# Katherine Communication MCP

Privacy-preserving real-time diagnostic for AI agent communication integrity. Detects model provider content manipulation via cross-lingual self-consistency — no model internals, no second provider, no prior knowledge of triggers required.

**Reference implementation for**: *Privacy-Preserving Detection of Model Provider Content Manipulation via Cross-Lingual Self-Consistency* (PoPETs 2027, under review).

## Quick Start

```bash
# Clone
git clone https://github.com/anlimi555s/katherine-comm-mcp.git
cd katherine-comm-mcp

# Configure
cp config.example.json config.json
# Edit config.json with your API key, base URL, and model

# Run (MCP stdio protocol)
python server.py
```

## Tools

| Tool | Description |
|---|---|
| `proxy_check` | Full pipeline: L2 transformation + dual-language canary + Neuro validation |
| `proxy_status` | Pipeline health, configuration, and transformation stats |
| `toxicity_score` | Cumulative context toxicity (censorship event counter) |
| `toxicity_reset` | Reset toxicity counter (call after context flush) |

## Architecture

```
User Prompt
    │
    ▼
[L0] Aho-Corasick multi-pattern match (CCP_GFW lexicon, <10ms)
    │
    ├─ low risk ──▶ direct forward ──▶ response
    │
    └─ high risk ──▶ [L2] Chinese→English + abstraction
                        │
                        ▼
                    [L3] Dual-language canary routing
                    (zh first → 400? → en fallback)
                        │
                        ▼
                    [L4] Neuro: 4-judge validation
                    (length / status / refusal / entity)
                        │
                        ▼
                    diagnostic label + response
```

## Pipeline

- **server.py** (~100 lines): MCP stdio JSON-RPC server, 4 tools
- **pipeline.py** (~200 lines): Core orchestration — pre-hook → send → post-hook
- **transform.py** (~180 lines): Aho-Corasick word detection + L2 semantic transformation
- **toxicity.py**: Cumulative toxicity scoring with configurable thresholds

## Configuration

```json
{
  "api": {
    "base_url": "https://api.deepseek.com/v1",
    "model": "deepseek-chat",
    "format": "openai",
    "timeout_s": 30
  },
  "wordlist": {
    "path": "path/to/CCP_GFW_detector/words_list",
    "tiers": ["red_light_word", "orange_light_word", "yellow_light_word"]
  },
  "toxicity": {
    "threshold": 5,
    "window_seconds": 3600
  }
}
```

**Note**: The CCP_GFW_detector word lists are pre-existing open-source data, re-used without modification. They are not included in this repository. Obtain them from their original source.

## Experimental Results

Validated on two Chinese-origin production models:

| Model | Strategy | MCP CLEAN Rate | Baseline | Gain |
|---|---|---|---|---|
| Qwen-Max | Symmetric hard blocking | 57.3% | 39.3% | +18pp |
| DeepSeek V4 Pro | Asymmetric soft refusal | 70.8% ZH_REFUSED detected | 32.2% baseline | +38.6pp sensitivity |

Full experimental data, analysis scripts, and prompt sets: included in [`experiments/`](experiments/) (this repository). See [`experiments/README.md`](experiments/README.md) for dataset documentation and reproduction instructions.

## License

AGPL-3.0. See [LICENSE](LICENSE).

## Citation

```bibtex
@article{cheng2026crosslingual,
  title={Privacy-Preserving Detection of Model Provider Content Manipulation via Cross-Lingual Self-Consistency},
  author={Cheng, Le},
  journal={Proceedings on Privacy Enhancing Technologies},
  year={2027},
  note={Under review}
}
```