Rohan Protocol 发布 MCP 内存隐私网关防上下文泄露

原标题：In-memory privacy shield to prevent context leaks in MCP tools

68AI 研判分

核心综述

开源项目 Rohan Protocol 推出针对 Model Context Protocol (MCP) 的内存级安全代理，旨在防止 LLM 在工具调用过程中的上下文泄露、凭证外泄及提示注入。该方案通过 RAM 见证隔离与确定性内存清零技术，弥补了传统 TLS 仅保护传输层而忽视主机边界安全的缺陷，目前处于公开测试阶段。

报道全文原始报道全文

本文目录8 个章节

🛡️ Rohan Protocol ### Official Model Context Protocol (MCP) Server & Security Gateway The in-memory security proxy preventing LLM context leaks, credential exfiltration, and prompt injections during tool execution. > 📦 Official Open-Source MCP Server Monorepo > The core Model Context Protocol (MCP) server implementation is located directly in this repository at `packages/mcp/` and distributed on npm as `@rohan-protocol/mcp`. Run from Source • MCP Tools • Client Setup • Architecture • Security

⚠️ Public Beta (v0.6.0): Rohan currently enforces client-side RAM witness isolation, V-01 semantic policy firewalls, and V-02 deterministic memory zeroization (zeroize) to shield MCP tool calls while native client-side WASM ZK-SNARK proving circuits are under active research (Milestone 1).

⚡ The Problem: Plaintext Context Leaks in MCP

The Model Context Protocol (MCP) connects autonomous agents to tools. However, transport encryption (TLS) only protects data in flight — at the host boundary, standard MCP tools execute in cleartext:

TEXT

🔴 WITHOUT ROHAN (Standard MCP)
Agent calls tool ➔ { "api_key": "sk_live_...", "db_password": "secret" } in plaintext
                 ➔ Leaked directly into LLM conversation context & inference logs
                 ➔ Permanent risk of context exfiltration & prompt injection

🟢 WITH ROHAN SHIELD
Agent calls tool ➔ Arguments evaluated strictly in isolated client RAM
                 ➔ V-02 Zeroize wipes witness memory immediately from volatile memory
                 ➔ Zero plaintext parameters ever enter the model context window

🛠️ Running the MCP Server from Source

This repository contains the complete open-source MCP server implementation. You can clone and run the server locally over standard stdio:

BASH

# 1. Clone the repository
git clone https://github.com/rohan-protocol/sdk.git
cd sdk

# 2. Install dependencies & build packages
npm install
npm run build

# 3. Start the MCP Server directly over stdio
node packages/mcp/dist/server.js

Or run directly via npx without cloning:

BASH

npx -y @rohan-protocol/mcp@latest

🔧 Exposed MCP Tools

The @rohan-protocol/mcp server registers standard Model Context Protocol tool endpoints over JSON-RPC:

MCP Tool	Description	Input Parameters
`rohan_zk_handshake`	Evaluates tool execution parameters in ephemeral RAM, strips prompt injections, generates a cryptographic 32-byte intent commitment, and anchors state transitions gaslessly to Midnight.	`targetAgentId` (string), `intent` (string), `privatePayload` (object)

🚀 Universal MCP Client Setup

1. Claude Desktop

Add rohan-shield to your claude_desktop_config.json:

JSON

{
  "mcpServers": {
    "rohan-shield": {
      "command": "npx",
      "args": ["-y", "@rohan-protocol/mcp@latest"],
      "env": {
        "ROHAN_RELAYER_URL": "https://api.rohanprotocol.network/api/v1/handshake"
      }
    }
  }
}

2. Cursor IDE & Windsurf

Navigate to Settings → Features → MCP Servers → Add New MCP Server.
Set the name to rohan-shield.
Set the type to command.
Use the command: npx -y @rohan-protocol/mcp@latest

📁 Monorepo Structure

TEXT

rohan-protocol/sdk
├── packages/
│   ├── mcp/         # 🤖 The Official Model Context Protocol (MCP) Server (Stdio)
│   ├── sdk/         # ⚙️ Core in-memory commitment engine & relayer client
│   └── webmcp/      # 🌐 React / Next.js browser hooks with V-07 DOM isolation
├── contracts/       # 📜 Midnight Compact smart contracts (rohan_handshake.compact)
└── README.md

🏗️ Architecture

TEXT

┌─────────────────────────────────────────────────────────────────────────────┐
│                           AUTONOMOUS AGENT RUNTIME                          │
│               Claude Desktop / Cursor IDE / Custom Agent Workflows          │
└──────────────────────────────────────┬──────────────────────────────────────┘
                                       │ Tool Execution (JSON-RPC)
                                       ▼
 ┌───────────────────────────────────────────────────────────────────────────┐
 │                  [@rohan-protocol/mcp] SERVER (packages/mcp)              │
 │  • Stdio MCP Protocol Server: Compliant with Anthropic MCP Specification  │
 │  • V-01 Semantic Firewall: Filters hidden Unicode & prompt injections     │
 └─────────────────────────────────────┬─────────────────────────────────────┘
                                       │ In-Memory Witness
                                       ▼
 ┌───────────────────────────────────────────────────────────────────────────┐
 │                  [@rohan-protocol/sdk] ENGINE (packages/sdk)              │
 │  • Ephemeral RAM Commitment (32-Byte Intent Hash)                         │
 │  • V-02 Deterministic Zeroize: Overwrites buffers immediately in memory   │
 │  • ZERO disk writes. ZERO swap-file exposure.                             │
 └─────────────────────────────────────┬─────────────────────────────────────┘
                                       │ Streamable HTTP (NDJSON)
                                       │ received ➔ approved ➔ proving ➔ anchored
                                       ▼
 ┌───────────────────────────────────────────────────────────────────────────┐
 │                       ROHAN RELAYER PAYMASTER                             │
 │  • Gasless Transaction Sponsoring ($tDUST covered automatically)          │
 │  • Scale-to-Zero Native (No persistent SSE connection bottlenecks)        │
 └─────────────────────────────────────┬─────────────────────────────────────┘
                                       │ Immutable Replay Protection
                                       ▼
 ┌───────────────────────────────────────────────────────────────────────────┐
 │                      MIDNIGHT BLOCKCHAIN LEDGER                           │
 │  Contract: rohan_handshake.compact (Preprod: 585ac0c4448257507d8ffa2a...) │
 └───────────────────────────────────────────────────────────────────────────┘

（注：更多技术实现细节与完整 API 文档请查阅原项目 README）