The Three-Layer Agent Firewall
Guardianship
Every one of Neurova's stars needs a guardian. We ship several protective layers built in:
| Layer | What it protects |
|---|
| L0 Entry | JWT authentication, IP allow/deny lists, rate limiting, input safety scanning |
| L1 Isolation | Hard isolation between users (cannot be disabled), optional isolation between agents |
| L2 Output | API key masking, sensitive-path interception, file-type protection |
| L3 Audit | Operation audit logs, security event monitoring, anomalous behaviour detection |
| L4 Data | Encrypted storage at rest, anonymisation of sensitive information, right-to-be-forgotten support |
Every star you tend belongs to you alone, and no one else can look at it.
L0: Entry gateway and output masking
- JWT authentication — every API request must be authenticated
- IP allow/deny lists — access controlled by source IP
- Global rate limiting — configured centrally by the administrator to absorb abusive traffic
- Input safety inspection — real-time interception of prompt injection, SQL injection, command injection and path traversal
- Automatic output masking — API keys, tokens, passwords and similar secrets are replaced on the way out
L1: Dual isolation across users and agents
| Isolation scope | Default | How it is controlled |
|---|
| Between users | Always on (cannot be disabled) | An agent of user A has no way to reach user B's data |
| Between agents | Off by default | Users may turn it on to isolate agents under the same user |
Isolation is carried through the whole stack by ContextVar scoping (three levels: agent / user-session / user) and enforced with a mandatory WHERE clause in SQL.
L2: File access protection
- System-level denial of access to configuration, keys, documentation, databases and other sensitive files
- Users may add their own interception rules for file extensions and paths
- An agent workspace allowlist: free read/write only inside workspace/{user_id}/
MCP governance (six P0 security hardenings)
| ID | Vulnerability | Fix |
|---|
| M1 | Unauthenticated RCE | Authorization dependency added to the router; stdio restricted to admin |
| M2 | No allowlist for stdio command | Shell rejection table plus a command allowlist |
| M3 | Tool routing bypassed the firewall | Firewall converged into the call_tool main path |
| M4 | Governance pre-check missed key names | Full-parameter scanning (scan_all) with graded fail-closed |
| M5 | MCP client was a cross-user singleton | Firewall identity is now threaded per request (injected via ContextVar) |
| M6-M10 | Configuration forks / dead code / key-name bugs | Storage converged, lazy ToolEngine acquisition, server_id corrected |