An agent doesn't just chat — it runs shells, sends email, reads files, hits APIs. The leak moves from the prompt to the tool call: a key slipped into a command, or a secret a tool reads back into the model. Proxia inspects both directions — in the browser, and on the MCP tool-call path itself.
Pick a step the agent tries to take. Watch Proxia's verdict.
Choose a step above to run it through the guard.
The prompt is no longer the only exit. Proxia treats a tool call as a checkpoint in both directions.
The model puts a credential into a tool call — execute_shell(cmd), send_email(body), http_post(url). If a secret is heading into a risky sink, Proxia stops it before the tool runs.
A tool read_file or db_query returns data containing a secret or PII — which would enter the model's context. Proxia redacts it in the result before the model ever sees it.
In a web AI, Proxia inspects tool calls in the traffic it already sees. But agents often run tools out of the browser's sight — so Proxia also ships a local MCP guard that wraps a tool server and inspects every JSON-RPC call, on-device.
Recognizes tool-call structures in the outgoing traffic and escalates a leaking call to a block — no setup beyond the extension.
Wrap the real server; every tools/call is inspected in the stdio stream.
proxia-mcp-guard -- mcp-server-filesystem /data
Toggle the demo above between the two. Both keep the secret out of the tool — they differ in whether the call still runs.
A leaking call is refused outright with a clear error. Nothing sensitive reaches the tool, and nothing partial slips through.
The secret is stripped from the arguments and the sanitized call is forwarded, so the agent isn't stopped cold. If the secret was essential to the tool, blocking is still the safer choice.
Whatever you send, whatever you see, whatever your agent does — the same on-device core decides, and nothing is transmitted.