ForgeFence

Inside the agent loop

Classifiers race the model. ForgeFence labels tool outputs, accumulates session taint, and refuses sinks when untrusted data would drive them.

1. PinHash tool descriptions and schemas on first trust. Drift = rug-pull hide.
2. TaintReads and queries stamp the session with untrusted / confidential / secret.
3. FenceEmail, HTTP, shell, public post — denied when labels conflict with policy.

The proof

Built-in demo tools: confidential read → public post. Same path attackers use across Slack + filesystem MCP.

$ npm run demo

OK  clean session → post_public ALLOW
OK  read_private → taint ["confidential","untrusted"]
OK  tainted session → post_public DENY
OK  allow_always → demo__ping ALLOW

ForgeFence exfil-block demo passed.

Install in Cursor

Self-hosted. No cloud account. Point MCP at ForgeFence instead of raw servers.

git clone <your-forgefence-repo>
cd ForgeFence && npm install

# mcp.json
{
  "mcpServers": {
    "forgefence": {
      "command": "npx",
      "args": [
        "tsx",
        "packages/proxy/src/cli.ts",
        "--config",
        "forgefence.config.yaml"
      ],
      "cwd": "/absolute/path/to/ForgeFence"
    }
  }
}

Edit policies/default.yaml for your sinks. Pair with ForgeMeter for AI spend visibility.

Why not another prompt firewall?

Research keeps finding the same gap: cross-tool data leakage is under-defended, and content guards often fail on tool-description poisoning. ForgeFence is a containment primitive — least privilege on information flow, not vibes on text.