In-memory privacy shield to prevent context leaks in MCP tools

Rohan Protocol released version 0.6.0 of its open-source Model Context Protocol server, published on npm as @rohan-protocol/mcp, which evaluates MCP tool-call arguments in isolated client RAM and uses V-02 deterministic memory zeroization (zeroize) so plaintext parameters such as API keys and database passwords never enter the LLM context window. The public beta also enforces client-side RAM witness isolation and V-01 semantic policy firewalls, while native client-side WASM ZK-SNARK proving circuits remain under research as Milestone 1. The server exposes a single tool, rohan_zk_handshake, which strips prompt injections, generates a 32-byte intent commitment and anchors state transitions gaslessly to Midnight, and can be added to Claude Desktop via npx.

The in-memory security proxy preventing LLM context leaks, credential exfiltration, and prompt injections during tool execution. 📦 Official Open-Source MCP Server Monorepo The core Model Context Protocol MCP server implementation is located directly in this repository at packages/mcp/ https://github.com/rohan-protocol/sdk/blob/main/packages/mcp and distributed on npm as @rohan-protocol/mcp . Run from Source -running-the-mcp-server-from-source • MCP Tools -exposed-mcp-tools • Client Setup -universal-mcp-client-setup • Architecture -architecture • Security -security-register-threat--mitigation ⚠️ Public Beta v0.6.0 : Rohan currently enforces client-side RAM witness isolation, V-01 semantic policy firewalls, and V-02 deterministic memory zeroization zeroize to shield MCP tool calls while native client-side WASM ZK-SNARK proving circuits are under active research Milestone 1 . The Model Context Protocol MCP connects autonomous agents to tools. However, transport encryption TLS only protects data in flight — at the host boundary, standard MCP tools execute in cleartext: 🔴 WITHOUT ROHAN Standard MCP Agent calls tool ➔ { "api key": "sk live ...", "db password": "secret" } in plaintext ➔ Leaked directly into LLM conversation context & inference logs ➔ Permanent risk of context exfiltration & prompt injection 🟢 WITH ROHAN SHIELD Agent calls tool ➔ Arguments evaluated strictly in isolated client RAM ➔ V-02 Zeroize wipes witness memory immediately from volatile memory ➔ Zero plaintext parameters ever enter the model context window This repository contains the complete open-source MCP server implementation. You can clone and run the server locally over standard stdio: 1. Clone the repository git clone https://github.com/rohan-protocol/sdk.git cd sdk 2. Install dependencies & build packages npm install npm run build 3. Start the MCP Server directly over stdio node packages/mcp/dist/server.js Or run directly via npx without cloning: npx -y @rohan-protocol/mcp@latest The @rohan-protocol/mcp server registers standard Model Context Protocol tool endpoints over JSON-RPC: | MCP Tool | Description | Input Parameters | |---|---|---| | rohan zk handshake | Evaluates tool execution parameters in ephemeral RAM, strips prompt injections, generates a cryptographic 32-byte intent commitment, and anchors state transitions gaslessly to Midnight. | targetAgentId string , intent string , privatePayload object | Add rohan-shield to your claude desktop config.json : { "mcpServers": { "rohan-shield": { "command": "npx", "args": "-y", "@rohan-protocol/mcp@latest" , "env": { "ROHAN RELAYER URL": "https://api.rohanprotocol.network/api/v1/handshake" } } } } 1. Navigate to Settings → Features → MCP Servers → Add New MCP Server . 2. Set the name to rohan-shield . 3. Set the type to command . 4. Use the command: npx -y @rohan-protocol/mcp@latest rohan-protocol/sdk ├── packages/ │ ├── mcp/ 🤖 The Official Model Context Protocol MCP Server Stdio │ ├── sdk/ ⚙️ Core in-memory commitment engine & relayer client │ └── webmcp/ 🌐 React / Next.js browser hooks with V-07 DOM isolation ├── contracts/ 📜 Midnight Compact smart contracts rohan handshake.compact └── README.md ┌─────────────────────────────────────────────────────────────────────────────┐ │ AUTONOMOUS AGENT RUNTIME │ │ Claude Desktop / Cursor IDE / Custom Agent Workflows │ └──────────────────────────────────────┬──────────────────────────────────────┘ │ Tool Execution JSON-RPC ▼ ┌───────────────────────────────────────────────────────────────────────────┐ │ @rohan-protocol/mcp SERVER packages/mcp │ │ • Stdio MCP Protocol Server: Compliant with Anthropic MCP Specification │ │ • V-01 Semantic Firewall: Filters hidden Unicode & prompt injections │ └─────────────────────────────────────┬─────────────────────────────────────┘ │ In-Memory Witness ▼ ┌───────────────────────────────────────────────────────────────────────────┐ │ @rohan-protocol/sdk ENGINE packages/sdk │ │ • Ephemeral RAM Commitment 32-Byte Intent Hash │ │ • V-02 Deterministic Zeroize: Overwrites buffers immediately in memory │ │ • ZERO disk writes. ZERO swap-file exposure. │ └─────────────────────────────────────┬─────────────────────────────────────┘ │ Streamable HTTP NDJSON │ received ➔ approved ➔ proving ➔ anchored ▼ ┌───────────────────────────────────────────────────────────────────────────┐ │ ROHAN RELAYER PAYMASTER │ │ • Gasless Transaction Sponsoring $tDUST covered automatically │ │ • Scale-to-Zero Native No persistent SSE connection bottlenecks │ └─────────────────────────────────────┬─────────────────────────────────────┘ │ Immutable Replay Protection ▼ ┌───────────────────────────────────────────────────────────────────────────┐ │ MIDNIGHT BLOCKCHAIN LEDGER │ │ Contract: rohan handshake.compact Preprod: 585ac0c4448257507d8ffa2a... │ └───────────────────────────────────────────────────────────────────────────┘ | Threat ID | Threat Vector | Mitigation Mechanism | |---|---|---| | V-01 | Adversarial Prompt Injection | Pre-Prover Semantic Firewall: intercepts out-of-bounds payloads and strips zero-width Unicode injection characters \u200B-\u200D\uFEFF . | | V-02 | Residual Heap Exfiltration | Deterministic Memory Zeroize: multi-pass volatile memory wiping overwriting witness buffers with deterministic 0x00 byte patterns. | | V-05 | Persistent Socket Exhaustion | Scale-to-Zero NDJSON: uses chunked Streamable HTTP instead of long-lived SSE connections, allowing proxies to spin down on idle. | | V-07 | DOM / WebWorker Scraping | WebMCP Thread Isolation: isolates execution buffers inside WebWorkers, shielded from malicious third-party browser extensions. | The cryptographic foundations, threat registers, and formal mathematical proofs are documented in our research paper: Rohan: A Stateless Zero-Knowledge Trust Gateway for Privacy-Preserving Agentic Workflows via Streamable HTTP Model Context Protocol Working Group & Rohan Protocol Lab Published via Zenodo / IEEE Spec v2.0 • DOI: 10.5281/zenodo.22730240 We build in the open. - 🐛 Found a bug or bypass vector? Open a GitHub Issue. - ⭐️ Support: consider starring the repository to help other developers discover privacy-first MCP tools. <sub Licensed under the</sub