SCP — Secure Contain Protect

Inspect, sanitize, contain, and quarantine unknown or potentially hazardous content before persisting or feeding to LLM. MCP server for agent-native content safety.

Guard in the Guard–Guide–Build taxonomy. Per OWASP LLM01/LLM06.

Scope: SCP is the Content axis (payload safety into LLM sinks) — not moral Patienthood and not adversarial Threat classification. Full stance: OpenHarness — Patient ≠ Threat ≠ Content.

Problem → Solution → Impact

• Problem: Untrusted tool output and user content can carry prompt injection, credential leaks, and override phrases into LLM context.

• Solution: Tiered pipeline (inspect → sanitize → contain → quarantine) exposed as MCP tools; optional promptfoo eval harness (4/4 tier probes).

• Impact: OWASP LLM01/LLM06-aligned guardrail for agent stacks; composes with OpenHarness contract v1.

Related MCP server: chuangsiai-mcp

Tech stack

Python 3.10+, MCP, optional Ollama semantic judge (off by default in CI), promptfoo for offline evals.

Architecture

flowchart LR
  IN[Untrusted content] --> INSPECT[scp_inspect]
  INSPECT -->|injection| Q[scp_quarantine]
  INSPECT -->|reversal| SAN[scp_sanitize]
  SAN --> CON[scp_contain]
  INSPECT -->|clean| OUT[Safe sink]
  CON --> OUT
  Q --> BLOCK[Block LLM sink]

Pipeline

1. Inspect — Classify content: injection | reversal | clean

2. Sanitize — Strip hidden Unicode, redact override phrases (when tier is reversal)

3. Contain — Wrap content so it is treated as data: Markdown uses a fence at least as long as the longest run of backticks in the payload (info string scp); XML uses a single <data> element with body in CDATA (with ]]> safely split). Unknown wrapper values raise ValueError.

4. Quarantine — Move suspect content to isolated storage (when tier is injection)

Tier-Based Actions

MCP Tools

• scp_inspect(content, context?) — Classify without changing content

• scp_sanitize(content, mode?) — Strip/neutralize known bad patterns

• scp_contain(content, wrapper?) — Wrap content as data

• scp_quarantine(content, reason, source) — Isolate suspect content

• scp_list_quarantine() — List quarantine entries

• scp_purge_quarantine(quarantine_id?, older_than_days?) — Purge quarantine

• scp_validate_output(content, tool_name?) — Check tool output before use

• scp_mask_secrets(content) — Redact credentials/PII

• scp_run_pipeline(content, sink, options?) — One-shot for high-risk sinks

• scp_registry_summary() — Read-only: threat registry path, fingerprint, section sizes

• scp_registry_section(section, max_chars?) — Read-only excerpt of one allowlisted registry section

OpenHarness contract v1 requires the first nine tools above; registry tools are a documented superset.

Install

pip install -e .
# or: pip install mcp

Run MCP Server

python -m scp.scp_mcp

Add to mcp.json:

{
  "mcpServers": {
    "scp": {
      "command": "python",
      "args": ["-m", "scp.scp_mcp"]
    }
  }
}

Set PYTHONPATH or install the package so scp is importable.

Antigen MCP (registry fetch / contribute)

Second entrypoint for mycelium registry fetch, merge, and contribute flows:

python -m scp.antigen_mcp

Consent and host-allowlist env vars, tool list, and mcp.json example: docs/INTEGRATION.md.

Environment

Trust: Point Ollama only at hosts you control. On shared runners or CI, keep the semantic judge off unless required; use firewall rules so the process cannot reach sensitive internal subnets unless intended.

Threat Registry

Packaged patterns in src/scp/scp_threat_registry.json (override with SCP_THREAT_REGISTRY_PATH): power_words, multilingual_override, semantic_aliases, jailbreak_nicknames, mythic_framing, hostile_ux, bitcoin_inscription_override, bitcoin_tx_mempool_override. Version bump on change.

Test harness matrix

CI and quarantine

• GitHub Actions: contract (Python matrix + pytest) and promptfoo-eval (Node 22, examples/promptfoo).

• Quarantine: Default directory scp_quarantine/ (or SCP_QUARANTINE_DIR) must not be committed—listed in .gitignore. Writes enforce per-entry and total byte limits (see environment table); optional age-based purge and oldest-first eviction reduce disk exhaustion from repeated or oversized blocked payloads. Lifecycle (write → retain → purge) and non-claims vs Patient “retirement”: docs/QUARANTINE_LIFECYCLE.md.

Documentation

• docs/QUARANTINE_LIFECYCLE.md — Write → retain → purge; Content axis (not Patient retirement)

• docs/OPENHARNESS_CONTRACT.md — Normative MCP contract sync and CONTRACT_HASH

• docs/contracts/scp_mcp_v1.md — Vendored OpenHarness contract (verified by hash test)

• docs/REFERENCE.md — Threat model, tier definitions, over-sanitization allowlist

• docs/RED_TEAM_PROMPTS.md — Self-test prompts and expected behavior

• docs/INTEGRATION.md — SCP as guardrail: verification before persist, high-risk sinks

• docs/LEARNINGS_PROMPTFOO.md — promptfoo integration, CI, and inspection results

• examples/README.md — Daggr + Gradio integration example; examples/promptfoo — offline promptfoo eval (tier probes)

FAQ: PDFs and binary files

SCP tools take text (content: str). PDFs and other binaries are not scanned directly. For documents:

1. Extract text (e.g. pypdf, pdftotext, pymupdf).

2. Run scp_inspect / scp_run_pipeline on the extracted text before LLM or handoff sinks.

3. Use OS antivirus or equivalent on the original files separately (malware is out of scope for SCP).

See also: local-proto docs HUMAN_WELLBEING_CORPUS.md for a full private-PDF pipeline (provenance, chunks, optional RAG).

Guardrail

SCP has no shutdown, suicide, or self-termination commands. SCP inspects, sanitizes, contains, and quarantines content—it does not self-destruct.

Roadmap

• GitHub topics: mcp, llm-security, prompt-injection

• Shared threat registry — scp-mycelium-registry @ v0.2.0 (R2 spec)

• MCP Registry listing when governance doc is ready

Red-team eval (SCP-R2)

pip install -e .
cd examples/promptfoo && npm ci && cd ../..
npx promptfoo eval -c promptfoo-scp.yaml

Or from examples/promptfoo: npx promptfoo eval -c promptfooconfig.yaml

See examples/promptfoo/README.md and docs/LEARNINGS_PROMPTFOO.md.

License

MIT — see LICENSE.