Source note
Show HN: Capframe – capability tokens for AI agent tool calls
Summary
Capframe is a local Rust toolkit that maps MCP tool access, issues scoped capability tokens, and enforces deterministic policies on AI agent tool calls. It targets indirect prompt-injection and excessive-authority risks in agents that can call external tools.
Problem
- AI agents connected through MCP can reach many tools, endpoints, and parameters, which makes their real authority hard to inspect.
- Unconstrained tool inputs and indirect-injection surfaces can let hostile content affect tool calls or push an agent beyond intended permissions.
- Security teams need audit evidence mapped to OWASP LLM Top 10, NIST AI RMF, and MITRE ATLAS.
Approach
findwalks MCP servers and tool endpoints, records parameters, flags unconstrained inputs and indirect-injection surfaces, and writescapframe.findings.json.bindissues scoped, revocable capability tokens with macaroon-style attenuation, ed25519 holder-of-key binding, limits such asmax_refund=50, and signed denial receipts using HMAC-SHA256.guardevaluates every tool call against YAML policy at runtime with deterministic Rust code, so allow and deny decisions do not depend on an LLM.reportexports HTML or PDF evidence mapped to OWASP LLM, NIST AI RMF, and MITRE ATLAS controls.
Results
- Example scan mapped 14 tools across 2 MCP servers and found 3 tools with unconstrained input tied to OWASP LLM01.
- A second example also found 1 indirect-injection surface tied to OWASP LLM01 and MITRE ATLAS T0051.
- Example token scoped
shopify-botto 2 tools, 2 limits, and a 24-hour TTL; concrete limits includemax_refund≤50andregion=eu. - Guard backtest reports 247/247 corpus cases passing across 14 rules and 3 categories, with a 0.0% false-positive rate.
- The report example shows OWASP LLM Top 10 coverage of 4/10 items, 2 open findings, 2 MITRE techniques flagged, and 0 active exploits.
- Runtime policy evaluation is claimed to run in single-digit microseconds.