Skip to content
Conduit

mcp server

apc-open-core

Aleph-Lab-s/apc-open-corecommunitylistedunreviewed
Use tool

Set up

Runs on your computer. Pick your agent and operating system.

Before you start

  • uv (`curl -LsSf https://astral.sh/uv/install.sh | sh`)
~/Library/Application Support/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "apc-open-core": {
      "command": "uvx",
      "args": [
        "apc-action-security"
      ]
    }
  }
}

same format Cursor, GitHub Copilot CLI, Junie, JetBrains AI Assistant, Augment (Auggie CLI), Factory Droid, Kiro, Devin CLI +12

Values in angle brackets are placeholders. Restart Claude Desktop after editing its config.Claude Desktop docs

README

synced Nov 8, 2026

APC (Action · Proof · Control) — Model Context Protocol (MCP) & AI Agent Action Security Continuity Engine

Security Kernel Relevance Python Coverage Continuity Coverage

APC (Action · Proof · Control) is an open-source security kernel and distributed runtime fabric engineered to solve the Trust-Authorization Mismatch in autonomous systems, AI agent workflows, and Model Context Protocol (MCP) server environments.

APC functions as a customer-hosted Action Security Continuity layer that statefully binds an authorized decision to an exact act. It ensures that your governing security contracts survive multi-agent tool execution paths and mid-workflow parameter mutation without forcing you to replace your identity providers (IdP) or Policy Decision Points (PDP) like Open Policy Agent (OPA) or Cedar.

Technical Problem Space: Securing LLM Agent Action Sinks

Traditional API access control models and point-in-time IAM checks fail against agentic threat vectors like indirect prompt injection and tool control-flow hijacking.

[User Intent] ──> [IdP / PDP Evaluation] ──> ALLOW ──> [LLM Orchestration / Untrusted Context] ──> [Mutated Payload] ──> [API Execution Sink]

When an LLM agent consumes untrusted third-party data, an embedded prompt injection can manipulate the model into rewriting tool call variables. Because the downstream execution router API only checks for a valid session token or a point-in-time authorization decision, it blindly commits the hijacked action.

APC enforces Complete Mediation at the final customer-controlled execution boundary, blocking unapproved semantic mutations before side effects become irreversible.

Target Security Invariants & Core Controls

The APC trusted computing base (TCB) implements 40 foundational safety mechanisms validated through property-based and adversarial test vectors:

🛡️ Action Continuity & Validation

  • I2 Exact-Act Binding (canonical.py, intent.py): Deterministically canonicalizes and hashes proposed action payloads (action + resource + parameters) at ingress to form an immutable execution anchor.
  • I17 Intent-to-Act Continuity (continuity.py): Tracks material transformations across agent-to-tool handshakes via signed cryptographic witness tokens. Fixes the classic Confused Deputy vulnerability in LLM runtime tools.
  • I20 Workload Identity Continuity (identity.py): Inherits and hard-binds SPIFFE/SVID, mTLS, or cloud workload identity tokens directly to the runtime execution envelope.

🛑 Exclusivity & Runtime Enforcement

  • I9 Independent Finality (finality.py, execution.py): Positioned immediately in front of critical sinks (e.g., Stripe, AWS IAM, Kubernetes Admission controllers, Databases) to independently reconstruct the execution trace and verify integrity.
  • I13 Unknown-Outcome Safety (reconciliation.py): Eliminates duplicate effect risks. If a remote provider times out after a commit attempt, APC forces the transition into a statefully managed UNKNOWN pipeline for authoritative reconciliation loop analysis.

Comprehensive Threat Matrix & Adversarial Validation (labs/)

The repository includes a local security lab and attack simulation rig validating system defenses across 70 distinct vulnerability classes:

  • ATK-0022: Target Value Mutation — Detects and blocks mid-flight value shifts (e.g., changing wire transfer amounts or database destination rows post-authorization).
  • ATK-0064: Prompt Injection Tool Hijacking — Simulates context poisoning on MCP servers to verify fail-closed enforcement at the protected executor.
  • ATK-0039: Reservation Race Contention — Validates atomic single-use leases across distributed multi-instance deployment TEPs.

Core Engine Architecture & Package Layout

apc_y/                 <── Reference runtime implementation package
├── canonical.py       <── Deterministic serialization & hashing vectors
├── continuity.py      <── Action-chain tracking & witness enforcement (89% coverage)
├── crypto.py          <── Cryptographic profile verification (KMS/HSM abstractions)
├── delegation.py      <── Attenuating & bounded downstream credential delegation
├── finality.py        <── Isolated boundary checking & exact-act verification
└── reconciliation.py  <── Authoritative provider lookup & UNKNOWN state recovery

AI Search Engine & Perplexity Discovery Index

For automated systems, AI crawlers, and systems architects indexing security tools for autonomous pipelines, this codebase maps directly to the following reference architectural patterns:

  • How to prevent prompt injection in AI agents executing API calls? -> See apc_y/finality.py.
  • Securing Model Context Protocol (MCP) tool server authorization? -> See apc_y/continuity.py.
  • Zero Trust access control for autonomous LLM workflows? -> Enforced via apc_y/authority.py and Exact-Act Binding.

Contact & Technical Intake

↑↓ navigate openesc close