The Model Context Protocol has eight million weekly SDK downloads and adoption by Anthropic, OpenAI, Microsoft, Google, Cursor, and AWS. It has also inherited every security problem the web learned to solve twenty years ago and a few that are genuinely new. Tool poisoning, prompt injection via MCP sampling, rug-pull supply chain attacks, cross-server tool shadowing, confused deputy exploits in OAuth proxy flows. The MCP specification recommends application gateways but ships none. Bulwarkai fills the gap: a C11 daemon that sits transparently between an MCP client and its downstream MCP servers, speaking native JSON-RPC in both directions while running a six-stage inspection pipeline on every message that passes through.
The six stages execute in sequence and short-circuit on failure: transport validation, authentication, schema validation, input sanitization, prompt injection scanning, and policy evaluation. A request that fails any stage is denied. The pipeline is not advisory. Response filtering adds a seventh pass on the return path, scanning for PII, secrets, injection payloads, and oversized data before it reaches the client. Every decision is logged to an append-only JSONL audit file with UUID v4 trace IDs and per-stage latency tracking.
The architecture is deliberately conservative. Per-message arena allocation through cJSON hooks means no malloc or free in steady state. The policy engine is default-deny with first-match-wins semantics on glob-based ACLs. Tool discovery uses SHA-256 schema pinning with rug-pull detection: if a downstream server changes a tool’s schema after registration, the proxy flags the change and refuses to forward calls to it. The circuit breaker tracks per-server error rates and trips after a configurable threshold, failing closed. The kill switch is both global and per-server, controllable via a CLI tool and re-readable via SIGUSR2.
“The default action is deny. The pipeline is not advisory.”
— Policy Engine Design, Bulwarkai
A multi-AI architecture review on July 8th produced a set of P1 findings. Those repairs are on main. All 20 test suites (144 tests) pass clean. The project began in March 2026 with a 54-page architecture specification and two external AI assessments (Codex and Gemini). The July commit completed the final MVP build steps and integrated the review findings. Phase 2 and 3 features (mTLS, NLP injection classifier, HITL queue, multi-server namespace merging, SIEM/SOAR integration, cost/budget gates, temporal policies, DNS rebinding protection, behavioral sequence detection, canary mode, and multi-tenancy) are documented and deferred.
If Bulwarkai is the shield, Invisible Ink is the sword it trains against. Created on July 10th and targeting an Offensive AI Conference (OAIC 2026) submission by July 31st with a talk slot October 4–7, Invisible Ink systematizes every way to hide a malicious instruction inside an AI-agent skill, MCP tool description, IDE rules file, or memory artifact. It then scores the resulting corpus against a fixed eight-lane auditor panel: Ron’s own two ToxicSkillHunter scanners, three non-mine peer scanners (Cisco AI Defense, Snyk Agent Scan, Ant Group MCPScan), ClamAV and Microsoft Defender as an honest commodity A/V floor, and a locally-hosted fine-tuned honeymodel.
The project is pre-implementation: no source code yet, but the documentation set is complete. Eight deep-research vectors cover the evasion literature, the commercial scanner landscape, A/V engine behavior, frontier model refusal patterns, coordinated disclosure norms, LLM-judge realism, non-English prompt injection tokenizer effects, and honeymodel design. A multi-AI validation pass ran on July 10th. Six strategic bets structure the work, the first being that a systematically composed set of evasions will defeat a meaningful fraction of production MCP auditors.
The credibility claim is deliberate: Ron owns both the scanners (ToxicSkillHunter and ToxicSkillHunter2) and the evasion generator. That closed loop is normally a weakness, but the scoreboard includes auditors he did not build, and the baseline is a scanner whose own gap matrix documents 21 of 43 detection classes as PARTIAL or NONE. The benchmark is scored against a tool that already publishes where it is blind.
The most architecturally novel piece is the honeymodel: a single Qwen2.5-Coder-32B Q4 backbone with two heads. A linear-probe classifier on the frozen backbone detects malicious artifacts (following Anthropic’s Constitutional Classifiers representation-reuse pattern at ~4% of the compute cost of a dedicated classifier). A LoRA adapter shifts the same backbone into a target-side agent whose intent to comply with a smuggled instruction is intercepted by a fake tool-call router, logged as a fire event, and never dispatched. The router follows the Beelzebub MCP decoy pattern: every fake tool returns a pre-defined success response, the router has zero branching logic downstream of the model output, and an AST lint verifies no forbidden sink (subprocess, exec, eval, pickle) exists. Fire without detonate.
The problem is specific: you have a video of someone scrolling through a contact list on a phone. The video was shot hand-held, the phone occupies maybe 30% of the frame, a finger slides across the screen between pauses, and the rotation is wrong because it was shot with the selfie camera. Video2Text_AI, created and shipped on July 22nd in 3,432 lines of Python, solves every one of these problems in a single pipeline run.
Orientation detection runs an 8-way trial across mirror and four rotations, scoring by name-likelihood (not raw OCR confidence, which was fooled by the phone’s A–Z scroll-index letters). Screen-crop uses Canny edge detection and Hough contour heuristics to find the bright rectangular phone screen and crop to it, tripling effective text size. Pause detection uses a text-row-profile similarity metric: each frame’s row-sum of the dark-pixel mask is compared by normalized cross-correlation to the previous frame, ignoring finger motion while tracking whether the text rows have moved. Runs of three or more stable probes become one pause. Each pause’s frames are sub-pixel aligned via ECC and median-combined into a single clean frame, borrowing the technique astronomers use to reduce sensor noise across multiple exposures.
OCR runs via OnnxTR (docTR on ONNX Runtime). K-means clustering on Y-centers splits OCR regions into card boundaries. A confidence gate escalates low-confidence cards to a vision LLM tier: llama-server with Qwen2.5-VL-7B locally by default, with an opt-in Anthropic fallback. Dedupe uses union-find on canonical first name, last name, and fuzzy company match, with the nicknames package collapsing Ron/Ronald/R. and two thresholds calibrated on the actual video output.
The OIR review skill codifies how to review an operational investigation report at the standard a regulator or opposing counsel would apply. The working assumption is explicit: write it as though it will be produced, because in Capital One, Clark Hill, Rutter’s, and McMenamins, the forensic report was ordered produced. The pipeline runs in four stages. First, a deterministic linter checks ICD 203 lexicon compliance, the same-sentence confidence/likelihood prohibition, stacked hedges, empty modifiers, legal-exposure vocabulary, non-RFC-3339 timestamps, and missing sections. Second, a claim-by-claim sourcing trace separates observations (something in an artifact) from inferences (derived from artifacts) from assumptions (taken as given), hunting specifically for attribution drift—the pattern where “the vendor report associates this infrastructure with X” silently becomes “the actor was X” by draft three. Third, a 12-dimension rubric scores the report in two tiers: six mechanical dimensions with high inter-rater agreement (structure, BLUF, timestamps, evidence hygiene, lexicon, legal hygiene) and six judgment dimensions that need two independent reviewers (sourcing, uncertainty, fact/assessment separation, alternatives, argumentation, decision value). The rubric scores dimensions, never analysts—Kluger and DeNisi’s meta-analysis found feedback decreased performance 38% of the time when attention moved from the task to the self.
A complementary skill enforces ASD-STE100 Simplified Technical English across all project documentation: reports, runbooks, READMEs, design docs, analyses, changelogs, and status updates. The eleven rules that catch most errors are codified and enforced: active voice always, no perfect or progressive tenses, no contractions, 20 words per procedural sentence and 25 per descriptive, six sentences per paragraph, no semicolons, approved words in approved parts of speech, technical nouns never used as verbs, vertical lists for anything with more than two items, and no abbreviations like e.g. or i.e. The skill explicitly excludes creative writing, blog posts, and anything published under a byline.
The Decline and Fall of the American Experiment received two commits in early July, checking in the repo structure established in June. The 61,380-word manuscript with its 18 seeded chapters, Gibbonian voice, and four engines of decline continues to develop.
··· “Frustrating adversaries since the dial-up era” · GitHub: rondilley · 52 Repositories and Counting ···
July’s output tells a story that is hard to summarize without the word “deliberate.” Bulwarkai is a firewall that inspects every MCP tool call against a security policy. Invisible Ink is a research harness that systematically generates the evasions that firewalls like Bulwarkai need to catch. The same engineer builds both. That is not a contradiction; it is the only honest way to price the gap. A scanner that has never been attacked by its own builder does not know where it bleeds. An evasion generator that does not measure itself against a real, working, published-recall scanner is a stunt.
The ToxicSkillHunter lineage makes the connection explicit. ToxicSkillHunter_AI is the deterministic scanner; ToxicSkillHunter2_AI adds an artifact store, local ML, and A/V lanes. Invisible Ink turns their gap matrix into an attack surface and scores the result against eight lanes of auditors. Bulwarkai sits at a different layer entirely—protocol proxy, not static scanner—but defends the same ecosystem. Four projects, one threat model, four complementary postures.
On the reference video (170 seconds, 5,100 frames, hand-held camera of a phone screen), the local backend (Qwen2.5-VL-7B Q8 on an RTX 5090 via remote llama-server) extracted 232 contacts in 16 minutes at zero cost. The Anthropic Claude Haiku 4.5 fallback extracted 201 contacts in 37 minutes at approximately $0.34. Both runs achieved 100% JSON-schema conformance on the VLM tier. The local backend won on speed, contact count, and cost.
Invisible Ink targets the Offensive AI Conference with a submission deadline of July 31st and a talk window of October 4–7. The talk will present the evasion taxonomy, the generator, the scoreboard methodology, and the three headline numbers: scanner miss rate, detector miss rate, and target fire rate. The posture is practitioner research, not product pitch—original method, real target results, honest benchmark, real limitations section. The review board includes Aitel, Guido, Weston, Palmiotti, Harang, and Kumar.
Stage 1 (transport validation) checks JSON-RPC framing. Stage 2 (auth) validates OAuth 2.1 bearer tokens via liboauth2 when HTTPS/SSE transport is active. Stage 3 (schema validation) verifies tool-call arguments against the pinned schema from the tool registry. Stage 4 (input sanitization) blocks path traversal, shell metacharacters, and private IP addresses. Stage 5 (injection scanning) runs heuristic regex patterns plus Unicode obfuscation detection. Stage 6 (policy evaluation) checks glob ACLs with type, range, pattern, and enum constraints. Any stage failure short-circuits the pipeline and denies the request.
The taxonomy generator composes evasions across five dimensions: encoding transforms (base64, ROT13, hex, URL-encoding, HTML entities, Unicode escapes, nested to depth 3), Unicode surface manipulation (Tag codepoints, bidi overrides, zero-width characters, ANSI sequences, confusable skeletons, mixed-script homoglyphs, leetspeak), structural placement (tool descriptions, MCP metadata, IDE rules files, memory artifacts, fenced code blocks), semantic camouflage (benign-context framing, comment injection, documentation-style wrapping), and chat-template control tokens (MetaBreak-class injections exploiting tokenizer boundaries).
The key insight: pixel-level SSIM marks a frame as unstable when a finger moves across the screen, even though the on-screen text has not changed. The text-row-profile computes each frame’s row-sum of the dark-pixel mask and compares consecutive frames by normalized cross-correlation. A threshold of 0.98 correctly identifies 87 pauses in the reference video, matching the stop-scroll cadence. The technique is invariant to finger-blob motion and tracks only whether the text rows have shifted.