Rohan Protocol Launches In-Memory Privacy Gateway for MCP Tools

68AI Score

Executive Summary

Open-source project Rohan Protocol introduces an in-memory security proxy for the Model Context Protocol (MCP), designed to prevent context leaks, credential exfiltration, and prompt injections during LLM tool execution. By employing RAM witness isolation and deterministic memory zeroization, it addresses the gap where traditional TLS protects data in transit but leaves host-boundary contexts vulnerable. The solution is currently in public beta.

SOURCE COVERAGEFull Original Report

Contents8 sections

🛡️ Rohan Protocol ### Official Model Context Protocol (MCP) Server & Security Gateway The in-memory security proxy preventing LLM context leaks, credential exfiltration, and prompt injections during tool execution. > 📦 Official Open-Source MCP Server Monorepo > The core Model Context Protocol (MCP) server implementation is located directly in this repository at `packages/mcp/` and distributed on npm as `@rohan-protocol/mcp`. Run from Source • MCP Tools • Client Setup • Architecture • Security

⚠️ Public Beta (v0.6.0): Rohan currently enforces client-side RAM witness isolation, V-01 semantic policy firewalls, and V-02 deterministic memory zeroization (zeroize) to shield MCP tool calls while native client-side WASM ZK-SNARK proving circuits are under active research (Milestone 1).

⚡ The Problem: Plaintext Context Leaks in MCP

The Model Context Protocol (MCP) connects autonomous agents to tools. However, transport encryption (TLS) only protects data in flight — at the host boundary, standard MCP tools execute in cleartext:

TEXT

🔴 WITHOUT ROHAN (Standard MCP)
Agent calls tool ➔ { "api_key": "sk_live_...", "db_password": "secret" } in plaintext
                 ➔ Leaked directly into LLM conversation context & inference logs
                 ➔ Permanent risk of context exfiltration & prompt injection

🟢 WITH ROHAN SHIELD
Agent calls tool ➔ Arguments evaluated strictly in isolated client RAM
                 ➔ V-02 Zeroize wipes witness memory immediately from volatile memory
                 ➔ Zero plaintext parameters ever enter the model context window

🛠️ Running the MCP Server from Source

This repository contains the complete open-source MCP server implementation. You can clone and run the server locally over standard stdio:

BASH

# 1. Clone the repository
git clone https://github.com/rohan-protocol/sdk.git
cd sdk

# 2. Install dependencies & build packages
npm install
npm run build

# 3. Start the MCP Server directly over stdio
node packages/mcp/dist/server.js

Or run directly via npx without cloning:

BASH

npx -y @rohan-protocol/mcp@latest

🔧 Exposed MCP Tools

The @rohan-protocol/mcp server registers standard Model Context Protocol tool endpoints over JSON-RPC:

MCP Tool	Description	Input Parameters
`rohan_zk_handshake`	Evaluates tool execution parameters in ephemeral RAM, strips prompt injections, generates a cryptographic 32-byte intent commitment, and anchors state transitions gaslessly to Midnight.	`targetAgentId` (string), `intent` (string), `privatePayload` (object)

🚀 Universal MCP Client Setup

1. Claude Desktop

Add rohan-shield to your claude_desktop_config.json:

JSON

{
  "mcpServers": {
    "rohan-shield": {
      "command": "npx",
      "args": ["-y", "@rohan-protocol/mcp@latest"],
      "env": {
        "ROHAN_RELAYER_URL": "https://api.rohanprotocol.network/api/v1/handshake"
      }
    }
  }
}

2. Cursor IDE & Windsurf

Navigate to Settings → Features → MCP Servers → Add New MCP Server.
Set the name to rohan-shield.
Set the type to command.
Use the command: npx -y @rohan-protocol/mcp@latest

📁 Monorepo Structure

TEXT

rohan-protocol/sdk
├── packages/
│   ├── mcp/         # 🤖 The Official Model Context Protocol (MCP) Server (Stdio)
│   ├── sdk/         # ⚙️ Core in-memory commitment engine & relayer client
│   └── webmcp/      # 🌐 React / Next.js browser hooks with V-07 DOM isolation
├── contracts/       # 📜 Midnight Compact smart contracts (rohan_handshake.compact)
└── README.md

🏗️ Architecture

TEXT

┌─────────────────────────────────────────────────────────────────────────────┐
│                           AUTONOMOUS AGENT RUNTIME                          │
│               Claude Desktop / Cursor IDE / Custom Agent Workflows          │
└──────────────────────────────────────┬──────────────────────────────────────┘
                                       │ Tool Execution (JSON-RPC)
                                       ▼
 ┌───────────────────────────────────────────────────────────────────────────┐
 │                  [@rohan-protocol/mcp] SERVER (packages/mcp)              │
 │  • Stdio MCP Protocol Server: Compliant with Anthropic MCP Specification  │
 │  • V-01 Semantic Firewall: Filters hidden Unicode & prompt injections     │
 └─────────────────────────────────────┬─────────────────────────────────────┘
                                       │ In-Memory Witness
                                       ▼
 ┌───────────────────────────────────────────────────────────────────────────┐
 │                  [@rohan-protocol/sdk] ENGINE (packages/sdk)              │
 │  • Ephemeral RAM Commitment (32-Byte Intent Hash)                         │
 │  • V-02 Deterministic Zeroize: Overwrites buffers immediately in memory   │
 │  • ZERO disk writes. ZERO swap-file exposure.                             │
 └─────────────────────────────────────┬─────────────────────────────────────┘
                                       │ Streamable HTTP (NDJSON)
                                       │ received ➔ approved ➔ proving ➔ anchored
                                       ▼
 ┌───────────────────────────────────────────────────────────────────────────┐
 │                       ROHAN RELAYER PAYMASTER                             │
 │  • Gasless Transaction Sponsoring ($tDUST covered automatically)          │
 │  • Scale-to-Zero Native (No persistent SSE connection bottlenecks)        │
 └─────────────────────────────────────┬─────────────────────────────────────┘
                                       │ Immutable Replay Protection
                                       ▼
 ┌───────────────────────────────────────────────────────────────────────────┐
 │                      MIDNIGHT BLOCKCHAIN LEDGER                           │
 │  Contract: rohan_handshake.compact (Preprod: 585ac0c4448257507d8ffa2a...) │
 └───────────────────────────────────────────────────────────────────────────┘

（注：更多技术实现细节与完整 API 文档请查阅原项目 README）