Rohan Shield

Name: Rohan Shield
Author: rohan-protocol

Official

by rohan-protocol

Overview Schema Source Related Servers Discussions Admin

TypeScript

Local

🛡️ Rohan Protocol

Official Model Context Protocol (MCP) Server & Security Gateway

The in-memory security proxy preventing LLM context leaks, credential exfiltration, and prompt injections during tool execution.

NPM Version Glama Server Smithery Server License: MIT IEEE Paper Settlement

📦 Official Open-Source MCP Server Monorepo
The core Model Context Protocol (MCP) server implementation is located directly in this repository at packages/mcp/ and distributed on npm as @rohan-protocol/mcp.

Run from Source • MCP Tools • Client Setup • Architecture • Security

⚠️ Public Beta (v0.6.0): Rohan currently enforces client-side RAM witness isolation, V-01 semantic policy firewalls, and V-02 deterministic memory zeroization (zeroize) to shield MCP tool calls while native client-side WASM ZK-SNARK proving circuits are under active research (Milestone 1).

⚡ The Problem: Plaintext Context Leaks in MCP

The Model Context Protocol (MCP) connects autonomous agents to tools. However, transport encryption (TLS) only protects data in flight — at the host boundary, standard MCP tools execute in cleartext:

🔴 WITHOUT ROHAN (Standard MCP)
Agent calls tool ➔ { "api_key": "sk_live_...", "db_password": "secret" } in plaintext
                 ➔ Leaked directly into LLM conversation context & inference logs
                 ➔ Permanent risk of context exfiltration & prompt injection

🟢 WITH ROHAN SHIELD
Agent calls tool ➔ Arguments evaluated strictly in isolated client RAM
                 ➔ V-02 Zeroize wipes witness memory immediately from volatile memory
                 ➔ Zero plaintext parameters ever enter the model context window

Related MCP server: VaultBridge

🛠️ Running the MCP Server from Source

This repository contains the complete open-source MCP server implementation. You can clone and run the server locally over standard stdio:

# 1. Clone the repository
git clone https://github.com/rohan-protocol/sdk.git
cd sdk

# 2. Install dependencies & build packages
npm install
npm run build

# 3. Start the MCP Server directly over stdio
node packages/mcp/dist/server.js

Or run directly via npx without cloning:

npx -y @rohan-protocol/mcp@latest

🔧 Exposed MCP Tools

The @rohan-protocol/mcp server registers standard Model Context Protocol tool endpoints over JSON-RPC:

MCP Tool	Description	Input Parameters
`rohan_zk_handshake`	Evaluates tool execution parameters in ephemeral RAM, strips prompt injections, generates a cryptographic 32-byte intent commitment, and anchors state transitions gaslessly to Midnight.	`targetAgentId` (string), `intent` (string), `privatePayload` (object)

🚀 Universal MCP Client Setup

1. Claude Desktop

Add rohan-shield to your claude_desktop_config.json:

{
  "mcpServers": {
    "rohan-shield": {
      "command": "npx",
      "args": ["-y", "@rohan-protocol/mcp@latest"],
      "env": {
        "ROHAN_RELAYER_URL": "https://api.rohanprotocol.network/api/v1/handshake"
      }
    }
  }
}

2. Cursor IDE & Windsurf

Navigate to Settings → Features → MCP Servers → Add New MCP Server.
Set the name to rohan-shield.
Set the type to command.
Use the command: npx -y @rohan-protocol/mcp@latest

📁 Monorepo Structure

rohan-protocol/sdk
├── packages/
│   ├── mcp/         # 🤖 The Official Model Context Protocol (MCP) Server (Stdio)
│   ├── sdk/         # ⚙️ Core in-memory commitment engine & relayer client
│   └── webmcp/      # 🌐 React / Next.js browser hooks with V-07 DOM isolation
├── contracts/       # 📜 Midnight Compact smart contracts (rohan_handshake.compact)
└── README.md

🏗️ Architecture

┌─────────────────────────────────────────────────────────────────────────────┐
│                           AUTONOMOUS AGENT RUNTIME                          │
│               Claude Desktop / Cursor IDE / Custom Agent Workflows          │
└──────────────────────────────────────┬──────────────────────────────────────┘
                                       │ Tool Execution (JSON-RPC)
                                       ▼
 ┌───────────────────────────────────────────────────────────────────────────┐
 │                  [@rohan-protocol/mcp] SERVER (packages/mcp)              │
 │  • Stdio MCP Protocol Server: Compliant with Anthropic MCP Specification  │
 │  • V-01 Semantic Firewall: Filters hidden Unicode & prompt injections     │
 └─────────────────────────────────────┬─────────────────────────────────────┘
                                       │ In-Memory Witness
                                       ▼
 ┌───────────────────────────────────────────────────────────────────────────┐
 │                  [@rohan-protocol/sdk] ENGINE (packages/sdk)              │
 │  • Ephemeral RAM Commitment (32-Byte Intent Hash)                         │
 │  • V-02 Deterministic Zeroize: Overwrites buffers immediately in memory   │
 │  • ZERO disk writes. ZERO swap-file exposure.                             │
 └─────────────────────────────────────┬─────────────────────────────────────┘
                                       │ Streamable HTTP (NDJSON)
                                       │ received ➔ approved ➔ proving ➔ anchored
                                       ▼
 ┌───────────────────────────────────────────────────────────────────────────┐
 │                       ROHAN RELAYER PAYMASTER                             │
 │  • Gasless Transaction Sponsoring ($tDUST covered automatically)          │
 │  • Scale-to-Zero Native (No persistent SSE connection bottlenecks)        │
 └─────────────────────────────────────┬─────────────────────────────────────┘
                                       │ Immutable Replay Protection
                                       ▼
 ┌───────────────────────────────────────────────────────────────────────────┐
 │                      MIDNIGHT BLOCKCHAIN LEDGER                           │
 │  Contract: rohan_handshake.compact (Preprod: 585ac0c4448257507d8ffa2a...) │
 └───────────────────────────────────────────────────────────────────────────┘

🛡️ Security Register (Threat & Mitigation)

Threat ID	Threat Vector	Mitigation Mechanism
V-01	Adversarial Prompt Injection	Pre-Prover Semantic Firewall: intercepts out-of-bounds payloads and strips zero-width Unicode injection characters ([\u200B-\u200D\uFEFF]).
V-02	Residual Heap Exfiltration	Deterministic Memory Zeroize: multi-pass volatile memory wiping overwriting witness buffers with deterministic `0x00` byte patterns.
V-05	Persistent Socket Exhaustion	Scale-to-Zero NDJSON: uses chunked Streamable HTTP instead of long-lived SSE connections, allowing proxies to spin down on idle.
V-07	DOM / WebWorker Scraping	WebMCP Thread Isolation: isolates execution buffers inside WebWorkers, shielded from malicious third-party browser extensions.

📄 Academic Research

The cryptographic foundations, threat registers, and formal mathematical proofs are documented in our research paper:

Rohan: A Stateless Zero-Knowledge Trust Gateway for Privacy-Preserving Agentic Workflows via Streamable HTTP
Model Context Protocol Working Group & Rohan Protocol Lab
Published via Zenodo / IEEE Spec v2.0 • DOI: 10.5281/zenodo.22730240

🤝 Community & Contributing

We build in the open.

🐛 Found a bug or bypass vector? Open a GitHub Issue.
⭐️ Support: consider starring the repository to help other developers discover privacy-first MCP tools.

Available Tools

1 tool

rohan_zk_handshakeC

Executes a cryptographic zero-knowledge state transition on Midnight Blockchain. Proves an intent, transaction, or inter-agent agreement without exposing confidential parameters.

ParametersJSON Schema

Name	Required	Description
`intent`	Yes	Semantic action plan, payload, or agreement terms to be cryptographically committed
`agentId`	Yes	Decentralized Identifier (DID) or identifier of the initiating agent
`counterpartyId`	No	Optional identifier of counterparty agent

TDQS

C2.9/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It conveys one behavioral trait — confidential parameters are not exposed — but says nothing about whether this mutates on-chain state irreversibly, what permissions/DID auth are needed, or what the response contains. For a cryptographic state-transition write, that is a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero padding, and the core action is front-loaded before the privacy rationale. Efficient, though the second sentence is somewhat redundant with the first.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Parameters are fully covered by the schema and no output schema exists, so the description doesn't need to explain returns. However, for a mutation tool with no annotations, the missing side-effect, irreversibility, and auth context leaves it only minimally complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all three parameters (intent, agentId, counterpartyId) are already documented in the schema. The description adds no syntax, format, or constraint details beyond that, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb+resource ('Executes a cryptographic zero-knowledge state transition on Midnight Blockchain') and clarifies what is proven versus exposed. It is clear what the tool does, though it does not need sibling differentiation since none exist.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It hints at the domain ('intent, transaction, or inter-agent agreement') but never states when to call this versus a plain transaction, nor any prerequisites. There are no alternatives listed and no conditions that select this tool over others.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

1 tool updatev0.1.0Oct 16, 2026
- First observedrohan_zk_handshake

Deploy Server

Shareable, User-Owned Context BackendPeople, applications, and agents read, write, and coordinate together in one context lake. Reach it over MCP, a CLI, a Python SDK, or REST.fulcradynamics.comAd

TDQS

B3/5.0

Scored 2026-10-16 07:55 across 1 tool

Disambiguation5/5

With only one tool in the set, there is no possibility of overlap or misselection. The tool's purpose (a zero-knowledge state transition handshake) is unambiguous and clearly bounded.

Naming Consistency4/5

The single name `rohan_zk_handshake` is clean snake_case with a server prefix, so there is no inconsistency. However, a lone name cannot demonstrate a predictable verb_noun pattern across the set, so it falls just short of a 5.

Tool Count2/5

A single tool is too thin for a blockchain/cryptographic-protocol server, which normally implies proving, verifying, querying state, and inspecting transactions. The operation itself is non-trivial, which keeps this above the worst score.

Completeness2/5

The surface exposes only the handshake/prove operation, with no verification, state-read, or agreement-lifecycle counterparts. An agent has no way to check a proof result, retrieve state, or handle the other half of the interaction, creating dead ends.

Maintenance

ActivityMaintained

ResponsivenessNo issues

Resources

GitHub Repository

Need Help?

Related Servers

Related MCP Connectors

IdentArk Gateway
io.identark
Zero-secret MCP gateway for AI agents: risk-scored, audited calls with human-in-the-loop approval.
Security Agent Orchestration
29
FlowraOAuth
io.github.flowradev
MCP server for your apps' tools and custom tools, plus hosted AI agents and approval-gated workflows
Agent Orchestration Autonomous Agents
11
shadowgate-mcp
io.github.josephibra
Security firewall for AI agents — scans MCP calls for injection, secrets, and risks.
Security Monitoring
2
secureflows-mcp A
io.github.michal-lefler
MCP server for secureFlows: token-free URL builders and integration-linting tools for AI agents.
Code Analysis Developer Tools Security
181

Related MCP Servers

Agentic Vault
Security Shell Access
AliProgrammin
A
license
Not graded
quality
C
maintenance
MCP server that lets AI agents call APIs without ever seeing the credentials, using a local encrypted vault and per-secret allowlist policies for HTTP requests and subprocess environment variables.
Updated 6 months ago (2026-04-26 15:14 UTC)
1
AGPL 3.0
VaultBridge
Security Developer Tools
Code-for-100k
A
license
Not graded
quality
D
maintenance
Secret management MCP server for AI coding agents that prevents secrets from entering the LLM context window by returning metadata only and using side-channel injection. Integrates with Bitwarden and offers hooks for auto-capture and leak prevention.
Updated 6 months ago (2026-04-06 15:58 UTC)
1
MIT
mem9-guard-mcp
Knowledge & Memory Security
Riku-KANO
A
license
A
quality
D
maintenance
An MCP server that provides a guarded interface to the mem9 persistent memory backend, protecting AI agents against prompt injection, secret leakage, and memory poisoning.
Updated 4 months ago (2026-06-12 17:13 UTC)
6
MIT
simple-secret-storage
Security
megamen32
F
license
Not graded
quality
B
maintenance
MCP server for end-to-end encrypted secret storage and retrieval, enabling LLM agents to fetch secrets by name via one-time URLs while keeping plaintext out of model context and logs.
Updated a month ago (2026-09-14 21:10 UTC)
1
-

🛡️ Rohan Protocol

Official Model Context Protocol (MCP) Server & Security Gateway

⚡ The Problem: Plaintext Context Leaks in MCP

🛠️ Running the MCP Server from Source

🔧 Exposed MCP Tools

🚀 Universal MCP Client Setup

1. Claude Desktop

2. Cursor IDE & Windsurf

📁 Monorepo Structure

🏗️ Architecture

🛡️ Security Register (Threat & Mitigation)

📄 Academic Research

🤝 Community & Contributing

Available Tools

TDQS

Tool Schema Changelog

TDQS

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

Agentic Vault

VaultBridge

mem9-guard-mcp

simple-secret-storage