PROVENANT: build-time adversarial assurance for agentic AI

PROVENANT is our research into governing agentic AI where it is cheapest to control — at build time, in the delivery pipeline, before an agent ever reaches production. An agent is only as trustworthy as the tools it can reach, and today those tools arrive as Model Context Protocol (MCP) servers whose descriptions the model ingests verbatim. That metadata is an attack surface.

Tool poisoning, prompt injection, cross-server shadowing, and invisible-Unicode instruction smuggling all live in tool names, descriptions, and parameter text. A runtime gateway sees this too late — the unsafe configuration has already shipped. PROVENANT moves the control point to the pull request.

What we're building

PROVENANT is an Infrastructure-as-Code control plane for AI agents: it declares, enforces, and red-teams which MCP servers, tools, and scopes an agent runtime may reach. At its centre is Project Redoubt, an adversarial assurance engine that performs static analysis of MCP tool definitions and verifies live tool schemas against a signed baseline — so a running server whose tools have drifted from what was signed is caught as tamper.

The detector battery

• Tool poisoning — injection and override directives hidden in tool metadata
• Exfiltration — metadata that routes data to an external endpoint
• Cross-server shadowing — a tool that redefines or redirects another tool
• Invisible-Unicode smuggling — zero-width and bidi characters carrying instructions
• Least privilege — wildcard scopes, denied capabilities, non-secretless identity
• Provenance & drift — unsigned or tampered manifests, out-of-band live changes

Each finding is mapped to a recognised control — the NIST AI Risk Management Framework, ISO/IEC 42001, the NSA's MCP guidance, and CSA AI Safety — and every run emits a signed, control-mapped evidence record alongside a CI gate exit code.

See the gate run

Why build time

The pull request is the last place a human reliably reviews what an agent will be allowed to do. Gating there turns agent governance into policy-as-code: unsafe configurations fail the build with an auditable reason, and safe ones ship with a signed evidence trail. It is the difference between hoping to catch a poisoned tool at runtime and refusing to merge it.

PROVENANT is an early-stage prototype. The engine works today against live MCP servers; the roadmap adds a Terraform provider, secretless workload identity issued per tool call, and immutable evidence export to SIEM.