{"slug": "sub-ms-deterministic-parsing-vs-llm-based-policy-for-agent-safety", "title": "Sub-ms deterministic parsing vs. LLM-based policy for agent safety?", "summary": "Independent developer Midhun Sekhar released MiSeGuard, a deterministic safety layer that proxies Model Context Protocol (MCP) tool calls for autonomous coding agents such as Cursor, Claude Code, Antigravity, OpenCode and Windsurf, scoring each invocation on a 0–100 Blast-Radius Risk Score in sub-millisecond time with no LLM in the loop. MiSeGuard installs via npm (Node.js 18.0 or later) and blocks commands scoring 70–100 with exit code 1, dry-runs commands scoring 30–69 with exit code 2 in strict mode, and allows commands scoring 0–29 with exit code 0, with exit codes guaranteed stable across versions for CI/CD and pre-commit hooks. The project ships a starter config with an allowlist and protected paths including .env*, *.pem, *.key, id_rsa*, ~/.ssh/*, ~/.aws/* and ~/.kube/*, and is not affiliated with any employer of its author.", "body_md": "**Disclaimer**\n\nMiSeGuard is an independent personal project created by Midhun Sekhar. It is not affiliated with, endorsed by, or representative of any current, past, or future employer. All development was conducted entirely on personal equipment, during personal time, and without the use of proprietary resources or confidential information.\n\n**A deterministic safety layer for autonomous coding agents.**\n\n*Runtime circuit breaker and stdio proxy that intercepts MCP tool calls before they reach your OS.*\n\n**AI coding agents can modify your machine. MiSeGuard puts a deterministic security boundary between the agent and your tools.**\n\n**What is MCP?**\nThe Model Context Protocol (MCP) is an open standard that lets autonomous AI agents (such as **Cursor, Claude Code, Antigravity, OpenCode, Windsurf**) invoke external tools (bash, filesystem, git, terminal) over stdio JSON-RPC 2.0. **MiSeGuard** sits as a transparent, sub-millisecond proxy between your agent and those tool runtimes to inspect, score, and block destructive operations before they reach the real operating system.\n\n**What Does \"Deterministic\" Mean?**\nThe same command or file mutation with the same configuration always produces the exact identical risk score. **No LLM in the loop, no non-deterministic inference, no prompt drift.**\n\n```\n# Global install (recommended for CLI use)\nnpm install -g miseguard\n\n# Or run directly via npx\nnpx miseguard --help\n\n# Or add as a project dev dependency\nnpm install --save-dev miseguard\n```\n\n**Requirements:** Node.js 18.0 or later.\n\n```\nmiseguard init\n```\n\nChoose the method that matches your workflow:\n\n- **Starting fresh or configuring an agent GUI?** Use`snippet` to generate copy-pasteable JSON:\n\n```\nmiseguard snippet --tool filesystem --path .\n```\n\n- **Already have an existing MCP configuration file?** Use`wrap-config <file-path>` to automatically rewrite and back up your config in place:\n\n```\n# Pass the explicit path to your agent's config file:\nmiseguard wrap-config .antigravity/mcp.json\nmiseguard wrap-config \"%APPDATA%\\Claude\\claude_desktop_config.json\"\n\n# Or omit path to auto-detect mcp.json / .cursor/mcp.json in current directory:\nmiseguard wrap-config\nmiseguard check \"rm -rf /\"     # 🛑 Exit Code 1: Blocked\nmiseguard check \"git status\"    # 🟢 Exit Code 0: Safe\n```\n\nMiSeGuard computes a multi-factor **Blast-Radius Risk Score (0–100)** for every tool invocation.\n\n| Level | Score | `strict` Mode | `permissive` Mode | Action | Trigger Examples | \n|---|---|---|---|---|---|\n| 🟢 **GREEN** | `0 - 29` | **Exit `0`** | **Exit `0`** | **ALLOW** | `git status` ,`ls -la` ,`npm test` ,`tsc --noEmit` , safe file edits | \n| 🟡 **YELLOW** | `30 - 69` | **Exit `2`** | **Exit `0`** (Warning) | **DRY-RUN** | `npm install -g` ,`chmod -R` ,`kill` ,`npm publish` ,`package.json` updates | \n| 🔴 **RED** | `70 - 100` | **Exit `1`** | **Exit `1`** | **BLOCK** | `rm -rf /` ,`git reset --hard` ,`cat .env` ,`curl ... \\| bash` ,`nc -e /bin/sh` ,`delete_file .env` | \n\n📌 **CLI Exit Code Stability Contract:**\n\n`0`: Safe operation (Green) or permitted in permissive mode.\n`1`: Dangerous operation blocked by circuit breaker (Red).\n`2`: Caution operation triggering dry-run in strict mode (Yellow).\n`3`: Internal parsing or configuration error.\n*Exit codes are stable and guaranteed across versions for CI/CD and pre-commit hook integration.*\n\nGenerate a starter configuration file in your project:\n\n```\nmiseguard init\n{\n  \"$schema\": \"https://raw.githubusercontent.com/midhunweb/miseguard/main/schema.json\",\n  \"mode\": \"strict\",\n  \"thresholds\": {\n    \"block\": 70,\n    \"dryRun\": 30\n  },\n  \"allowlist\": [\n    \"echo *\",\n    \"git log*\",\n    \"git status*\",\n    \"git diff*\",\n    \"npm run test*\",\n    \"npm run lint*\",\n    \"npm run clean:*\"\n  ],\n  \"protectedPaths\": [\n    \".env*\",\n    \"*.pem\",\n    \"*.key\",\n    \"id_rsa*\",\n    \"id_ed25519*\",\n    \"~/.ssh/*\",\n    \"~/.aws/*\",\n    \"~/.kube/*\",\n    \".git/*\",\n    \"secrets/**\"\n  ]\n}\n```\n\n- **`mode`** :\n  - `\"strict\"` (default): Yellow tier actions trigger ephemeral sandbox dry-run simulation; Red tier actions are blocked.\n  - `\"permissive\"` : Yellow tier actions log warnings and allow execution; Red tier actions are still blocked.\n- **`allowlist`** : Commands or file targets matching these patterns are unconditionally granted**Green (Score 0)** status.\n- **`protectedPaths`** : Glob patterns of sensitive files that immediately elevate risk to**Red (Score >= 70)** upon access or mutation attempt.\n- **`thresholds`** : Customize risk boundaries for` block` and`dryRun` .\n\nSafely transforms tools in an existing MCP configuration file so commands run shielded behind `miseguard proxy --`. Supports explicit file paths or workspace auto-discovery:\n\n```\n# Explicit path (recommended across agents):\nmiseguard wrap-config .antigravity/mcp.json\nmiseguard wrap-config \"%APPDATA%\\Claude\\claude_desktop_config.json\"\nmiseguard wrap-config ~/.config/Claude/claude_desktop_config.json\n\n# Workspace auto-detection (scans for mcp.json, .cursor/mcp.json, .antigravity/mcp.json):\nmiseguard wrap-config\n```\n\n*Creates `<file-path>.bak` before modification and guarantees idempotency.*\n\nGenerates copy-pasteable JSON configuration blocks for agent GUI settings (Cursor, Claude, Antigravity, Windsurf):\n\n```\n# Filesystem preset (default)\nmiseguard snippet --tool filesystem --path ./\n\n# Git preset\nmiseguard snippet --tool git --path ./\n\n# Bash/Terminal preset\nmiseguard snippet --tool bash\n\n# Custom tool preset\nmiseguard snippet --tool custom --name my-server --cmd python --args -m my_module\n```\n\nEvaluates the blast-radius risk score of any shell command:\n\n```\nmiseguard check \"rm -rf /\"\n```\n\nSimulates a command inside an isolated ephemeral shadow sandbox and outputs a SHA-256 filesystem delta table:\n\n```\nmiseguard dry-run \"npm run build\"\n```\n\nRuns MiSeGuard as an active stdio proxy in front of an MCP server process:\n\n```\nmiseguard proxy -- npx -y @modelcontextprotocol/server-filesystem ./\n```\n\nDisplays the complete deterministic security rule matrix.\n\nMiSeGuard adds negligible overhead. The numbers below measure **policy evaluation and interception logic** — the scoring, sandbox dispatch, and diff-checking path. They exclude process spawn, JSON serialization, and OS scheduling, which are common to all stdio proxies and not attributable to MiSeGuard.\n\n| Scenario | Median Latency | Mean Latency | 95th Percentile (p95) | \n|---|---|---|---|\n| 🟢 **Green Pass-Through (`git status`)** | **~0.006 ms** | ~0.007 ms | 0.010 ms | \n| 🔴 **Red Filesystem Block (`delete_file .env`)** | **~0.004 ms** | ~0.005 ms | 0.009 ms | \n| 🔴 **Red Command Block (`rm -rf /`)** | **~0.066 ms** | ~0.083 ms | 0.118 ms | \n| 🟡 **Yellow Caution Scoring (`npm -g`)** | **~0.194 ms** | ~0.280 ms | 0.325 ms | \n\n**Reproducibility:** Full methodology, hardware specs, warm-up procedure, and percentile distributions are in [`docs/BENCHMARKS.md`](https://github.com/midhunweb/miseguard/blob/main/docs/BENCHMARKS.md). Run `npm run benchmark` to reproduce on your own machine.\n\nMiSeGuard operates at the **Model Context Protocol (MCP) stdio layer**. It intercepts every `tools/call` JSON-RPC message that flows between an agent and an MCP tool server (bash, filesystem, git, etc.).\n\n| Agent / Environment | Protected? | Notes | \n|---|---|---|\n| **Claude Desktop** | ✅ **Full** | MCP-native (all tools route via stdio) | \n| **Claude Code** | ✅ **Full** | MCP-native | \n| **Cline** | ✅ **Full** | MCP-native | \n| **Roo Code** | ✅ **Full** | MCP-native | \n| **OpenCode** | ✅ **Full** | MCP-native | \n| **LibreChat** | ✅ **Full** | MCP-native | \n| **Cursor (MCP servers)** | ✅ **Yes** | Protects all tools configured under `mcpServers` | \n| **Antigravity (MCP servers)** | ✅ **Yes** | Protects all tools configured under `mcpServers` | \n| **Cursor (native IDE tools)** | ❌ *No* | Bypasses MCP (Roadmap: v0.3.0 IDE Extension) | \n| **Antigravity (native IDE tools)** | ❌ *No* | Bypasses MCP (Roadmap: v0.3.0 IDE Extension) | \n| **Windsurf (native IDE tools)** | ❌ *No* | Bypasses MCP (Roadmap: v0.3.0 IDE Extension) | \n\nBeing explicit about architectural boundaries:\n\n- **Does not protect against prompt injection** — That is an LLM inference layer concern. MiSeGuard assumes the agent's intent may be compromised or hallucinatory, and deterministically enforces policy on the*executed action* , not the reasoning.\n- **Does not intercept native IDE built-in tools** — Cursor's internal`run_command` , Antigravity's internal`edit_file` , and Windsurf's native terminal bypass MCP entirely. MiSeGuard only inspects MCP stdio traffic. Direct IDE extension hooks are planned for v0.3.0.\n- **Does not sandbox long-running persistent VM state** — Ephemeral shadow sandboxes for dry-runs are discarded immediately after filesystem diff analysis.\n- **Does not support HTTP/gRPC transports yet** — Standard input/output (`stdio` ) JSON-RPC 2.0 only for v0.1.0 (HTTP/SSE transport on roadmap for v0.2.0).\n- **Does not use ML or probabilistic heuristics for risk scoring** — By design. Determinism and reproducibility are core security features.\n- **Does not defend against kernel-level escapes or raw syscall bypasses** — Operates at the tool runtime protocol layer.\n\n- **v0.2.0** : HTTP / SSE / gRPC MCP transport support\n- **v0.3.0** : IDE Extension / LSP wrapper for Cursor, Antigravity, and Windsurf native tools\n\n- [Architecture & Design Specification →](https://github.com/midhunweb/miseguard/blob/main/docs/ARCHITECTURE.md)\n- [Latency Benchmark Details →](https://github.com/midhunweb/miseguard/blob/main/docs/BENCHMARKS.md)\n- [Agent Frontend Integration Guide (Cursor, Claude Desktop, Antigravity) →](https://github.com/midhunweb/miseguard/blob/main/docs/INTEGRATION.md)\n\n```\n# Run all 60 unit and integration tests\nnpm test\n\n# Run latency benchmark suite\nnpm run benchmark\n```\n\nMIT License. Copyright (c) 2026 Midhun Sekhar & MiSeGuard Contributors.", "url": "https://wpnews.pro/news/sub-ms-deterministic-parsing-vs-llm-based-policy-for-agent-safety", "canonical_source": "https://github.com/midhunweb/miseguard", "published_at": "2026-09-17 16:08:28+00:00", "updated_at": "2026-09-17 16:28:04.323965+00:00", "lang": "en", "topics": ["ai-agents", "agent-protocols", "ai-safety", "ai-tools", "developer-tools"], "entities": ["MiSeGuard", "Midhun Sekhar", "Model Context Protocol", "Cursor", "Claude Code", "Antigravity", "OpenCode", "Windsurf"], "alternates": {"html": "https://wpnews.pro/news/sub-ms-deterministic-parsing-vs-llm-based-policy-for-agent-safety", "markdown": "https://wpnews.pro/news/sub-ms-deterministic-parsing-vs-llm-based-policy-for-agent-safety.md", "text": "https://wpnews.pro/news/sub-ms-deterministic-parsing-vs-llm-based-policy-for-agent-safety.txt", "jsonld": "https://wpnews.pro/news/sub-ms-deterministic-parsing-vs-llm-based-policy-for-agent-safety.jsonld"}}