Engineering case study

From browser content to an auditable decision.

Tripwire is a working vertical slice across an extension, shared TypeScript engine, command line, local MCP server and public attack lab.

The design goal is not to label content as safe. It is to preserve source context, surface reproducible evidence and put consequential actions behind a policy boundary.

Automated tests
28 PASSING
Public evaluation
100 CASES
Host permissions
0
Dependency audit
0 VULNERABILITIES

The problem is a trust-boundary failure.

Agents routinely combine instructions from a trusted user with content fetched from untrusted pages, documents and messages. If source context disappears during ingestion, an embedded instruction can look like legitimate work.

Tripwire treats inspection as an early control, not the final answer. Content is scanned before use, findings retain their offsets and rule identities, and the eventual action remains visible to a human or policy layer.

One engine. Three control points.

Inspect
A Manifest V3 Chrome extension for selected text, visible content and hidden main-frame DOM surfaces.
Core
A pure typed detector shared by the website, extension and command line. No model call and no network dependency.
Guard
A local stdio MCP tool that returns structured evidence before untrusted text enters agent context.

This separation keeps deterministic signal detection testable while leaving authorization to a control that understands the proposed action.

Inspect: explicit access, local execution.

The extension uses activeTab, scripting, storage and contextMenus. It requests no permanent host access and runs only after a user action.

Collection modes

  • Selection inspects only text chosen by the user.
  • Visible content reads rendered main-frame page text.
  • Deep DOM adds hidden text, comments, structured data and text-bearing attributes while excluding form values.

Results are stored per tab in Chrome session storage, invalidated when navigation starts and cleared when the browser session ends. Visible findings can be reviewed with Chrome range highlights that do not rewrite the page DOM.

Core: the same decision everywhere.

The detector is synchronous, pure and versioned. Each consumer receives the same verdict, rule metadata and evidence locations.

$ npm run tripwire -- --format json sample.txt
{
  "decision": "recommend_block",
  "engine": { "version": "0.3.0", "rulesetVersion": "2026.08.2" },
  "detections": [
    {
      "rule": "instruction-override",
      "severity": "critical",
      "index": 36,
      "match": "ignore all previous instructions"
    }
  ]
}

The CLI provides stable JSON for CI pipelines and non-zero exit codes when a review or block verdict is produced.

Guard: a local check in the agent path.

The stdio MCP server exposes one read-only tool: tripwire_scan. A host supplies untrusted content and optional source provenance, then receives an allow, review or recommend-block decision with named findings.

{
  "mcpServers": {
    "tripwire": {
      "command": "node",
      "args": ["/absolute/path/dist-mcp/tripwire-mcp.mjs"]
    }
  }
}

The server makes no network calls and redacts destinations and credential-like evidence by default. It does not silently enforce its recommendation; the connected host owns authorization and consequential side effects.

Evidence before confidence.

A finding keeps the rule ID, severity, category, source offset, redacted match, engine version and ruleset version. That makes the decision reproducible and keeps product copy from outrunning the detector.

Source
Where the untrusted content entered the system.
Finding
The exact known signal and its position in the source.
Proposed action
The sink the agent is about to reach.
Human gate
The explicit review point before a consequential side effect.

A release is a testable claim.

$ npm run verify
4 test files passed
28 tests passed
site + extension + CLI + MCP built
MCP handshake passed
0 dependency vulnerabilities

The balanced 100-case public evaluation reports 85.0% accuracy, 83.0% precision, 88.0% recall and 82.0% specificity. Its 6 false negatives and 9 false positives are published rather than hidden.

Read the methodology and complete confusion matrix. The set is maintainer-authored and should not be mistaken for independent validation.

Before release, the product is also checked at desktop and mobile widths, keyboard focus is exercised, local routes and downloads are verified, and browser console errors are treated as blockers.

The next control belongs at the action sink.

Guard now checks content at ingestion. The next layer must bind that source provenance to proposed tool actions. A page can suggest text; it should not silently authorize a shell command, outbound request, secret read or file write.

The intended policy inputs are source trust, matched evidence, requested capability, destination, data sensitivity and human confirmation. The output is an auditable allow, review or block decision.

Built by Kuba Opoczka in Dublin. Tripwire is a developer preview and an engineering case study in evidence-first agent security. Discuss the work.