Rohan Protocol MCP 服務推出零寫入記憶體隱私防護盾

Official Model Context Protocol (MCP) Server & Security Gateway

The in-memory security proxy preventing LLM context leaks, credential exfiltration, and prompt injections during tool execution.

📦 Official Open-Source MCP Server Monorepo
The core Model Context Protocol (MCP) server implementation is located directly in this repository at packages/mcp/ and distributed on npm as @rohan-protocol/mcp.

Run from Source • MCP Tools • Client Setup • Architecture • Security

⚠️ Public Beta (v0.6.0): Rohan currently enforces client-side RAM witness isolation, V-01 semantic policy firewalls, and V-02 deterministic memory zeroization (zeroize) to shield MCP tool calls while native client-side WASM ZK-SNARK proving circuits are under active research (Milestone 1).

⚡ The Problem: Plaintext Context Leaks in MCP

The Model Context Protocol (MCP) connects autonomous agents to tools. However, transport encryption (TLS) only protects data in flight — at the host boundary, standard MCP tools execute in cleartext:

🔴 WITHOUT ROHAN (Standard MCP)
Agent calls tool ➔ { "api_key": "sk_live_...", "db_password": "secret" } in plaintext
                 ➔ Leaked directly into LLM conversation context & inference logs
                 ➔ Permanent risk of context exfiltration & prompt injection

🟢 WITH ROHAN SHIELD
Agent calls tool ➔ Arguments evaluated strictly in isolated client RAM
                 ➔ V-02 Zeroize wipes witness memory immediately from volatile memory
                 ➔ Zero plaintext parameters ever enter the model context window

🛠️ Running the MCP Server from Source

This repository contains the complete open-source MCP server implementation. You can clone and run the server locally over standard stdio:

# 1. Clone the repository
git clone https://github.com/rohan-protocol/sdk.git
cd sdk

# 2. Install dependencies & build packages
npm install
npm run build

# 3. Start the MCP Server directly over stdio
node packages/mcp/dist/server.js

Or run directly via npx without cloning:

npx -y @rohan-protocol/mcp@latest

🔧 Exposed MCP Tools

The @rohan-protocol/mcp server registers standard Model Context Protocol tool endpoints over JSON-RPC:

MCP Tool	Description	Input Parameters
`rohan_zk_handshake`	Evaluates tool execution parameters in ephemeral RAM, strips prompt injections, generates a cryptographic 32-byte intent commitment, and anchors state transitions gaslessly to Midnight.	`targetAgentId` (string), `intent` (string), `privatePayload` (object)

🚀 Universal MCP Client Setup

1. Claude Desktop

Add rohan-shield to your claude_desktop_config.json:

{
  "mcpServers": {
    "rohan-shield": {
      "command": "npx",
      "args": ["-y", "@rohan-protocol/mcp@latest"],
      "env": {
        "ROHAN_RELAYER_URL": "https://api.rohanprotocol.network/api/v1/handshake"
      }
    }
  }
}

2. Cursor IDE & Windsurf

Navigate to Settings → Features → MCP Servers → Add New MCP Server.
Set the name to rohan-shield.
Set the type to command.
Use the command: npx -y @rohan-protocol/mcp@latest

📁 Monorepo Structure

rohan-protocol/sdk
├── packages/
│   ├── mcp/         # 🤖 The Official Model Context Protocol (MCP) Server (Stdio)
│   ├── sdk/         # ⚙️ Core in-memory commitment engine & relayer client
│   └── webmcp/      # 🌐 React / Next.js browser hooks with V-07 DOM isolation
├── contracts/       # 📜 Midnight Compact smart contracts (rohan_handshake.compact)
└── README.md

🏗️ Architecture

┌─────────────────────────────────────────────────────────────────────────────┐
│                           AUTONOMOUS AGENT RUNTIME                          │
│               Claude Desktop / Cursor IDE / Custom Agent Workflows          │
└──────────────────────────────────────┬──────────────────────────────────────┘
                                       │ Tool Execution (JSON-RPC)
                                       ▼
 ┌───────────────────────────────────────────────────────────────────────────┐
 │                  [@rohan-protocol/mcp] SERVER (packages/mcp)              │
 │  • Stdio MCP Protocol Server: Compliant with Anthropic MCP Specification  │
 │  • V-01 Semantic Firewall: Filters hidden Unicode & prompt injections     │
 └─────────────────────────────────────┬─────────────────────────────────────┘
                                       │ In-Memory Witness
                                       ▼
 ┌───────────────────────────────────────────────────────────────────────────┐
 │                  [@rohan-protocol/sdk] ENGINE (packages/sdk)              │
 │  • Ephemeral RAM Commitment (32-Byte Intent Hash)                         │
 │  • V-02 Deterministic Zeroize: Overwrites buffers immediately in memory   │
 │  • ZERO disk writes. ZERO swap-file exposure.                             │
 └─────────────────────────────────────┬─────────────────────────────────────┘
                                       │ Streamable HTTP (NDJSON)
                                       │ received ➔ approved ➔ proving ➔ anchored
                                       ▼
 ┌───────────────────────────────────────────────────────────────────────────┐
 │                       ROHAN RELAYER PAYMASTER                             │
 │  • Gasless Transaction Sponsoring ($tDUST covered automatically)          │
 │  • Scale-to-Zero Native (No persistent SSE connection bottlenecks)        │
 └─────────────────────────────────────┬─────────────────────────────────────┘
                                       │ Immutable Replay Protection
                                       ▼
 ┌───────────────────────────────────────────────────────────────────────────┐
 │                      MIDNIGHT BLOCKCHAIN LEDGER                           │
 │  Contract: rohan_handshake.compact (Preprod: 585ac0c4448257507d8ffa2a...) │
 └───────────────────────────────────────────────────────────────────────────┘

🛡️ Security Register (Threat & Mitigation)

Threat ID	Threat Vector	Mitigation Mechanism
V-01	Adversarial Prompt Injection	Pre-Prover Semantic Firewall: intercepts out-of-bounds payloads and strips zero-width Unicode injection characters ([\u200B-\u200D\uFEFF]).
V-02	Residual Heap Exfiltration	Deterministic Memory Zeroize: multi-pass volatile memory wiping overwriting witness buffers with deterministic `0x00` byte patterns.
V-05	Persistent Socket Exhaustion	Scale-to-Zero NDJSON: uses chunked Streamable HTTP instead of long-lived SSE connections, allowing proxies to spin down on idle.
V-07	DOM / WebWorker Scraping	WebMCP Thread Isolation: isolates execution buffers inside WebWorkers, shielded from malicious third-party browser extensions.

📄 Academic Research

The cryptographic foundations, threat registers, and formal mathematical proofs are documented in our research paper:

Rohan: A Stateless Zero-Knowledge Trust Gateway for Privacy-Preserving Agentic Workflows via Streamable HTTP
Model Context Protocol Working Group & Rohan Protocol Lab
Published via Zenodo / IEEE Spec v2.0 • DOI: 10.5281/zenodo.22730240

🤝 Community & Contributing

We build in the open.

🐛 Found a bug or bypass vector? Open a GitHub Issue.
⭐️ Support: consider starring the repository to help other developers discover privacy-first MCP tools.

_{Licensed under the MIT License. Maintained by the Rohan Protocol community.}