-side WASM ZK-SNARK proving circuits are under active research (Milestone 1).\n\nThe Model Context Protocol (MCP) connects autonomous agents to tools. However, transport encryption (TLS) only protects data in flight — at the host boundary, standard MCP tools execute in cleartext:\n\n```\n🔴 WITHOUT ROHAN (Standard MCP)\nAgent calls tool ➔ { \"api_key\": \"sk_live_...\", \"db_password\": \"secret\" } in plaintext\n                 ➔ Leaked directly into LLM conversation context & inference logs\n                 ➔ Permanent risk of context exfiltration & prompt injection\n\n🟢 WITH ROHAN SHIELD\nAgent calls tool ➔ Arguments evaluated strictly in isolated client RAM\n                 ➔ V-02 Zeroize wipes witness memory immediately from volatile memory\n                 ➔ Zero plaintext parameters ever enter the model context window\n```\n\nThis repository contains the complete open-source MCP server implementation. You can clone and run the server locally over standard stdio:\n\n```\n# 1. Clone the repository\ngit clone https://github.com/rohan-protocol/sdk.git\ncd sdk\n\n# 2. Install dependencies & build packages\nnpm install\nnpm run build\n\n# 3. Start the MCP Server directly over stdio\nnode packages/mcp/dist/server.js\n```\n\nOr run directly via `npx` without cloning:\n\n```\nnpx -y @rohan-protocol/mcp@latest\n```\n\nThe `@rohan-protocol/mcp` server registers standard Model Context Protocol tool endpoints over JSON-RPC:\n\n| MCP Tool | Description | Input Parameters | \n|---|---|---|\n| `rohan_zk_handshake` | Evaluates tool execution parameters in ephemeral RAM, strips prompt injections, generates a cryptographic 32-byte intent commitment, and anchors state transitions gaslessly to Midnight. | `targetAgentId` (string),`intent` (string),`privatePayload` (object) | \n\nAdd `rohan-shield` to your `claude_desktop_config.json`:\n\n```\n{\n  \"mcpServers\": {\n    \"rohan-shield\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@rohan-protocol/mcp@latest\"],\n      \"env\": {\n        \"ROHAN_RELAYER_URL\": \"https://api.rohanprotocol.network/api/v1/handshake\"\n      }\n    }\n  }\n}\n```\n\n1. Navigate to **Settings → Features → MCP Servers → Add New MCP Server** .\n2. Set the name to **`rohan-shield`** .\n3. Set the type to **`command`** .\n4. Use the command: `npx -y @rohan-protocol/mcp@latest`\n\n```\nrohan-protocol/sdk\n├── packages/\n│   ├── mcp/         # 🤖 The Official Model Context Protocol (MCP) Server (Stdio)\n│   ├── sdk/         # ⚙️ Core in-memory commitment engine & relayer client\n│   └── webmcp/      # 🌐 React / Next.js browser hooks with V-07 DOM isolation\n├── contracts/       # 📜 Midnight Compact smart contracts (rohan_handshake.compact)\n└── README.md\n┌─────────────────────────────────────────────────────────────────────────────┐\n│                           AUTONOMOUS AGENT RUNTIME                          │\n│               Claude Desktop / Cursor IDE / Custom Agent Workflows          │\n└──────────────────────────────────────┬──────────────────────────────────────┘\n                                       │ Tool Execution (JSON-RPC)\n                                       ▼\n ┌───────────────────────────────────────────────────────────────────────────┐\n │                  [@rohan-protocol/mcp] SERVER (packages/mcp)              │\n │  • Stdio MCP Protocol Server: Compliant with Anthropic MCP Specification  │\n │  • V-01 Semantic Firewall: Filters hidden Unicode & prompt injections     │\n └─────────────────────────────────────┬─────────────────────────────────────┘\n                                       │ In-Memory Witness\n                                       ▼\n ┌───────────────────────────────────────────────────────────────────────────┐\n │                  [@rohan-protocol/sdk] ENGINE (packages/sdk)              │\n │  • Ephemeral RAM Commitment (32-Byte Intent Hash)                         │\n │  • V-02 Deterministic Zeroize: Overwrites buffers immediately in memory   │\n │  • ZERO disk writes. ZERO swap-file exposure.                             │\n └─────────────────────────────────────┬─────────────────────────────────────┘\n                                       │ Streamable HTTP (NDJSON)\n                                       │ received ➔ approved ➔ proving ➔ anchored\n                                       ▼\n ┌───────────────────────────────────────────────────────────────────────────┐\n │                       ROHAN RELAYER PAYMASTER                             │\n │  • Gasless Transaction Sponsoring ($tDUST covered automatically)          │\n │  • Scale-to-Zero Native (No persistent SSE connection bottlenecks)        │\n └─────────────────────────────────────┬─────────────────────────────────────┘\n                                       │ Immutable Replay Protection\n                                       ▼\n ┌───────────────────────────────────────────────────────────────────────────┐\n │                      MIDNIGHT BLOCKCHAIN LEDGER                           │\n │  Contract: rohan_handshake.compact (Preprod: 585ac0c4448257507d8ffa2a...) │\n └───────────────────────────────────────────────────────────────────────────┘\n```\n\n| Threat ID | Threat Vector | Mitigation Mechanism | \n|---|---|---|\n| V-01 | Adversarial Prompt Injection | Pre-Prover Semantic Firewall: intercepts out-of-bounds payloads and strips zero-width Unicode injection characters ([\\u200B-\\u200D\\uFEFF]). | \n| V-02 | Residual Heap Exfiltration | Deterministic Memory Zeroize: multi-pass volatile memory wiping overwriting witness buffers with deterministic `0x00` byte patterns. | \n| V-05 | Persistent Socket Exhaustion | Scale-to-Zero NDJSON: uses chunked Streamable HTTP instead of long-lived SSE connections, allowing proxies to spin down on idle. | \n| V-07 | DOM / WebWorker Scraping | WebMCP Thread Isolation: isolates execution buffers inside WebWorkers, shielded from malicious third-party browser extensions. | \n\nThe cryptographic foundations, threat registers, and formal mathematical proofs are documented in our research paper:\n\nRohan: A Stateless Zero-Knowledge Trust Gateway for Privacy-Preserving Agentic Workflows via Streamable HTTP\n\nModel Context Protocol Working Group & Rohan Protocol Lab\n\nPublished via Zenodo / IEEE Spec v2.0 • DOI: 10.5281/zenodo.22730240\n\nWe build in the open.\n\n- 🐛 Found a bug or bypass vector? Open a GitHub Issue.\n- ⭐️ Support: consider starring the repository to help other developers discover privacy-first MCP tools.\n\n<sub>Licensed under the</sub>", "url": "https://wpnews.pro/news/in-memory-privacy-shield-to-prevent-context-leaks-in-mcp-tools", "canonical_source": "https://github.com/rohan-protocol/sdk", "published_at": "2026-10-20 15:05:53+00:00", "updated_at": "2026-10-20 15:16:51.950108+00:00", "lang": "en", "topics": ["ai-agents", "agent-protocols", "ai-safety", "ai-tools", "developer-tools"], "entities": ["Rohan Protocol", "@rohan-protocol/mcp", "Model Context Protocol", "Claude Desktop", "Cursor", "Midnight", "rohan_zk_handshake", "npm"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/in-memory-privacy-shield-to-prevent-context-leaks-in-mcp-tools", "markdown": "https://wpnews.pro/news/in-memory-privacy-shield-to-prevent-context-leaks-in-mcp-tools.md", "text": "https://wpnews.pro/news/in-memory-privacy-shield-to-prevent-context-leaks-in-mcp-tools.txt", "jsonld": "https://wpnews.pro/news/in-memory-privacy-shield-to-prevent-context-leaks-in-mcp-tools.jsonld"}}