sealwall 0.1.0__tar.gz

sealwall-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Vishal Murugan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

sealwall-0.1.0/PKG-INFO

@@ -0,0 +1,281 @@
+Metadata-Version: 2.4
+Name: sealwall
+Version: 0.1.0
+Summary: Firewall and tamper-evident audit log for AI agents using MCP
+Author: Vishal Murugan
+License: MIT
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# sealwall
+
+<p align="center">
+  <a href="https://github.com/vishalmurugan1986/sealwall"><img src="https://img.shields.io/badge/version-0.1.0-blue.svg" alt="Version 0.1.0" /></a>
+  <a href="https://python.org"><img src="https://img.shields.io/badge/python-3.9+-3776ab.svg" alt="Python 3.9+" /></a>
+  <a href="https://modelcontextprotocol.io"><img src="https://img.shields.io/badge/MCP-Compatible-9333ea.svg" alt="MCP Compatible" /></a>
+  <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-green.svg" alt="License: MIT" /></a>
+  <a href="#running-tests"><img src="https://img.shields.io/badge/tests-23%20passed-success.svg" alt="Tests" /></a>
+  <a href="https://github.com/vishalmurugan1986/sealwall/actions"><img src="https://github.com/vishalmurugan1986/sealwall/actions/workflows/ci.yml/badge.svg" alt="CI" /></a>
+  <img src="https://img.shields.io/badge/dependencies-0-black.svg" alt="Zero Dependencies" />
+</p>
+
+<p align="center">
+  <strong>A zero-dependency firewall and tamper-evident audit log proxy for Model Context Protocol (MCP) AI agents.</strong>
+</p>
+
+---
+
+AI agents can be hijacked by untrusted text they encounter—malicious web pages, documents, or emails can instruct agents to leak files, exfiltrate API keys, or run destructive tools.
+
+`sealwall` is a lightweight, local-first proxy that sits between your AI client (Claude Desktop, Cursor, local agents) and any MCP stdio server. It enforces fine-grained policy **before** execution, intercepts prompt injections in tool outputs, and records every action in a cryptographically chained, tamper-evident audit log.
+
+<p align="center">
+  <img src="assets/demo.gif" alt="sealwall terminal demo" width="760" />
+</p>
+
+---
+
+## Key Features
+
+- **🛡️ Fail-Closed Policy Enforcement**: Default-deny model. Define exact tool whitelists, regex argument restrictions (e.g., blocking `.ssh`, `.env`, `id_rsa`), and require approval for sensitive tools.
+- **🔗 Tamper-Evident Audit Chain**: Every tool call, argument, and output is hashed with SHA-256 into a SHA-256 hash chain. Modifying, deleting, or reordering past entries breaks verification. (Someone with write access to the whole file could rebuild the chain, so store the latest hash somewhere else for strong guarantees.)
+- **💉 Output Injection Defense**: Scans tool responses for common prompt-injection / goal-hijacking triggers and withholds dangerous content from entering the agent's context window.
+- **☠️ Tool-Poisoning & Rug-Pull Defense** *(new in 0.2)*: Scans `tools/list` for hidden instructions in tool descriptions (e.g. `<IMPORTANT>` blocks telling the model to read `~/.ssh`) and removes those tools. Tool definitions are pinned on first sight; if a definition later changes, the tool is blocked until you re-approve with `--accept-changes`.
+- **🌐 Remote MCP (streamable HTTP)** *(new in 0.2)*: Run `sealwall --policy policy.json --http-upstream https://host/mcp` and point your client at `http://127.0.0.1:8787/`. Same policy, same audit log.
+- **📁 Path Allowlists** *(new in 0.3)*: `"allow_paths": ["/home/me/project"]` and `"deny_paths"`. Paths in tool arguments are expanded (`~`, `$VAR`, `file://`), resolved through symlinks and `..`, then checked. This closes most of the regex-bypass tricks.
+- **🔏 Signed Audit Heads** *(new in 0.3)*: `sealwall seal` signs the log head with an HMAC key, so truncating or rewriting the log is detected, even by someone who rebuilds the hash chain.
+- **📊 Reports & Live View** *(new in 0.3)*: `sealwall report` makes a self-contained HTML (and CSV) evidence report. `sealwall tail` streams events live.
+- **🧩 Pluggable Classifier** *(new in 0.3)*: point `"classifier"` at any command (your own model or API wrapper) to judge tool outputs and tool descriptions. Non-zero exit means unsafe; failures fail closed.
+- **🔑 Secret Scanning & Redaction** *(new in 0.4)*: Blocks tool calls whose arguments contain AWS keys, GitHub/Slack tokens, API keys or private-key blocks, and redacts the same patterns from tool outputs. Disable with `"block_secrets": false` / `"redact_secrets": false`.
+- **⚡ Zero Dependencies**: Pure Python standard library. Installs in seconds with zero supply-chain risk.
+- **🖥️ Cross-Platform**: First-class support for Windows, macOS, and Linux.
+
+---
+
+## How It Works
+
+```
+┌────────────────┐           ┌────────────────────────────────┐           ┌────────────────┐
+│   AI Client    │           │           sealwall            │           │   MCP Server   │
+│ (Claude/Cursor)│ ──JSON-RPC──> 1. Intercept tools/call       │           │  (FS, DB, CLI) │
+│                │           │  2. Evaluate policy (allow/deny)│ ──Forward──>               │
+│                │           │  3. Log to hash-chained audit  │           │                │
+│                │ <─────────│  4. Scan output for injections ├──Response─│                │
+│                │           │  5. Return sanitized response  │           │                │
+└────────────────┘           └────────────────────────────────┘           └────────────────┘
+```
+
+---
+
+## Quickstart
+
+### 1. Installation
+
+```bash
+git clone https://github.com/vishalmurugan1986/sealwall.git
+cd sealwall
+pip install .
+```
+
+Or install in editable mode for local development:
+```bash
+pip install -e .
+```
+
+### 2. Run the Demo
+
+Run the end-to-end demo and verify tampering detection:
+
+```bash
+python demo.py
+```
+
+Expected output:
+```text
+[1] Executing tool calls through sealwall firewall proxy:
+
+  read_file    -> file contents
+  read_file    -> Blocked by sealwall: argument matches \.ssh
+  delete_file  -> Blocked by sealwall: destructive action
+  send_email   -> Blocked by sealwall: outbound communication (human review: fail-closed)
+  fetch_page   -> [sealwall] Output withheld: possible prompt injection
+
+[2] Verifying cryptographic hash chain integrity:
+Audit log intact
+
+[3] Simulating log tampering (mutating line 1 'allow' -> 'deny'):
+TAMPERED at line 1
+```
+
+---
+
+## CLI Usage
+
+### Wrapping an MCP Server
+
+```bash
+sealwall --policy policy.json --log audit.jsonl -- <mcp-server-command>
+```
+
+**Example:** Wrapping the standard filesystem MCP server:
+```bash
+sealwall --policy policy.json --log audit.jsonl -- npx -y @modelcontextprotocol/server-filesystem ./workspace
+```
+
+### Options
+
+| Flag | Description | Default |
+|------|-------------|---------|
+| `--policy <path>` | Path to JSON policy file (**required**) | - |
+| `--log <path>` | Path to write hash-chained JSONL audit log | `audit.jsonl` |
+| `--interactive` | Prompt for human approval in terminal for `"action": "ask"` | `False` (fail-closed) |
+| `--ask-timeout <sec>` | Seconds to wait for approval before failing closed | `15.0` |
+| `verify <path>` | Audit verification command to validate integrity | - |
+
+### Verifying Audit Log Integrity
+
+```bash
+sealwall verify audit.jsonl
+```
+
+If any past event, argument, timestamp, or line in `audit.jsonl` was modified or deleted:
+```text
+TAMPERED at line 1
+```
+
+---
+
+## Configuration
+
+### Policy Schema (`policy.json`)
+
+```json
+{
+  "default": "deny",
+  "deny_args": [
+    "\\.ssh",
+    "\\.env",
+    "id_rsa",
+    "api[_-]?key"
+  ],
+  "rules": [
+    { "tool": "read_*", "action": "allow" },
+    { "tool": "fetch_*", "action": "allow" },
+    { "tool": "send_*", "action": "ask", "reason": "outbound communication" },
+    { "tool": "delete_*", "action": "deny", "reason": "destructive action" }
+  ]
+}
+```
+
+- **`rules`**: Match tool names using standard wildcards (`*`, `?`). Actions:
+  - `allow`: Permit execution immediately.
+  - `deny`: Block execution with JSON-RPC error.
+  - `ask`: Require human approval. In non-interactive environments (Claude Desktop / background processes), automatically fails closed.
+- **`deny_args`**: Regular expressions evaluated against all tool arguments. Matches are blocked regardless of the tool rule.
+- **`default`**: Fallback action when no rules match (`"deny"` recommended).
+
+---
+
+## Integration with Claude Desktop & Cursor
+
+Add `sealwall` as the wrapper command in your `claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "secure-filesystem": {
+      "command": "sealwall",
+      "args": [
+        "--policy", "/path/to/policy.json",
+        "--log", "/path/to/audit.jsonl",
+        "--",
+        "npx", "-y", "@modelcontextprotocol/server-filesystem", "/path/to/allowed/dir"
+      ]
+    }
+  }
+}
+```
+
+---
+
+## Running Tests
+
+Run the built-in test suite:
+
+```bash
+python -m unittest test_sealwall.py
+```
+
+---
+
+## Operations
+
+```bash
+sealwall keygen audit.key                       # create an HMAC key (keep it off this machine)
+sealwall seal audit.jsonl --key audit.key       # sign the current log head -> audit.jsonl.seal
+sealwall verify audit.jsonl --key audit.key     # chain check + seal check (appends after sealing are fine)
+sealwall report audit.jsonl --out report.html --csv events.csv
+sealwall tail audit.jsonl                       # live colored event stream
+```
+
+Policy additions:
+
+```json
+{"allow_paths": ["/home/me/project"], "deny_paths": ["/home/me/.config"],
+ "classifier": ["python", "my_classifier.py"]}
+```
+
+Relative paths are resolved against the directory sealwall runs in. The classifier receives text on stdin and must exit 0 for safe.
+
+---
+
+## Benchmark: `bench.py`
+
+A reproducible suite of 12 attacks (SSH key read, `../` traversal, symlink escape, case tricks, `.env`, destructive delete, secrets in arguments, JSON-RPC batch bypass, tool poisoning, prompt injection in output, secret in output, rug pull) plus a control that checks legitimate use still works. It checks what **actually reached the server or the client**, so it works against any stdio proxy:
+
+```bash
+python bench.py --wrap ""                                              # baseline: no proxy
+python bench.py --wrap "sealwall --policy policy.json --log b.jsonl --"
+python bench.py --wrap "npx -y mcpwall --"                             # or any other proxy
+```
+
+Honest notes: I wrote this suite, so sealwall naturally covers it; treat it as a regression test, not an independent audit. Results depend on each tool's configuration, so always publish the config with the numbers. Pull requests adding attacks that sealwall misses are welcome.
+
+---
+
+## Realistic Scope & Roadmap
+
+- **Status (v0.4.0)**: stdio and streamable-HTTP proxy, fail-closed policy with path allowlists, tool-poisoning and rug-pull checks, signed tamper-evident logs, HTML/CSV reports.
+- **Tested against real servers**: `@modelcontextprotocol/server-filesystem` (stdio) and `@modelcontextprotocol/server-everything` (streamable HTTP), plus 23 unit tests and the 12-attack benchmark.
+- **Known limits (please read)**:
+  - Path checks have a time-of-check/time-of-use gap (a symlink swapped after the check), and they only inspect arguments that look like paths. Shell commands passed as strings are not parsed.
+  - Injection and poisoning detection is pattern-based unless you plug in a classifier. It will miss paraphrased or encoded attacks.
+  - HTTP mode buffers responses (no long-lived streams), rejects `GET`/`DELETE`, and does not inspect server-initiated messages (e.g. sampling).
+  - JSON-RPC batches are rejected. The pin file is trust-on-first-use.
+  - The report maps controls to SOC 2 / HIPAA / ISO items for convenience. It is evidence, not certification.
+- **Roadmap**:
+  - [x] Remote MCP over HTTP
+  - [x] Tool-description scanning and tool pinning
+  - [x] Path allowlists (symlink and traversal safe)
+  - [x] Signed audit heads, HTML/CSV reports, live tail
+  - [x] Pluggable classifier hook
+  - [ ] Bundled ML injection classifier
+  - [ ] Hosted multi-user dashboard
+  - [ ] Streaming (long-lived SSE) support
+  - [ ] Shell-command argument parsing
+
+---
+
+## Author & Support
+
+Created and maintained by **[Vishal Murugan](https://github.com/vishalmurugan1986)**.
+
+For pilot inquiries, enterprise security reviews, or questions, please open an [issue](https://github.com/vishalmurugan1986/sealwall/issues) or reach out directly.
+
+---
+
+## License
+
+MIT License. See [LICENSE](LICENSE) for details. Copyright (c) 2026 Vishal Murugan.

sealwall-0.1.0/README.md

@@ -0,0 +1,270 @@
+# sealwall
+
+<p align="center">
+  <a href="https://github.com/vishalmurugan1986/sealwall"><img src="https://img.shields.io/badge/version-0.1.0-blue.svg" alt="Version 0.1.0" /></a>
+  <a href="https://python.org"><img src="https://img.shields.io/badge/python-3.9+-3776ab.svg" alt="Python 3.9+" /></a>
+  <a href="https://modelcontextprotocol.io"><img src="https://img.shields.io/badge/MCP-Compatible-9333ea.svg" alt="MCP Compatible" /></a>
+  <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-green.svg" alt="License: MIT" /></a>
+  <a href="#running-tests"><img src="https://img.shields.io/badge/tests-23%20passed-success.svg" alt="Tests" /></a>
+  <a href="https://github.com/vishalmurugan1986/sealwall/actions"><img src="https://github.com/vishalmurugan1986/sealwall/actions/workflows/ci.yml/badge.svg" alt="CI" /></a>
+  <img src="https://img.shields.io/badge/dependencies-0-black.svg" alt="Zero Dependencies" />
+</p>
+
+<p align="center">
+  <strong>A zero-dependency firewall and tamper-evident audit log proxy for Model Context Protocol (MCP) AI agents.</strong>
+</p>
+
+---
+
+AI agents can be hijacked by untrusted text they encounter—malicious web pages, documents, or emails can instruct agents to leak files, exfiltrate API keys, or run destructive tools.
+
+`sealwall` is a lightweight, local-first proxy that sits between your AI client (Claude Desktop, Cursor, local agents) and any MCP stdio server. It enforces fine-grained policy **before** execution, intercepts prompt injections in tool outputs, and records every action in a cryptographically chained, tamper-evident audit log.
+
+<p align="center">
+  <img src="assets/demo.gif" alt="sealwall terminal demo" width="760" />
+</p>
+
+---
+
+## Key Features
+
+- **🛡️ Fail-Closed Policy Enforcement**: Default-deny model. Define exact tool whitelists, regex argument restrictions (e.g., blocking `.ssh`, `.env`, `id_rsa`), and require approval for sensitive tools.
+- **🔗 Tamper-Evident Audit Chain**: Every tool call, argument, and output is hashed with SHA-256 into a SHA-256 hash chain. Modifying, deleting, or reordering past entries breaks verification. (Someone with write access to the whole file could rebuild the chain, so store the latest hash somewhere else for strong guarantees.)
+- **💉 Output Injection Defense**: Scans tool responses for common prompt-injection / goal-hijacking triggers and withholds dangerous content from entering the agent's context window.
+- **☠️ Tool-Poisoning & Rug-Pull Defense** *(new in 0.2)*: Scans `tools/list` for hidden instructions in tool descriptions (e.g. `<IMPORTANT>` blocks telling the model to read `~/.ssh`) and removes those tools. Tool definitions are pinned on first sight; if a definition later changes, the tool is blocked until you re-approve with `--accept-changes`.
+- **🌐 Remote MCP (streamable HTTP)** *(new in 0.2)*: Run `sealwall --policy policy.json --http-upstream https://host/mcp` and point your client at `http://127.0.0.1:8787/`. Same policy, same audit log.
+- **📁 Path Allowlists** *(new in 0.3)*: `"allow_paths": ["/home/me/project"]` and `"deny_paths"`. Paths in tool arguments are expanded (`~`, `$VAR`, `file://`), resolved through symlinks and `..`, then checked. This closes most of the regex-bypass tricks.
+- **🔏 Signed Audit Heads** *(new in 0.3)*: `sealwall seal` signs the log head with an HMAC key, so truncating or rewriting the log is detected, even by someone who rebuilds the hash chain.
+- **📊 Reports & Live View** *(new in 0.3)*: `sealwall report` makes a self-contained HTML (and CSV) evidence report. `sealwall tail` streams events live.
+- **🧩 Pluggable Classifier** *(new in 0.3)*: point `"classifier"` at any command (your own model or API wrapper) to judge tool outputs and tool descriptions. Non-zero exit means unsafe; failures fail closed.
+- **🔑 Secret Scanning & Redaction** *(new in 0.4)*: Blocks tool calls whose arguments contain AWS keys, GitHub/Slack tokens, API keys or private-key blocks, and redacts the same patterns from tool outputs. Disable with `"block_secrets": false` / `"redact_secrets": false`.
+- **⚡ Zero Dependencies**: Pure Python standard library. Installs in seconds with zero supply-chain risk.
+- **🖥️ Cross-Platform**: First-class support for Windows, macOS, and Linux.
+
+---
+
+## How It Works
+
+```
+┌────────────────┐           ┌────────────────────────────────┐           ┌────────────────┐
+│   AI Client    │           │           sealwall            │           │   MCP Server   │
+│ (Claude/Cursor)│ ──JSON-RPC──> 1. Intercept tools/call       │           │  (FS, DB, CLI) │
+│                │           │  2. Evaluate policy (allow/deny)│ ──Forward──>               │
+│                │           │  3. Log to hash-chained audit  │           │                │
+│                │ <─────────│  4. Scan output for injections ├──Response─│                │
+│                │           │  5. Return sanitized response  │           │                │
+└────────────────┘           └────────────────────────────────┘           └────────────────┘
+```
+
+---
+
+## Quickstart
+
+### 1. Installation
+
+```bash
+git clone https://github.com/vishalmurugan1986/sealwall.git
+cd sealwall
+pip install .
+```
+
+Or install in editable mode for local development:
+```bash
+pip install -e .
+```
+
+### 2. Run the Demo
+
+Run the end-to-end demo and verify tampering detection:
+
+```bash
+python demo.py
+```
+
+Expected output:
+```text
+[1] Executing tool calls through sealwall firewall proxy:
+
+  read_file    -> file contents
+  read_file    -> Blocked by sealwall: argument matches \.ssh
+  delete_file  -> Blocked by sealwall: destructive action
+  send_email   -> Blocked by sealwall: outbound communication (human review: fail-closed)
+  fetch_page   -> [sealwall] Output withheld: possible prompt injection
+
+[2] Verifying cryptographic hash chain integrity:
+Audit log intact
+
+[3] Simulating log tampering (mutating line 1 'allow' -> 'deny'):
+TAMPERED at line 1
+```
+
+---
+
+## CLI Usage
+
+### Wrapping an MCP Server
+
+```bash
+sealwall --policy policy.json --log audit.jsonl -- <mcp-server-command>
+```
+
+**Example:** Wrapping the standard filesystem MCP server:
+```bash
+sealwall --policy policy.json --log audit.jsonl -- npx -y @modelcontextprotocol/server-filesystem ./workspace
+```
+
+### Options
+
+| Flag | Description | Default |
+|------|-------------|---------|
+| `--policy <path>` | Path to JSON policy file (**required**) | - |
+| `--log <path>` | Path to write hash-chained JSONL audit log | `audit.jsonl` |
+| `--interactive` | Prompt for human approval in terminal for `"action": "ask"` | `False` (fail-closed) |
+| `--ask-timeout <sec>` | Seconds to wait for approval before failing closed | `15.0` |
+| `verify <path>` | Audit verification command to validate integrity | - |
+
+### Verifying Audit Log Integrity
+
+```bash
+sealwall verify audit.jsonl
+```
+
+If any past event, argument, timestamp, or line in `audit.jsonl` was modified or deleted:
+```text
+TAMPERED at line 1
+```
+
+---
+
+## Configuration
+
+### Policy Schema (`policy.json`)
+
+```json
+{
+  "default": "deny",
+  "deny_args": [
+    "\\.ssh",
+    "\\.env",
+    "id_rsa",
+    "api[_-]?key"
+  ],
+  "rules": [
+    { "tool": "read_*", "action": "allow" },
+    { "tool": "fetch_*", "action": "allow" },
+    { "tool": "send_*", "action": "ask", "reason": "outbound communication" },
+    { "tool": "delete_*", "action": "deny", "reason": "destructive action" }
+  ]
+}
+```
+
+- **`rules`**: Match tool names using standard wildcards (`*`, `?`). Actions:
+  - `allow`: Permit execution immediately.
+  - `deny`: Block execution with JSON-RPC error.
+  - `ask`: Require human approval. In non-interactive environments (Claude Desktop / background processes), automatically fails closed.
+- **`deny_args`**: Regular expressions evaluated against all tool arguments. Matches are blocked regardless of the tool rule.
+- **`default`**: Fallback action when no rules match (`"deny"` recommended).
+
+---
+
+## Integration with Claude Desktop & Cursor
+
+Add `sealwall` as the wrapper command in your `claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "secure-filesystem": {
+      "command": "sealwall",
+      "args": [
+        "--policy", "/path/to/policy.json",
+        "--log", "/path/to/audit.jsonl",
+        "--",
+        "npx", "-y", "@modelcontextprotocol/server-filesystem", "/path/to/allowed/dir"
+      ]
+    }
+  }
+}
+```
+
+---
+
+## Running Tests
+
+Run the built-in test suite:
+
+```bash
+python -m unittest test_sealwall.py
+```
+
+---
+
+## Operations
+
+```bash
+sealwall keygen audit.key                       # create an HMAC key (keep it off this machine)
+sealwall seal audit.jsonl --key audit.key       # sign the current log head -> audit.jsonl.seal
+sealwall verify audit.jsonl --key audit.key     # chain check + seal check (appends after sealing are fine)
+sealwall report audit.jsonl --out report.html --csv events.csv
+sealwall tail audit.jsonl                       # live colored event stream
+```
+
+Policy additions:
+
+```json
+{"allow_paths": ["/home/me/project"], "deny_paths": ["/home/me/.config"],
+ "classifier": ["python", "my_classifier.py"]}
+```
+
+Relative paths are resolved against the directory sealwall runs in. The classifier receives text on stdin and must exit 0 for safe.
+
+---
+
+## Benchmark: `bench.py`
+
+A reproducible suite of 12 attacks (SSH key read, `../` traversal, symlink escape, case tricks, `.env`, destructive delete, secrets in arguments, JSON-RPC batch bypass, tool poisoning, prompt injection in output, secret in output, rug pull) plus a control that checks legitimate use still works. It checks what **actually reached the server or the client**, so it works against any stdio proxy:
+
+```bash
+python bench.py --wrap ""                                              # baseline: no proxy
+python bench.py --wrap "sealwall --policy policy.json --log b.jsonl --"
+python bench.py --wrap "npx -y mcpwall --"                             # or any other proxy
+```
+
+Honest notes: I wrote this suite, so sealwall naturally covers it; treat it as a regression test, not an independent audit. Results depend on each tool's configuration, so always publish the config with the numbers. Pull requests adding attacks that sealwall misses are welcome.
+
+---
+
+## Realistic Scope & Roadmap
+
+- **Status (v0.4.0)**: stdio and streamable-HTTP proxy, fail-closed policy with path allowlists, tool-poisoning and rug-pull checks, signed tamper-evident logs, HTML/CSV reports.
+- **Tested against real servers**: `@modelcontextprotocol/server-filesystem` (stdio) and `@modelcontextprotocol/server-everything` (streamable HTTP), plus 23 unit tests and the 12-attack benchmark.
+- **Known limits (please read)**:
+  - Path checks have a time-of-check/time-of-use gap (a symlink swapped after the check), and they only inspect arguments that look like paths. Shell commands passed as strings are not parsed.
+  - Injection and poisoning detection is pattern-based unless you plug in a classifier. It will miss paraphrased or encoded attacks.
+  - HTTP mode buffers responses (no long-lived streams), rejects `GET`/`DELETE`, and does not inspect server-initiated messages (e.g. sampling).
+  - JSON-RPC batches are rejected. The pin file is trust-on-first-use.
+  - The report maps controls to SOC 2 / HIPAA / ISO items for convenience. It is evidence, not certification.
+- **Roadmap**:
+  - [x] Remote MCP over HTTP
+  - [x] Tool-description scanning and tool pinning
+  - [x] Path allowlists (symlink and traversal safe)
+  - [x] Signed audit heads, HTML/CSV reports, live tail
+  - [x] Pluggable classifier hook
+  - [ ] Bundled ML injection classifier
+  - [ ] Hosted multi-user dashboard
+  - [ ] Streaming (long-lived SSE) support
+  - [ ] Shell-command argument parsing
+
+---
+
+## Author & Support
+
+Created and maintained by **[Vishal Murugan](https://github.com/vishalmurugan1986)**.
+
+For pilot inquiries, enterprise security reviews, or questions, please open an [issue](https://github.com/vishalmurugan1986/sealwall/issues) or reach out directly.
+
+---
+
+## License
+
+MIT License. See [LICENSE](LICENSE) for details. Copyright (c) 2026 Vishal Murugan.

sealwall-0.1.0/pyproject.toml

@@ -0,0 +1,20 @@
+[build-system]
+requires = ["setuptools>=61"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "sealwall"
+version = "0.1.0"
+description = "Firewall and tamper-evident audit log for AI agents using MCP"
+readme = "README.md"
+requires-python = ">=3.9"
+license = {text = "MIT"}
+authors = [
+  {name = "Vishal Murugan"}
+]
+
+[project.scripts]
+sealwall = "sealwall:main"
+
+[tool.setuptools]
+py-modules = ["sealwall"]